Slashdot Mirror
Comcast Launches First Public US Trial of DNSSEC
cryan7755 and netbuzz both sent along a NetworkWorld story on Comcast's public test deployment of DNSSEC. Here is the company's blog post announcing the trial.
"Comcast this morning announced what is believed to be the first public test deployment of DNS Security Extensions. The company says it has deployed DNSSEC throughout its nationwide network and will immediately make validating servers available to customers. In addition, Comcast said it would digitally sign all of its own domain names using DNSSEC by early next year. 'There is often talk about a chicken-and-egg sort of problem with DNSSEC. People don’t want to sign their own domains with DNSSEC until people are validating signatures,' says Jason Livingood, Executive Director of Internet Systems Engineering at Comcast. 'We want to explain how we as an ISP have a roadmap for validating signatures with DNSSEC.'"
That's great, but VERISIGN will not setup DNSSEC for .COM for some time.
http://www.root-dnssec.org/
It's great that ISPs enable DNSSEC in their DNS servers, but until .COM and the like are not signed, the point is a little moot?
Don't they mean Xfinity?
The most interesting part of the article didn't make the summary...
"Opt-in by changing your DNS server IP addresses to 75.75.75.75 and 75.75.76.76 (we'll be adding IPv6 addresses soon)."
75.75.75.75 will answer outside of the comcast network... so I can use it to test DNS entries. (Or presumably someone could use it in an amplifier attack)
"Science flies us to the moon. Religion flies us into buildings." - Victor Stenger
finally a ISP who makes this a feature !
if a ISP would do this in the UK I would use them...
its a feature you should ask for in your ISP !
regards
John Jones
Dear customer, we want your web browsing experience to be as secure as possible, however we still want to be able to hear you sing happy birthday to aunt Margaret. Did you decide to send her the chocolates and candles you were discussing with your sister?
Regards
Comcast Customer Services
For your information:
People who sent chocolates and candles for birthdays also chose: ...
Support NYCountryLawyer RIAA vs People
I'm pretty knowledgeable when it comes to new Internet tech, but I don't offhand know the benefits of DNSSEC or much about it other than it has to do with Doman Name Servers and Security (I assume encryption). Is it a complement to SSL? Does it help secure browsing sessions or is it more about identifying and authenticating legitimate domain names versus questionable ones? I guess I'll have to read up on it.
Part of the hardcore faithful who believed in Apple long before it was cool again to do so
Say what you want about Comcast's customer policies, it's clear that they're almost as foresighted as Google when it comes to deploying next generation networking technologies, not only deploying DNSSEC, but also beginning an opt-in IPv6 transition project.
In short: Credit where credit is due. At least *someone* is looking to the future and working toward it.
Are the Comcast DNS servers still redirecting mistyped domains to advertising servers?
In case anybody else did not know what an amplifier attack is:
http://dnscurve.org/amplification.html
Go green: turn off your refrigerator.
Good question.
I would mod you, but there is no "this needs an answer" mod.
I would mod an informative response to you informative, but there has been no informative responses at this point.
Don't know something? Look it up. Still don't know? Then ask.
In the context of a user name of Apple Acolyte, I'm not thinking the reference is to consoles.
Do not fold, spindle or mutilate.
... Frederick's of Hollywood crotchless panties
KY Sensual Massage Lubricant
Their own ears
"Trolls they were, but filled with the evil will of their master: a fell race..." -- J.R.R. Tolkien on Olog-hai
Then you probably want to mod him "Underrated".
DNSSEC uses cryptographic signatures to authenticate DNS records and thereby prevents DNS spoofing. DNSSEC does not use encryption, only authentication, i.e. it provides trust, but not privacy.
DNS spoofing is an attack which can be used to redirect traffic to an attacker's server, where the attacker can intercept the traffic for a man in the middle attack or create an impostor service and harvest credentials. There are several countermeasures in plain DNS to prevent spoofing, but Dan Kaminsky's discovery of a fundamental spoofing vulnerability in the DNS protocol finally pushed DNSSEC out of the labs into the wild.
I noticed this exciting tidbit on their FAQ page:
What happens to Comcast Domain Helper, which offers DNS redirect services, when you fully implement DNSSEC?
* We believe that the web error redirection function of Comcast Domain Helper is technically incompatible with DNSSEC.
* Comcast has always known this and plans to turn off such redirection when DNSSEC is fully implemented.
* The DNSSEC trial servers we are announcing today do not have Comcast Domain Helper's DNS redirect functionality enabled.
