Slashdot Mirror
DNSSEC Comes To .Net Zone Today
wiredmikey sends news that as of today VeriSign has enabled DNSSEC on the .net zone. This is one milestone in a years-long process of securing the DNS against cache poisoning and other attacks. Next step will be for VeriSign to sign the .com root early next year."Having DNSSEC enabled for .net domains... [is] important as it represents one of the most critical implementations of DNSSEC technology, since .net serves as the underpinning for many critical Internet functions. The largest zone to be DNSSEC enabled to date, .net currently has more than 13 million... domain name registrations worldwide."
The USA is your boogieman.
but hey, it's popular to hate them, lets go for it! They are magically worse than everyone else (many of whom do exactly the same, some are better, some are worse) because they have power and you aren't with them.
Grow up. They'll drop down a few pegs in the next 10-20 years, and the EU, China or both will become a more formidable power. Don't worry. I hope you are in one and can enjoy the other side of the idiocy you are propagating.
We'll all have to move to non US domains. Like .tr which stands for TERROR. Obviously.
Oh wait. ICANN. No such thing as non US controlled. I wouldn't mind EUCANN (you can) existing. But no doubt the powers that be (read: powers that do because they cann) would have too much sway.
I cringe each time the word hacktivists is used on the news.
Skwisgaar Skwigelf from Dethklok, is that you?
As opposed to what? The good ol' days when editors read the articles and proof-read submissions? When men were real men, and small furry creatures, etc etc.
Tic-Tac-Toe, Global Thermonuclear War, and relationships all have the same winning move.
Looks like the lawyers of Microsoft were anticipating this move and were itching for a fight. They have sued the entire internet for infringing on their trademark .Net
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
I was thinking more or less the same thing.
The point is that a good domain name system implementation needs to be secure against protocol attacks. DNSSEC secures it against hackers, but makes it more vulnerable to political attacks. Because DNS was designed to be centralized.
The problem with currently emerging alternatives is that they're designed to be decentralized, making them vulnerable to protocol attacks. However, a good p2p implementation would use an underlying hierarchy based on the anonymity of the name authorities, and they would be able to establish further authority points. But that protocol isn't even invented yet as far as I recall, and it would require a hell lot of thought and encryption.
In any case, more cryptographic security is better, not worse. If you want someone to blame, it's the inventors of DNS for establishing a US-based name authority. Oh wait, the Internet was invented in the US, by none other than the DARPA. Go figure.
Damn, you're dumb. He's calling for a decentralized system, which doesn't rely on any government, including the EU and China.
Dilbert RSS feed
Does DNSSEC allow storing SSL certificates in the DNS records? It would seem that this is an awesome way of getting free SSL certificates.
Also, I doubt anyone bothered with this, but does DNSSEC have any way of saying "this domain should only be contacted with SSL"? That would prevent SSL stripping MitM attacks.
You really don't know what DNSSEC is, do you?
What DNSSEC does: DNSSEC provides a means for an end-user to determine the authenticity of the DNS data they receive by proving that only someone in control of the domain could have served the record.
What DNSSEC does not do: DNSSEC does not provide for the security of data being exchanged between systems.
With DNSSEC, each domain admin holds their own private keys. Nobody else should ever see them. Chain of authenticity is provided by each parent domain signing the delegation records provided by the child domain.
So, for the "government" to "exert control" over your domain, they would have to completely spoof every parent of your domain. This would affect not just your domain, but all domains in that TLD. Pretty sure if everyone in .com all broke at the same time, someone would notice. In short, this makes it harder for someone to take control of your DNS. If the "government" wanted it to be easier, they never would have allowed the root to be signed.
And let's face it, DNSSEC was not designed for you. DNSSEC is designed for businesses, banks and other large entities who are trying to protect their customers from being spoofed. It is just another tool like SSL. And, IMO, anyone who uses SSL certs should use DNSSEC. If you don't use SSL, it's highly unlikely you need DNSSEC.
But hey, if all you want to do is spew ridiculous conspiracy theories, never mind, rant on.
As opposed to what? The good ol' days when editors read the articles and proof-read submissions? When men were real men, and small furry creatures, etc etc.
And ponies. Pink ponies.
Note to self: Stop putting jokes in my insightful comments so I can get something other than +1 Funny!
Actually, .net was enabled sometime around 16:00 GMT yesterday. They just didn't announce it until today.
