Tag Info

New answers tagged

0

The authoritative for .com will indicate in its signed answer that example.com is also signed (some output omitted) $ dig +norec +dnssec a www.example.com @c.gtld-servers.net ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags: do; udp: 4096 ;; QUESTION SECTION: ;www.example.com. IN A ;; AUTHORITY SECTION: example.com. 172800 IN NS ...


0

I recently added dnssec to a few domains, and here are a few random notes and tips from that experience: First of all, make sure your domain registrar support DNSSEC. Some do, others (e.g. namecheap) don't. If your registrar don't support dnssec (i.e. don't have a method for adding DS records for your domain at the parent level) you need to switch registrar ...


2

It appears that secure DNSSec recursive queries are not possible to enforce. According to the notes in this IETF draft: DNSSEC is not an enforcement mechanism, it's a resource. When I see folks voice opinions that DNSSEC's recommended operation has to strictly followed, my gut reaction is that these folks have forgotten the purpose of all of our ...


1

Well, DANE can, in conjunction with Public Key Pinning' (HPKP), protect your current users from malicous use (even if the DANE record changed, the browsers will still remember the HPKP headers and fail to connect). This does not protect new connections. But since HPKP has a life of at least 1 month it adds reasonably safety to your 'stack'.


0

When your system makes DNS requests without the anonymisation network you are normally using an eavesdropper is able to predict which sites you are visiting. Assume you want to visit https://security.stackexchange.com/. Your browser makes a DNS request and sends it to your anonymisation network, which in turn requests the site. So the eavesdropper has an ...


1

DNSSEC does not protect against eavesdropping, in this respect it only signs the response so the client knows it has not been spoofed: It is a set of extensions to DNS which provide to DNS clients (resolvers) origin authentication of DNS data, authenticated denial of existence, and data integrity, but not availability or confidentiality. Emphasis ...


0

If you do DNS over your local unencrypted network, a third party could see what names you were looking up and might be able to glean some information out of those lookups. If you're a deep-cover CIA operative somewhere and they can see that you're going to super-sekret-email.cia.gov, well, even without that traffic you might be in trouble. There's also a ...



Top 50 recent answers are included