* We plan to update our IETF Internet Draft on this subject, available at http://tools.ietf.org/html/draft-livingood-dns-redirect, to reflect this in the coming months.
If someone can spoof DNS, why not just spoof routing? Now days, it is very common to connect through public wireless networks. You should not have to depend on the connection point not being hacked somehow. My understanding is that DNSSEC can supply host keys as well, so you can be sure that the host you actually connect to is the one defined by DNSSEC. Is it being implemented that way, or is it just being used to avoid DNS spoofing?
Also, are DNSSEC certificates designed in a way that generates profit for certificate providers? We don't want a system where the system is more oriented toward profit than security.
In my experience, Comcast's DNS servers go down all the time, and even when they work, they sometimes have unexplained "glitches" that render websites unusable. Every time I try using their servers, this happens, and I switch back to something more stable, like L3. I'd be surprized to find anybody but a total n00b still using Comcast's DNS.
it's clear that they're almost as foresighted as Google when it comes to deploying next generation networking technologies
Except Google didn't try to kill bittorrent, come under a congressional investigation, and spark a row with the FCC over its use of "next generation networking technology". And while we're at it, how next generation is a network with a 250GB bandwidth cap?
#fuckbeta #iamslashdot #dicemustdie
---
Computer Security Feed @ Feed Distiller
Except Google didn't try to kill bittorrent, come under a congressional investigation, and spark a row with the FCC over its use of "next generation networking technology". And while we're at it, how next generation is a network with a 250GB bandwidth cap?
Uhuh... and that disproves my point how, exactly?
The simple fact is that Comcast is rolling out next-gen technologies for the Internet before anyone else. Now, you may not like how they're trying to manage the bandwidth in their backhaul network, but that's an entirely separate issue.
Put another way, yes, believe it or not, some companies can do bad things *and* good things! Wow! What a crazy idea!
So please, take your zealotry elsewhere, as it's at best tangential, and quite frankly, I'm not interested.
Just saw an add for $29.99/month Comcast internet + cable (probably just broadcast, dunno) for 1 year. I think I cancelled my service too soon though (just last month). How long do I have to be "not a customer" to be a "new customer" ? Hmm, and IPv6 native service isn't that far away either. I'll probably switch back.
I would rather see Comcast improve their DNS server availability first, or at least in addition. For the last three months, I've turned to using another DNS provider because Comcast sees fit to run nightly maintenance on their servers sometime after 01:30 CST. Rarely has connection to the internet been compromised, rather to the DNS servers themselves. If they're using load-balancing hardware, I'm not seeing it as an end-user. Hopefully they can piggy-back a reliable high-availability architecture in addition to DNSSEC...
assert(expired(knowledge));
The Canadian Internet Registration Authority (CIRA) "has committed to the full deployment of DNSSEC, the security extensions for DNS, and has been conducting extensive research and analysis into the technical and operational impact of signing the dot-ca (.ca) zone file. The roll-out is anticipated in the later part of 2010."
CIRA is already providing a DNSSEC test bed for those interested in signing their own dot-ca name or interacting with a name server serving the signed dot-ca zone file.
for details see https://registrants.cira.ca/dnssec/login
That is one of the greatest things ever. http://www.mytwitteradder.com/
I use Comcast and I've noticed DNS has been damned slow the last few days. Maybe this is why?
DNSSEC Cache Poisoning has been confirmed just as I described. Note that many people are now advising to turn off DNSSEC validation.
Most officially, I discussed it in my DNSSEC NTIA comments:
http://www.ntia.doc.gov/dns/comments/comment027.pdf
in the section on Cache Poisoning. Notably, Vixie et al disputed
this when discussed on DNSOP and namedroppers. Guess they were wrong
again.
If you want to engage in honest uncensored discussion of DNS issues,
subscribe to dnsop-honest or namedroppers-honest through the interface
at lists.iadl.org
[*] See DNSSEC cache poisoning links contained in
http://lists.iadl.org/pipermail/namedroppers-honest/2010-January/000074.html
The IETF has known of these problems for a long time, and silenced me
to keep these problems quiet.
Vixie and the IETF have known about the DNSSEC Cache Poisoning problem
and other DNSSEC problems for a number of years, but they have covered
it up by threatening and silencing critics. Inquiry reveals that DNSSEC
is a scam that threatens the stability of the Internet.
Please be sure to credit me with discovering the DNSSEC flaws. And
please forward this message widely.