Tag Info

Hot answers tagged

25

There's a problem: DNSCurve is more like TLS for DNS servers, in comparison to DNSSEC, which is signed records. DNSCurve uses point-to-point cryptography to secure communication, while DNSSEC uses pre-calculated signatures to ensure the accuracy of the supplied records. So we can summaraize it like this: DNSSEC: Accurate Results DNSCurve: Encrypted Traffic ...


12

DNSSec is normal DNS, but with signatures. It absolutely prevents DNS Spoofing; that's what it's for, and that's what it does. Registrars can still theoretically abuse their position because they're responsible for communicating your intentions to the root servers. This includes information about your DNSSec keys. This relationship will never change; if ...


12

DNSSEC and DNSCurve address completely different aspects of DNS security. First of all, DNSSEC does NOT sign your queries. Rather DNSSEC allows a zone (such as a domain) to be signed by its owner, and allows a resolver (for instance, Comcast's DNS servers) to verify the signature, and therefore be sure that the zone data it gets is authentic. It protects ...


10

There is a RFC for that. It is part of what DNSSEC is meant to do. Now don't get too hopeful about "top dollar" or reduction thereof. The need to "certify" in some way public keys with regards to server names is not magically removed by switching to DNSSEC. The "CA" role is just moved around, and the associated costs are still there. It can be predicted ...


10

DNS Zone transfer is the process where a DNS server passes a copy of part of it's database (a zone) to another DNS server. It's how you can have more than one DNS server able to answer queries about a particular zone; there is a Master DNS server, and Slave DNS servers, and the slave asks he master for a copy of the records for that zone. A basic DNS Zone ...


9

The major reason is that DNSSEC was already being adopted by the major root servers when DNSCurve came out. Furthermore they do not tackle the same problems, they overlap on some points but differ on others. They could very well be used together. Note that we have had a question DNSSec (comcast) vs DNSCurve (OpenDNS) which details the differences very ...


8

The "Kaminsky bug" (CVE-2008-1447) affects "BIND 8 and 9 before 9.5.0-P1, 9.4.2-P1, and 9.3.5-P1".


8

Most likely not. IPv6 support is still quite patchy in many parts of the world. The delay is most likely caused by bad routing or network packets having to go through too many hops. You can test out your IPv6 connection here. The hosts file is used to bypass DNS and make your access to websites matching domains listed slightly faster, not slower. A whois ...


7

No. DNSSEC does not protect the integrity of a DNS name if the registrar for that name is malicious (or compromised). The registrar for grumpyavians.com is the ultimate source of authority for who owns grumpyavians.com (and, e.g., what is the public key for grumpyavians.com). Consequently, if the registrar is malicious or compromised, then the registrar ...


7

I strongly believe that the pure usage of DNSSEC should not be indicated to the user at all. DNSSEC just ensures that the DNS lookups are not tampered with by third (fourth?) parties. DNSSEC does not ensure that the connection is really established with the returned IP-address nor that no attacker is listening in on the data. So pure DNSSEC is way too ...


6

The CERT RR has been deprecated. The current proposal for putting public key material in DNS is called DANE. They have defined a TLSA record type which is documents in RFC 6698. This lets a domain administrator assert a specific certificate, or a CA for a particular service.


6

It is actually unclear whether DNSSEC is "what we want". Right now, the certification of Web site, i.e. how a Web browser makes sure that it talks to the right site (when doing HTTPS) is done with digital certificates emitted from about a hundred of Root Certification Authorities. The root CA are entities who decided to go into the certificate issuance ...


5

One problem with HTTPS is that you need to trust the root CA. And most browsers have many of those by default. With TOR hidden services, the .onion address itself contains a hash of the server public key, so you don't need any CAs. But the main issue is that .onion addresses aren't very user friendly. So the problem shifts to getting/verifying that you're ...


5

DNSSEC provides something rather different than IPSec, and either or both may meet your needs. IPSec can encrypt packets and sign them, providing evidence that they come from something you trust, IF you have a PKI (Public Key Infrastructure) you can trust. But that "IF" is a very tall order, especially given the presence these days in most common "trusted" ...


5

makerofthings7 wrote: it seems TOR is better/more secure since it doesn't use DNS, and it doesn't rely on CAs Just as it's ultimately the user's responsibility to verify a TLS certificate before accepting it, it's the user's responsibility to verify that an onion address is the intended address. By starting with (a) I know an onion address (b) I ...


