Slashdot Mirror

← Back to Stories (view on slashdot.org)

Secure DNS a Hard Sell

Posted by ScuttleMonkey on from the underdeveloped-ideas dept.

ebresie writes "Computer Business Review Online has an interesting article about the lack of acceptance for Secure DNS." From the article: "Speaking during a workshop on the technology, Keith Schwalm of Good Harbor Consulting, a former US Secret Service agent, said that even the financial sector, traditional security early-adopters, are not rushing DNSsec."

3 of 142 comments (clear)

  1. Hard to understand by Mr.+Flibble · · Score: 4, Insightful

    Enough of my customers don't understand REGULAR DNS, nevermind secure DNS. The only way that this is likely to be adopted is to have the top level name servers eventually require the secure extensions. I doubt, however, that that will happen.

    As it is now, I have my users going to their registrars and "deleting the 'A' records because: "There is no A on my website."

    --
    Try to hack my 31337 firewall!
  2. Same as Sony by Nom+du+Keyboard · · Score: 5, Insightful
    While the vulnerabilities in the DNS are well known, the absence of widespread attacks, regulations, and proven business models are holding back DNSsec adoption

    One could have said the same thing about music CD DRM (e.g. the Sony XCP RootKit) -- or the 9/11 terrorist attacks for that matter.

    There's not a problem with it -- until there's a big problem with it. Then everyone asks why wasn't something done to protect us against it?

    --
    "It's the height of ridiculousness to say for those 9 lines you get hundreds of millions."
  3. Re:bigger fear by Agelmar · · Score: 4, Insightful

    This is a valid point, especially when you look at the number of small fish in the pond. You have small registrars, you have small CAs (do you really trust Unizeto? I don't even know what it is, and yet by default Mozilla gives it the same trust as it gives Verisign.) Even so, I posit that it really doesn't matter how much trust I can place in the CAs and the registrars, because the (unfortunate) end result is that most users, when presented with a certificate error, simply click OK. We train users to do this. Many corporate and educational entities set up their own CAs, and then when users see a message in their browser about an untrusted CA, the tech staff just tells them to 'click ok'. As such, the user is now conditioned to click 'OK'. What have we done? Totally diminished the usefulness of the trust aspect of SSL.