I was doing testing of a DNSSEC system yesterday, and one of my test cases change state on me unexpectedly. (Signed zone in an unsigned parent)
DNS has allways been more or less centralized, and was allways controlled by the US. The US can already disable domains as they please, DNSSEC or not. The only difference with DNSSEC is, that it now impossible to change DNS data without having access to the keys. This makes DNS more secure for everyone, including private individuals.
I was thinking more or less the same thing.
The point is that a good domain name system implementation needs to be secure against protocol attacks. DNSSEC secures it against hackers, but makes it more vulnerable to political attacks.
You do know that DNS root servers are located (and co-located) around the world (20+ countries I believe off the top of my head), and they are all equal. The only US-centric part is that the designated maintainers (ICANN and IANA) are US based organizations, in large part due to historically originating in the US, and this does have the benefit being one of the best legal protection for free-speech in the world.
If you want an alternate system, edit your DNS root hints file.
Join the Internet Society, ICANN, and your national domain registrar if you want to make difference.
Yesterday I thought we were planning on getting rid of DNS... huh.
Oh wait, the internet was invented in the US, by none other than the DARPA. Go figure
That couldn't be any more wrong.
What DARPA invented was what people commonly mistake the Internet for, or more what they WANT it to be.
The internet is the opposite of what DARPA created, in other words, locked down, centralised and EASILY knocked out by nuclear war.
Hell, it is easily knocked out by a country you piss off simply by them nullrouting everything and letting the mostly neutral BGP do the rest of the work. (well, this is less of a problem these days because there are smarter filters that communicate with each other to compare results, but it could still be taken down with a smart request done in the right way)
DARPA merely created the base framework for what eventually (d)evolved to The Internet.
ARPANET is what a lot of people are striving to bring back in some sense on the current internet. P2P DNS* being a recent huge thing due to Verisign pissing a lot of people off by happily letting US government in their pants and pushing all sorts of switches.
I remember reading on here the other day there about an idea of shaking up the control system and making it a true democratic internet.
Each major region gets a representative (or a few), they all take votes on actions to do, just like other groups such as UN.
I think it would be a really nice thing to see happen. Then other regions can finally be heard instead of shafted, with crippling hardware, software and blackholes all over the place.
As for China... not sure what they would do. I think they would probably have people there just to listen in and nothing more really. They don't particularly care about the internet outside, besides as an intelligence gatherer...
* And while a lot of people seem to be unsure of how safe this would be, or how to deal with attacks, a Web Of Trust could be created.
Chain of authenticity is provided by each parent domain signing the delegation records provided by the child domain.
So, for the "government" to "exert control" over your domain, they would have to completely spoof every parent of your domain. This would affect not just your domain, but all domains in that TLD. Pretty sure if everyone in .com all broke at the same time, someone would notice.
Or they could pressure the parent domain into signing their own bogus delegation records, the same way they currently can pressure them into serving bogus delegation records (such as customs seizing all those trademark-and-copyright-infringing domains a few days ago). This relies entirely on each parent domain being trustworthy about what they sign, which is a bit difficult if you don't trust the government that they're subject to.
As opposed to what? The good ol' days when editors read the articles and proof-read submissions? When men were real men, and small furry creatures, etc etc.
Ah, the good ol' days... when the men were men, the women were men, and the girls were FBI agents.
They say a little knowledge is a dangerous thing, but it's not one half so bad as a lot of ignorance. - Terry Pratchett
Each major region gets a representative (or a few), they all take votes on actions to do, just like other groups such as UN.
There's your problem. As bad as the US has been in recent years, it's no where near as bad as a grouping would be. Sure it would give the EU more of a say, but it would also give China a bigger say as well, and probably other governments known for far more abusive practices with regards to the internet.
They could do that, but under the system, crackers could also just poison the cache or redirect DNS traffic to a rogue DNS server. As bad as the US government has been lately with regards to interfering with the internet, they're far better than having nobody in charge at all, or leaving things open to random crackery.
I assume you're joking, but it's the TLD, unless those other things are suddenly requiring DNS look ups.
DNSSEC secures it against hackers, but makes it more
vulnerable to political attacks. Because DNS was designed to be
centralized.
I don't understand. DNS is centralized and is somewhat vulnerable
to political attacks. But how does DNSSEC make it more vulnerable?
(It seems no different to me).
