2

In FireFox, for example, there are network.dnsCacheExpiration and network.dnsCacheEntries preferences in about:config. Is increasing the length of time and number of cached DNS entries a security vulnerability? What if the IP address of the secure website I'm visiting changes, but my browser uses the old cached address, and now it's trying to authenticate to the wrong website, which could be that of an attacker?

  • 1
    What's the probability of this becoming a security problem? Near nil, I'd gather. – Deer Hunter Mar 11 '16 at 17:08
  • I don't see why all of a sudden, an IP that was reserved for X service would be reassigned to Y service. – Simon Mar 11 '16 at 17:09
  • @Simon Yes, that's true; it's unlikely. – Geremia Mar 11 '16 at 18:31
  • @DeerHunter Currently, yes; but it's a possible attack, no? – Geremia Mar 11 '16 at 18:33
6

This is what TLS is supposed to fix - if the website uses a certificate to identify itself, someone having the old IP address will still not be able to impersonate them.

Also, even if you don't cache the entries within Firefox, your own resolver is going to cache them. You cannot count on a DNS change being immediately visible to all clients - so anyone moving their site from one IP address to another should keep a cache or a redirect going at the old IP address for a while, in order to prevent just this.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.