46,400 reputation
1380149
bio website tltech.com
location United States
age 36
visits member for 4 years, 2 months
seen 20 hours ago

{{Hacker}}

Long-time owner and operator of a small, successful security consulting business. As of recently, though, by day I work for a really big company.

Nothing I write here represents the views of my employer, nor does it reflect any proprietary or confidential knowledge. In fact, practically all of it was written before I even started working there, so don't get too excited.


Jun
30
answered Does splitting RNG into “private” and “public” entropy sources reduce risks of compromise?
Jun
30
awarded  Guru
Jun
30
awarded  Custodian
Jun
26
awarded  Notable Question
Jun
16
revised where to store a key for encryption
added 1183 characters in body
Jun
7
awarded  Famous Question
Jun
1
awarded  Announcer
Jun
1
awarded  Nice Answer
May
28
revised OpenVPN dhparam
new content
May
28
revised OpenVPN dhparam
new content
May
28
revised OpenVPN dhparam
new content
May
27
awarded  Good Answer
May
24
awarded  Nice Answer
May
23
comment If DNSSEC is so questionable, why is it ahead of DNSCurve in adoption?
@cnst That's explained in my answer and my previous comment. A mitm can change the response to the root/TLD query, and there's no way for you to know.
May
23
comment If DNSSEC is so questionable, why is it ahead of DNSCurve in adoption?
@cnst With DNSCurve, your results are not guaranteed, even if you run your own recursive resolver. All a MITM actor (e.g. a greedy ISP or an oppressive nation-state) needs to do is intercept and modify the NS records ostensibly coming from the TLD servers. By manipulating the nameserver names, they control the DNSCurve keys, and can trivially direct traffic to their own poisoned servers and distribute modified but still "authenticated" records. There no chain of trust with DNSCurve, and therefore there is no content integrity.
May
23
comment If DNSSEC is so questionable, why is it ahead of DNSCurve in adoption?
@cnst Sort of. DNSCurve (and yes DNSCrypt) provides confidentiality and integrity of the conversation, but not the content. Just like a VPN. If the party you're communicating with is authoritative and trustworthy, then you've got something. Again, just like a VPN. But this is still a fundamentally different story from DNSSEC, which can guarantee trustworthy results irrespective of the trustworthiness of all the world's individual ISPs running recursive resolvers.
May
23
comment If DNSSEC is so questionable, why is it ahead of DNSCurve in adoption?
@Pacerier Bernstein has a long and proud history of creating really well-written software (djbdns, qmail, etc.) but releasing it with a license that does not allow derivative works (so the community is not allowed to maintain them) and then abandoning them. He has since released is most popular works into the public domain, so people can maintain them now if they want. But he's not interested in putting any more time into them.
May
23
comment If DNSSEC is so questionable, why is it ahead of DNSCurve in adoption?
@Pacerier Each has its purpose. One guarantees the integrity of the conversation, and the other guarantees the correctness of the data. It's like how, TLS guarantees that your connection to Gmail is secure, but it doesn't guarantee that the email you read there is truthful. DNSSEC can guarantee truthfulness, but thats about it. Ultimately I think DNSSec is more urgent because it could readily replace our horribly broken TLS PKI, while nearly the entire benefit of DNSCurve can be achieved with a VPN to your DNS server.
May
22
awarded  Nice Answer
May
22
comment If DNSSEC is so questionable, why is it ahead of DNSCurve in adoption?
@Pacerier neither. I'm not taking sides, I'm just telling you what the two opinions are.