Sure, they could pressure the parent to supply bogus records. On the other hand, they always could have pressured them to change the NS records, which they would also have to do if they published bogus DS records.
So at absolute worst, no security was gained from the "government". It cannot be made worse, because any theoretical compromise by the governing agency was already possible, and much easier before.
This is definitely theoretically possible. However, you're going to have to convince the major application developers to play along.
Though to be fair, it would only be the equivalent of the cheaper certs that only verify domain control for authority when issuing certs. The higher-level certs truly do involve a third-party verification of identity of the cert recipient.
But how does DNSSEC make it more vulnerable?
(It seems no different to me).
It doesn't. But it makes a nice straw-man, doesn't it?
For someone with control of the root, DNSSEC makes things only slightly more difficult, but definitely does not make it easier.
And yet when the US government asked VeriSign to revoke domain names, all the root servers mirrored that decision. Just because DNS is distributed doesn't make it the least bit decentralized.
I'm aware that DNSSEC is currently supported in test builds of PowerDNS, but consider this a vote for having it available in stable by the time .com gets signed..
(In the interim, I figure having BIND slaves serving data off of PowerDNS would work, since PDNS can handle DNSSEC RR types)
In DNS speak a "zone" defines names with a common suffix. It may either define those names directly or it may delegate them to sub-zones hosted on other servers.
So when you lookup www.slashdot.org then (asusming nothing is cached) the recursive resolver looks up www.slashdot.org in servers responsible for the root zone which tells it where the .org zone is hosted. Those servers tell the resolver where slashdot.org zone is hosted and finally those servers tell the resolver the requested details for www.slashdot.org .
note: i'm known as plugwash most places but i screwd up registering that here somehow in the past and now can't register
Though to be fair, it would only be the equivalent of the cheaper certs that only verify domain control for authority when issuing certs. The higher-level certs truly do involve a third-party verification of identity of the cert recipient.
Seems to me that would be adequate for most purposes. The main thing the cert mechanism catches is a man-in-the-middle forging a response from a machine within a domain, while it's the user's job to go to the correct domain in the first place. If the servers and the company's DNS records are under control of the same IT operation, and the remote user has accessed the correct domain, why shouldn't the company's IT operation self sign and publish their signatures through DNS, rather than paying somebody else to construct certificates for their internal machines?
Meanwhile, the fact that the higher-level certs verify things beyond the scope of DNS administration - such as that a given cert really IS held by the Seventh Bank of Whatsistan - means the cert authorities wouldn't lose their whole market. For starters, they could sell higher-level certs for DNS. B-)
Bantam Dominique roosters crow a four-note song. Once you've heard it as "Happy BIRTHday" you can't NOT hear it that way
"Join the Internet Society, ICANN, and your national domain registrar if you want to make difference."
Oh please. It was the ISOC that helped hand the domain name system to the government. In 1997 Bob Shaw, ITU, Albert Tramposch WIPO and Don Heath ISOC met at an OECD meeting. They cooked up a plan that became IAHC then ICANN. The alternative was an industry consortium that would operate the DNS the way the Internet itself operates - free of a US government regualatory authority.
It was Steve Wolff that liberated the Internet itself from DARPA. He told me he didn't move the DNS because he just plain forgot, not thinking it was important.
ISOC has a vested interest in the ICANN/domain ecosystem. The IETF insists ICANN is the root authority, ICANN delegated .ORG to PIR, operated by ISOC, the ISOC funds the IETF.
This is what you call "a loop".
Need Mercedes parts ?
"Nobody else should ever see them."
*Should* being the operative word.
The other problem with DNSSEC is, once you sign your domain the government can assign the domain to somebody else via UDRP, but without your key signing, it aint gonna work. The trade mark guys are gonna freak out when they figure this out.
Need Mercedes parts ?
And the answers from such a server would not be accepted. DNSSEC does not prevent DoS attacks and actually make some DoS attacks easier. What it does do, when properly implemented, is prevent applications seeing false data.
The only data not covered by signatures is referrals and compromised referrals don't lead to false data being returned to the application. It will be rejected at the validation stage.
I remember it well, it was GLORIOUS!
Climate Progress - Hell and High Water
username girlintraining, and you think it's a guy?
If you ignore ACs because they are anonymous - you're an idiot.
this does have the benefit being one of the best legal protection for free-speech in the world [i.e. in the US].
Q: what do you get if you register free-speech.us at a DNS provider?
A: a free-speech zone.