[Cerowrt-devel] DNSSEC

[Valdis.Kletnieks at vt.edu]

On Tue, 10 Feb 2015 16:57:07 -0800, Ranganathan Krishnan said:
> I am looking into ways to improve DNS on the openwireless router software.
> When I mentioned DNSSEC as one of the items to review, I received this
> response from one of the developers.
>
> http://sockpuppet.org/blog/2015/01/15/against-dnssec/

Right off the bat:

"But it doesn't make those attacks infeasible, so sites still need to adopt
secure transports like TLS. With TLS properly configured, DNSSEC adds nothing."

Which makes the rash assumption that it's appropriate to use TLS for everything.

For starters, consider NTP or any other UDP-based system, or any TCP-based
protocol that uses something other than TLS.

"Had DNSSEC been deployed 5 years ago, Muammar Gaddafi would have controlled
BIT.LY's TLS keys."

Actually, whoever controlled the master for .LY would have controlled BIT.LY,
whether or not DNSSEC was in play. If Gaddafi had control of .LY, he could have
redirected BIT.LY anywhere he wanted without keys, so the situation is no
worse. What DNSSEC does is prevent a Gaddafi that *doesn't* control .LY from
swiping control of your view of .LY (including BIT.LY) out from under you.

Or your view of .COM, which would probably matter just a tad more to you...

I'll let somebody else debunk the rest, I quit reading at that point. :)

-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 848 bytes
Desc: not available
URL: <https://lists.bufferbloat.net/pipermail/cerowrt-devel/attachments/20150210/7798fe79/attachment.sig>