Slashdot Mirror
DNSSEC Comes To .Net Zone Today
wiredmikey sends news that as of today VeriSign has enabled DNSSEC on the .net zone. This is one milestone in a years-long process of securing the DNS against cache poisoning and other attacks. Next step will be for VeriSign to sign the .com root early next year."Having DNSSEC enabled for .net domains... [is] important as it represents one of the most critical implementations of DNSSEC technology, since .net serves as the underpinning for many critical Internet functions. The largest zone to be DNSSEC enabled to date, .net currently has more than 13 million... domain name registrations worldwide."
Damn, you're dumb. He's calling for a decentralized system, which doesn't rely on any government, including the EU and China.
Dilbert RSS feed
You really don't know what DNSSEC is, do you?
What DNSSEC does: DNSSEC provides a means for an end-user to determine the authenticity of the DNS data they receive by proving that only someone in control of the domain could have served the record.
What DNSSEC does not do: DNSSEC does not provide for the security of data being exchanged between systems.
With DNSSEC, each domain admin holds their own private keys. Nobody else should ever see them. Chain of authenticity is provided by each parent domain signing the delegation records provided by the child domain.
So, for the "government" to "exert control" over your domain, they would have to completely spoof every parent of your domain. This would affect not just your domain, but all domains in that TLD. Pretty sure if everyone in .com all broke at the same time, someone would notice. In short, this makes it harder for someone to take control of your DNS. If the "government" wanted it to be easier, they never would have allowed the root to be signed.
And let's face it, DNSSEC was not designed for you. DNSSEC is designed for businesses, banks and other large entities who are trying to protect their customers from being spoofed. It is just another tool like SSL. And, IMO, anyone who uses SSL certs should use DNSSEC. If you don't use SSL, it's highly unlikely you need DNSSEC.
But hey, if all you want to do is spew ridiculous conspiracy theories, never mind, rant on.
I was thinking more or less the same thing.
The point is that a good domain name system implementation needs to be secure against protocol attacks. DNSSEC secures it against hackers, but makes it more vulnerable to political attacks.
You do know that DNS root servers are located (and co-located) around the world (20+ countries I believe off the top of my head), and they are all equal. The only US-centric part is that the designated maintainers (ICANN and IANA) are US based organizations, in large part due to historically originating in the US, and this does have the benefit being one of the best legal protection for free-speech in the world.
If you want an alternate system, edit your DNS root hints file.
Join the Internet Society, ICANN, and your national domain registrar if you want to make difference.
DNS is just a database. You can store anything you want in it. If you're storing something you want lots of people to care about, it's best to get a dedicated record type for it, but if you just want to play around you can use TXT records. There is a record type for certificates.
So yes, you can do
www.example.com IN TXT "this server should only be contacted by HTTPS. Do not gopher!"
but web browsers are not likely to ask for that record. Feel free to develop a browser which does or ask the browser developers to include this feature.
Finally! A year of moderation! Ready for 2019?
Coincidentally, today this working group became official:
http://www.ietf.org/mail-archive/web/keyassure/current/msg01078.html
Objective:
Specify mechanisms and techniques that allow Internet applications to
establish cryptographically secured communications by using information
distributed through DNSSEC for discovering and authenticating public
keys which are associated with a service located at a domain name.