The dnssec tag has no wiki summary.
2
votes
1answer
96 views
How to verify DNSKEY by using its corresponding DS
A DNSKEY on a name server can be verified by using it DS stored on its parental name server. According to RFC4034: The DS record refers to a DNSKEY RR by including a digest of that DNSKEY RR.
The ...
0
votes
1answer
176 views
DNS Vulnerabilities Scanner [closed]
I'm looking for a DNS Vulnerabilities Scanner tools, which is specially for DNS vulnerabilities, that shows me the Vulnerabilities, and the solution for that, like "Nessus" and "Acunetix" but just ...
2
votes
1answer
190 views
If DNSSEC is so useful, why its deployment is non-existent for top domains?
I've read several papers on DNSSEC, and it appears that it does prevent many attack classes, and the only two possible downsides is that its deployment is hard (DNSSEC is complex), and that you can ...
2
votes
1answer
171 views
TESTING DNSSec from command line
I am doing a research project on DNSSec.
I have a SOA, Stub resolver and a client as well as a attack machine.
My question is this. On a Linux Client is there a way test for validity of record ...
3
votes
1answer
131 views
Can NSEC domain enumeration happen for zones with wildcard records?
In DNSSEC, NSEC records are used to provide proof of nonexistence. The trouble is that these records provide pointers to existent domain names (the closest known domain in either direction) ...
7
votes
1answer
140 views
Does dnssec protect against malicious registrars?
With the recent conspiracy theories around the registrar MarkMonitor Inc., the question arises, if DNSSEC protects against a registrar going malicious (or being attacked).
This is especially ...
4
votes
1answer
139 views
Kaminsky Bug Exploitation
I am trying to exploit the Kaminsky bug for a school assignment. The specific version of the bug that I want to exploit is sending a forged packet with false information about www.domain.com so that ...
3
votes
1answer
921 views
DNSSec (comcast) vs DNSCurve (OpenDNS)
I was previously using OpenDNS on my internal network. I found out today that comcast has switched over to DNSSec:Comcast DNSSec.
I've did a little research on DNSSec and its benefits. I ...
12
votes
4answers
2k views
Does TOR Hidden Service Protocol provide more threat protection than a standard HTTPS session?
DuckDuckGo is a search engine that has a TOR Exit Enclave. This site is focused on the safe, secure searching of its users.
Since DNS is not used in TOR, it appears that HTTPS is less secure due to ...
1
vote
1answer
419 views
How can I tell if a DNSSec zone is protected using NSEC3 (versus NSEC)
This answer describes how DNSSec might permit "Zone walking"... where a bad guy can extract all the DNS records from a DNSSec enabled zone. NSEC3 is an update that prevents this. (See bottom of this ...
4
votes
2answers
684 views
How does DNSSec work? Are there known limitations or issues?
Based on information from this site, DNSSec is needed to protect us from a number of DNS and SSL / TLS hacks, including:
DNS spoofing, especially on wifi or shared medium
Registrars that abuse their ...
6
votes
2answers
3k views
DNS zone transfer attack
Hello Guys! Can anyone explain what is DNS zone transfer or give any link, paper? I have already googled, but could not find anything meaningful?
0
votes
1answer
487 views
Protecting yourself against DNS spoofing?
Are there any things which the user can do, on their own machine, to protect against DNS spoofing? I was just thinking when I was at the airport last and I wanted to check my email I used a hotspot ...
3
votes
1answer
212 views
How exactly would SOPA-style DNS blocking threaten the security of the Internet?
A point that keeps getting mentioned in the SOPA debate is that the DNS blocking it prescribes will cause security problems. Can somebody explain in simple terms just exactly how SOPA threatens ...
6
votes
3answers
345 views
Is the Kaminsky bug still a problem for sites without DNSSEC?
I have read about the Kaminsky bug, but I don't fully understand how easy it is to use this vulnerability for an attacker.
Are DNS-software updated now so it's not that easy to use this vulnerability ...
4
votes
1answer
171 views
What is the status of forced HTTPS everywhere (Strict transport security) via DNS? I only see last years draft
I'm trying to find the most recent RFC on HSTS in DNS (or rather said DNSSEC), but can only find this year old one in expired draft status
Where can I find the most current guidance on STS in DNS? If ...
4
votes
1answer
170 views
My DNS Name Server does not support DNSSec client queries, what alternatives do I have?
I am using a web browser to access DNSSec enabled sites. My current name server doesn't (won't) support DNSSec for at least a year. What are my alternatives?
Do any ISPs currently offer DNSSec? ...
0
votes
3answers
138 views
What organisation(s) is able to recommend a baseline technology set for safe, secure, web browsing?
This is a high level question regarding some recent posts about enhancing web browser security from an end-user perspective.
What business/organisation(s) would have:
Sufficient technical skill ...
3
votes
1answer
149 views
How will users know if their session is DNSSec protected or not?
There is definite security value in having DNSSec-verified connections, however I have yet to see software indicate if the connection is secure.
Ultimately I would like my users to recognize that ...
5
votes
2answers
371 views
Does DNSSec have any benefit if used with IPSec-enabled IPv6?
I'm not sure if the RFC's support a IPSec-only implementation of DNS, but if it does, what does that mean for DNSSec?
Is DNSSec an IPv4-only technology?
