Slashdot Mirror
ICANN Sets Plan To Reinforce Internet DNS Security (networkworld.com)
coondoggie shares a report: In a few months, the internet will be a more secure place. That's because the Internet Corporation for Assigned Names and Numbers (ICANN) has voted to go ahead with the first-ever changing of the cryptographic key that helps protect the internet's address book -- the Domain Name System (DNS). The ICANN Board at its meeting in Belgium this week, decided to proceed with its plans to change or "roll" the key for the DNS root on Oct. 11, 2018. It will mark the first time the key has been changed since it was first put in place in 2010. During its meeting ICANN spelled out the driving forces behind the need for improved DNS security that the rollover will bring. For example, the continued evolution of Internet technologies and facilities, and deployment of IoT devices and increased capacity of networks all over the world, coupled with the unfortunate lack of sufficient security in those devices and networks, attackers have increasing power to cripple Internet infrastructure, ICANN stated.
"Specifically, the growth in attack capacity risks outstripping the ability of the root server operator community to expand defensive capacity. While it remains necessary to continue to expand defensive capacity in the near-term, the long-term outlook for the traditional approach appears bleak," ICANN stated. The KSK rollover means generating a new cryptographic public and private key pair and distributing the new public component to parties who operate validating resolvers, according to ICANN. Such resolvers run software that converts typical addresses like networkworld.com into IP network addresses. Resolvers include: internet service providers, enterprise network administrators and other DNS resolver operators, DNS resolver software developers; system integrators, and hardware and software distributors who install or ship the root's "trust anchor," ICANN said.
"Specifically, the growth in attack capacity risks outstripping the ability of the root server operator community to expand defensive capacity. While it remains necessary to continue to expand defensive capacity in the near-term, the long-term outlook for the traditional approach appears bleak," ICANN stated. The KSK rollover means generating a new cryptographic public and private key pair and distributing the new public component to parties who operate validating resolvers, according to ICANN. Such resolvers run software that converts typical addresses like networkworld.com into IP network addresses. Resolvers include: internet service providers, enterprise network administrators and other DNS resolver operators, DNS resolver software developers; system integrators, and hardware and software distributors who install or ship the root's "trust anchor," ICANN said.
And CAs are going to run this madhouse. Brilliant!
Play dead
Good dog
It's a key rollover event
https://www.icann.org/resources/pages/ksk-rollover
They continue to do what is best for profit, not what is best for users. Sure, this is important but don't think it isn't being driven by profit. At least there is some user benefit to this though, as opposed to their catastrophically awful decision years back to start selling gTLDs.
Damn_registrars has no butt-hole. Damn_registrars has no use for a butt-hole.
You can choose to not validate. It's a fundamental issue that there have to be an authority of some sort if you want to validate against an authority.
ICANN used "roll" in their press release. https://www.icann.org/resources/press-material/release-2018-09-18-en
Feel free to check the source material before you try and correct the author.
https://www.icann.org/dns-resolvers-checking-current-trust-anchors
The professional response is: Right or wrong, RFC 5011, section 6.3 uses the term 'roll'
Stopping to your level, the response is: read the RFCs before you write your next comment.
One big lying corporate wingtip asshole company says that this other big lying corporate group of sons-of-bitches (and regular bitches) is to be trusted! Oh? Really? Guys, I gotta say, the whole premise of crypto-CAs is kinda stupid as long as the asshats corporations are all policing each other. Maybe *they* have some faith in that shit, but as an individual technologist (that hates corporations and corporate personhood) I have to say that the flaws in x509 crypto isn't crypto - it's the source of trust. Don't ask me to trust *ANY* corporation. If you start with that, you start with a flawed design. Fuck those people. We need a better system.
How about a system that's based on individual trust of people? Ie.. If I trust two friends and both of them say that this non-profit 501c is at least trustworthy enough to believe their website, they cryto-sign something to that affect publically? This is similar to PGP/GPG's web-of-trust. Sure, there are still some logistics problems with that, but at least it puts the trust in people not companies.
Actually, I am pushing my CONgress critter to understand that we need VETTED Certificates/PPK. The only way to do that is to have brick/mortars that will vet an ID, and then either issue a certificate/private key, while serving up the public key, OR even take the public key/certificate from the vetted person . When you think about it, this does not belong in gov purview, NOR in individuals controls (that is, you vet a friend and your friend falsely vetted somebody else because they were not paying attention).
/., it should be possible for me say no more ACs that are below a certain level (say 4). Now if I register a login, I should start at say 1, and increase if I am being modded up. Then if I am a login that also gave in my cert, I could then start at say 3 or even 4. Why start somebody that much higher? Because if they screw it up, then it is their only vetted login. They do not get to have multiple vetted logins. As such, they have a lot riding on their postings to make sure they are polite, etc.
There is really only choice on this, and it would the postal mails from each nation.
With this approach, then gov, businesses, social media sites, etc can KNOW that if you are claiming to be someone, then you are them. For example, on
Same way with ads. If I was Facebook/Google and I get a political ad, I want to know that it is an American company, with a vetted American backing it (i.e. somebody has to be responsible) . If they can not produce both, then no posting the ad.
I prefer the "u" in honour as it seems to be missing these days.
That rocks. Good idea, brother.
How about they focus on Domain Squatters, most of the domains arent usable because they are held for advertising or overpriced to make money off them.
It's not a typo if you understood the meaning!