5

The main security-related concerns raised so far are attackers may use false infringement claims as a denial-of-service attack. ISPs may start doing deep packet inspection on their customer's traffic, to look for infringing content. it may interfere with the effectiveness of, or take-up of, DNSSEC.


4

The only thing wrong with DNSSEC is that it's new, DNS is (obviously) important and people are reluctant to mess with their DNS setup. If your DNSSEC deployment goes wrong you could loose your entire internet presence. As to why you'd want to authenticate DNS lookups, read this paper on how the great firewall leaks onto users outside of China: ...


3

Click the link in the header: this draft dated Mar 2012 replaces the one you linked, and expires in Sep 2012. See also the websec working group.


3

If you're willing to rely on an online service (and don't mind one that is pretty picky), the DNSSEC Checker will warn (among other things) about zones that don't use NSEC3. To check by yourself, simply query a non-existent domain and look for either an NSEC or NSEC3 resource record in response. An example query would be dig +dnssec -t any ...


3

"more", yes. But that's not meaningful if the threat you're trying to counter is not the vulnerability being used against you. MITM attacks are a strange thing to ask about in Tor hidden services. If you trust the hidden service (maybe you met somebody who handed you a .onion url?), and you trust your Tor client (i.e, the MITM is not feeding you tainted ...


3

You may have to clarify what it is you mean when you say that your current nameserver doesn't support DNSSEC when you're speaking from the resolver perspective. You see, any nameserver (that will do recursive queries for you) will cache and forward any record set your request. That includes RRSIG records which are the foundation of DNSSEC. Examples: ...


3

Kaminsky isn't the first person to find a DNS cache poising vulnerablity. In fact many of these vulnerability have been found and that is why DNSSEC is important. DNSSEC is a defense in-depth strategy against this attack pattern. However responsible software vendors patch vulnerabilities, and when you find a DNS cache poisoning attack in BIND, it will be ...


3

Yes, DNSSEC is immune to this kind of attack. Starting at an anchor (usually the root, sometimes DLV), every delegation is either explicitly secure (presence of DS set on delegation): powerdns.com. 172800 IN NS powerdnssec1.ds9a.nl. powerdns.com. 172800 IN NS powerdnssec2.ds9a.nl. powerdns.com. 86400 IN DS 44030 8 3 ...


3

These days Google uses HTTPS even for their search, which makes it relatively easy for you to verify that your connection is secure. This does not absolutely grantee that your connection isn't being rerouted by an attacker, but it does guarantee they're not able to view or manipulate your traffic and therefore the attacker would have little motivation to do ...


2

It does exist - it's called DANE - http://tools.ietf.org/html/rfc6698 (the CERT RFC hasn't seen to of had any traction, I don't know why). To generate the records you can use this: https://github.com/pieterlexis/swede This firefox plugin can validate them: https://os3sec.org/ unfortunatly it's not complete. The certificate patrol team have an updated ...


2

According to the information on this page: Effectively, the digest is calculated over the following fields, concatenated: DNSKEY owner name: se. (0x 02736500) Flags: 257 (0x0101) Protocol: 3 (0x03) Algorithm: 5 (0x05) Public Key: Aw…… The first four fields, in hex are as follows: 02736500 0101 03 05, My question was how one can ...


2

@GrahamHill already explained a zone transfer pretty good already, but I'll try to fill inn some more. By being able to query for all records from the DNS server, the attacker can easily determine which machines are accessible. The zone transfer may reveal network elements that is accessible from the Internet, but that a search engine like Google ...


2

What business/organisation(s) would have: Sufficient technical skill to evaluate technologies needed for safe, secure web browsing OWASP The capacity to publicly recommend a set of technologies to achieve the same not actually, still CERT as several nations have it Does not have conflicting goals of Certificate Authorities nor other goals ...


2

In terms of your question, I don't think there is any one organisation. OWASP gives good detail on the ten obvious things you should get right, but that should be a bare minimum - because there are so many aspects of security, and different browsers, OS'es, plugins, ways to access the Internet etc I'd be surprised if any single organisation could do it. I ...


2

They should still be vulnerable, since the wildcard record is signed as literally "*". The details of how wildcard results are handled are covered in RFC 2535 (DNSSEC), RFC 3845 (NSEC RDATA format), and RFC 5155 (NSEC3 hashed responses). This simple description was helpful to me in understanding how a wildcard response can be proven: "The receiving ...



Only top voted, non community-wiki answers of a minimum length are eligible