Seven People Who Hold the Keys to Worldwide Internet Security

http://www.theguardian.com/technology/2014/feb/28/seven-people-keys-worldwide-internet-security-web

by hornokplease • 12 years ago

85 43 12 years ago

nly• 12 years ago

How did this article manage to not use the byte sequence 'DNSSEC' or mention the fact that it's only deployed on a tiny % of domains under TLDs that support it?

Reports like this just add to public misconception.

adrianb• 12 years ago

This comment provided me with more information than the entire article. Would you care to add more details on what the key cards are and what their power is (the article seems to be stuck on "can they shut down the internet?")

Diederich3• 12 years ago

I'm not a security expert, just an interested amateur.

Can someone explain how this step doesn't invalidate all of the hours of ceremony and procedure?

"Later Okubo will transmit the key on a secure channel to Verisign and this signed key will be made live across the internet."

Velox• 12 years ago

Signing the key is the important part. Proving that the key was in fact created by the people it was supposed to be. (I think they key does have to be kept secure, which could be done by using a one time pad. Theoretically unbreakable.)

Diederich3• 12 years ago

Right, that part I get. But isn't the security of the resultant key now left entirely to Verisign?

schoen• 12 years ago

That's a public key/private key issue (I think!): the key he sends to Verisign will be the public key from the ceremony, not the private key.

If I'm mistaken about this, I hope the secure channel is very very very secure!

Diederich3• 12 years ago

Indeed! And I'm not even thinking about the communication channel as much as...Verisign. Not picking on them, but it's just a single, US based organization.

EGreg• 12 years ago

Ok, centralization leads to silly things like this.

Namecoin is but one of many ways to decentralize DNS while even while having one centralized registry.

tptacek3• 12 years ago

Skimming this article, I couldn't tell if it was about DNSSEC or not. But if these are DNSSEC keys, you can safely ignore this story; DNSSEC is a sideshow. It's hopefully never going to see widespread deployment, and regardless of whether it does, it isn't going to make a difference for your security.

I've written a bunch about DNSSEC on HN (and elsewhere) and won't preemptively repeat myself. You might consider just taking my word for this.

computer• 12 years ago

Doesn't it mean we can do CA-free authenticated HTTPS? That would make it useful for me.

tptacek3• 12 years ago

No, it doesn't. It means that a different set of huge organizations, this time explicitly including world governments, will get added to the list of CA-equivalents.

Post-NSA-revelations, DNSSEC-based browser security is lunacy.

minimax• 12 years ago

Yes the author is apparently writing about "Root DNSSEC KSK Ceremony 16"

http://data.iana.org/ksk-ceremony/16/KC16_Scripts.pdf

tptacek3• 12 years ago

The author has been fooled into writing a dramatic story about a total nonevent.

JoachimSchipper• 12 years ago

DNSSEC is a sideshow.

I recently had the occasion to attend a meeting of a body recommending standards for the Dutch government. (Serving) DNSSEC has been on their "use or explain"-list for well over a year (and the Netherlands apparently leads worldwide DNSSEC adoption.) At the meeting, the other attendees expressed their sincere regret that the DANE proposal, although a great idea, was still too immature.

As you probably know, DANE says that you "MUST" implement "trust this certificate, no matter what any CA says" over DNSSEC; combined with the fact that DNSSEC servers usually hold the signing keys online (NSEC3), implementing DANE is significantly less secure than just trusting the CA's. In fact, the Netherlands put quite a bit of effort into a government PKI infrastructure after our previous CA (DigiNotar) got pwned; it's not clear that requiring e.g. municipal system administrators to handle their own cryptographic keys is an improvement over what we have now.

Which is to say, don't discount well-meaning public servants; "given enough thrust, pigs can (temporarily) reach 6% of cruising altitude." </snark> [1,2]

[1] https://tools.ietf.org/html/rfc1925

[2] http://www.networkworld.com/news/2012/092412-ipv6-traffic-26...

jedberg• 12 years ago

Doesn't revealing the identities of the key holders somewhat compromise the system? Ot at least make it more vulnerable?

bitJericho• 12 years ago

Reminds me of http://www.youtube.com/watch?v=iDbyYGrswtg

IceyEC• 12 years ago

"Once activated by the smartcards, this will produce a lengthy cryptographic code. If dropped, or even knocked too hard, the machine will self-destruct."

gph• 12 years ago

The first few paragraphs really overdramatize it. It makes it sound like the internet would completely cease to exist if something happened to the root DNS servers. It was so cheesy I just couldn't read anymore after that.

higherpurpose• 12 years ago

I wish this story didn't read like a novel, and actually gave me the meat of the information more quickly. I feel like the way the author told the story diluted the importance of it.

