45,007 reputation
1277146
bio website tltech.com
location United States
age 36
visits member for 4 years
seen 3 hours ago

{{Hacker}}

Long-time owner and operator of a small, successful security consulting business. As of recently, though, by day I work for a really big company.

Nothing I write here represents the views of my employer, nor does it reflect any proprietary or confidential knowledge. In fact, practically all of it was written before I even started working there, so don't get too excited.


1h
awarded  Nice Answer
16h
comment If DNSSEC is so questionable, why is it ahead of DNSCurve in adoption?
@cnst That's explained in my answer and my previous comment. A mitm can change the response to the root/TLD query, and there's no way for you to know.
1d
comment If DNSSEC is so questionable, why is it ahead of DNSCurve in adoption?
@cnst With DNSCurve, your results are not guaranteed, even if you run your own recursive resolver. All a MITM actor (e.g. a greedy ISP or an oppressive nation-state) needs to do is intercept and modify the NS records ostensibly coming from the TLD servers. By manipulating the nameserver names, they control the DNSCurve keys, and can trivially direct traffic to their own poisoned servers and distribute modified but still "authenticated" records. There no chain of trust with DNSCurve, and therefore there is no content integrity.
1d
comment If DNSSEC is so questionable, why is it ahead of DNSCurve in adoption?
@cnst Sort of. DNSCurve (and yes DNSCrypt) provides confidentiality and integrity of the conversation, but not the content. Just like a VPN. If the party you're communicating with is authoritative and trustworthy, then you've got something. Again, just like a VPN. But this is still a fundamentally different story from DNSSEC, which can guarantee trustworthy results irrespective of the trustworthiness of all the world's individual ISPs running recursive resolvers.
1d
comment If DNSSEC is so questionable, why is it ahead of DNSCurve in adoption?
@Pacerier Bernstein has a long and proud history of creating really well-written software (djbdns, qmail, etc.) but releasing it with a license that does not allow derivative works (so the community is not allowed to maintain them) and then abandoning them. He has since released is most popular works into the public domain, so people can maintain them now if they want. But he's not interested in putting any more time into them.
1d
comment If DNSSEC is so questionable, why is it ahead of DNSCurve in adoption?
@Pacerier Each has its purpose. One guarantees the integrity of the conversation, and the other guarantees the correctness of the data. It's like how, TLS guarantees that your connection to Gmail is secure, but it doesn't guarantee that the email you read there is truthful. DNSSEC can guarantee truthfulness, but thats about it. Ultimately I think DNSSec is more urgent because it could readily replace our horribly broken TLS PKI, while nearly the entire benefit of DNSCurve can be achieved with a VPN to your DNS server.
2d
awarded  Nice Answer
2d
comment If DNSSEC is so questionable, why is it ahead of DNSCurve in adoption?
@Pacerier neither. I'm not taking sides, I'm just telling you what the two opinions are.
2d
comment If DNSSEC is so questionable, why is it ahead of DNSCurve in adoption?
@Pacerier Really? How about qmail, djbdns, and daemontools, and just to name a few. By contrast, NaCl is actively maintained, but only because it's maintained by other people. Can you give a single example of anything djb has released and actively maintained? Even one?
2d
comment Creating my own CA for an intranet
@André Intermediate certs are just normal certs with basicConstraints = CA:TRUE set in their extended attributes. Nothing magic, just another certificate.
May
19
awarded  Notable Question
May
18
comment OAuth2 vs. JSON authentication
@JamesLambeth yes, presumably that goes without saying; if you want to grant limited account access them you have to define what that means for your service.
May
17
answered Creating my own CA for an intranet
May
16
answered OAuth2 vs. JSON authentication
May
16
comment Which kind of Wifi is safe to use ?
WiFi is not safe. HTTPS is safe. VPNs are safe.
May
13
revised Two-Step vs. Two-Factor Authentication - Is there a difference?
added 263 characters in body
May
11
answered Secure Hash of a very short payload - is it possible?
May
10
awarded  Enlightened
May
10
awarded  Nice Answer
May
6
answered How do google or facebook know I'm behind a man in the middle proxy?