Boston Linux & UNIX was originally founded in 1994 as part of The Boston Computer Society. We meet on the third Wednesday of each month, online, via Jitsi Meet.

BLU Discuss list archive


[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[Discuss] free SSL certs from the EFF



> From: discuss-bounces+blu=nedharvey.com at blu.org [mailto:discuss-
> bounces+blu=nedharvey.com at blu.org] On Behalf Of Matthew Gillen
> 
> This is not without new attack vectors: you can only trust DNS responses
> as far as DNS-SEC goes, which unfortunately ends one-hop before
> end-systems (unless you run your own DNS server and force everything on
> your home network to use that; which I do but don't know how common
> that
> is).

Based on my understanding of DNSSEC, it doesn't add security except in esoteric edge cases.  Because your client doesn't have any point of trust - if your client queries DNS, there's no way for your client to know *this* response is authentic for your domain.  In theory, you could start using x509 certs to sign your DNS but then there's the chicken and egg problem.

I don't see any way to make DNS actually secure, except to completely scrap all of DNS in favor of a new "secure" DNS.  Which could literally be regular DNS with TLS on it, but the point is, as long as you try to make clients compatible with *both* the secure and insecure DNS, then attacking the secure DNS is trivial.  You just block secure DNS and cause the client to fallback to insecure DNS, or you just substitute whatever malicious DNS response you want, knowing that the client accepts insecure DNS responses.  There is no defense.



BLU is a member of BostonUserGroups
BLU is a member of BostonUserGroups
We also thank MIT for the use of their facilities.

Valid HTML 4.01! Valid CSS!



Boston Linux & Unix / webmaster@blu.org