PhantomGremlin• 12 years ago

I agree with you, it's way way way too long. And overly dramatic. I gave up reading pretty quickly.

However, judging by other comments here, I'm not sure there really was any "importance" to "dilute". It's probably just a way for apparatchiks to justify all-expense-paid vacations twice a year.

smutticus• 12 years ago

It's ICANN, not Icann. This article is overly sensational.

matthewsimon• 12 years ago

The Guardian's UK stylesheet calls for this treatment of acronyms that are pronounced as a word -- people say "Icann", not "Eye See Aye En En" -- which does seem odd but may be acceptable as a regionalism.

akira2501• 12 years ago

Some people make the following distinction: when pronounced as a word, it's an acronym. If it's not, then it's an initialism.

davidu4• 12 years ago

This is really one of the worst kinds of stories. It's just not true, and not only is it not true, it purports to cover DNSSEC as a technology that people RELY or NEED, when in fact, DNSSEC adoption never gained traction, and actually decreases every single day.

Someone spun some crazy PR for this one.

blibble• 12 years ago

in the interests of transparency: parent's business (OpenDNS) will have severe problems operating (replacing legitimate responses with spoofed ones) when DNSSEC is adopted.

jessaustin• 12 years ago

I think you're missing an "if" somewhere.

davidu4• 12 years ago

That's actually not true, not even a little bit. We've covered this before. When the resolver issues a query, we can disable the DS bit and disable DNSSEC for our customers. Alternatively, we can extend our DNSCrypt client to do validation and rejection of malicious responses.

DNSSEC doesn't add security, nor does it prevent our business from operating to the fullest extent.

bascule• 12 years ago

In addition to everything else that's wrong with DNSSEC, using Shamir to share a digital signature key is a silly idea. Multisignature trust systems / threshold signatures provide the same functionality, but without having a single secret that has to live on one computer at a single time. While I know they did their due diligence to prevent the leak of the DNSSEC root key, it's a problem they could've easily avoided by using an incredibly boring design rather than a more "clever" one like Shamir. As things stand, there is actually one key that could completely destroy DNSSEC and require the thing be bootstrapped again from scratch.

DavidWanjiru• 12 years ago

Oh, like scylla in "Prison Break?

acd• 12 years ago

Internet security is pwned by organisations powerful enough to hack into CAs or simply buy one and run them as a covert operation impersonating any site they want by issuing certificates trusted by all web browsers. Internet security broken by design of centralization.

Thus if you have IP A you will get fake certificate generated by government owned CA, if you have IP B you will get to the real site. If you are IP A you will get pwned by MITM attack malware the site will look genuine to the browser.

MichaelGG• 12 years ago

Governments already directly own CAs.

The mitigation for the attack you outlined is that such attacks will be detected, and the CA will get blacklisted. That may not actually work in the real world.

gwu783• 12 years ago

"We peaked at 12."

Peaked. And that probably includes the sysadmin who was required to watch it.

Where are the articles on the new ridiculous TLD's?

A while back the IP address for the FTP copy of the root.zone changed.

And sure enough, the file is now full of crap like .buzz, .house and .kitchen

I cannot even read through the whole zone anymore. It's too long.

There are some gems in there though. And some fool paid $185,000+ for each one.

I have been running my own root for years and this is why.

Snip, snip. No more .buzz

Very easy to set up up your own custom root and to filter out the crap TLD's. But, like with the ceremony in this article, some folks think that ICANN has some sort of "authority" on how people use domain names.

Whole .com zone (=public information) fits on a USB stick.

And the HOSTS file remains as a failsafe, if you have to use someone else's resolver.

And most of the entries in the com.zone are garbage anyway: parked names with ads.

Imagine how many different domains the average user will visit in their lifetime. It is but a small fraction of all the names registered.

But let's pretend ICANN is relevant.

God help us if ICANN should cease to exist.

ChristianBundy• 12 years ago

How do you manage your own root?

gwu783• 12 years ago

1. Get copy of the file "root.zone" from ftp.internic.net

2. Load it into tinydns or nsd. I have a sed script that translates BIND format into tinydns format, but if you search you will find someone has written one in C.

3. Point your resolver at your root.

4. Create or delete TLD's at will, not to mention many other benefits.

Running your own DNS gives lots of control. Most malicious or deceptive practices that tarnish the internet rely on DNS. When you control your own, you can neutralize a very large percentage of it.

Redirecting .apple.com to your own httpd will show you just how bad this company has gotten.

You can also redirect ad servers like .doubleclick.net and voila, you will have free apps with NO ADS.

Seven People Who Hold the Keys to Worldwide Internet Security

Related Stories