2

In FireFox, for example, there are network.dnsCacheExpiration and network.dnsCacheEntries preferences in about:config. Is increasing the length of time and number of cached DNS entries a security vulnerability? What if the IP address of the secure website I'm visiting changes, but my browser uses the old cached address, and now it's trying to authenticate to the wrong website, which could be that of an attacker?

4
  • 1
    What's the probability of this becoming a security problem? Near nil, I'd gather. Commented Mar 11, 2016 at 17:08
  • I don't see why all of a sudden, an IP that was reserved for X service would be reassigned to Y service.
    – Simon
    Commented Mar 11, 2016 at 17:09
  • @Simon Yes, that's true; it's unlikely.
    – Geremia
    Commented Mar 11, 2016 at 18:31
  • @DeerHunter Currently, yes; but it's a possible attack, no?
    – Geremia
    Commented Mar 11, 2016 at 18:33

1 Answer 1

6

This is what TLS is supposed to fix - if the website uses a certificate to identify itself, someone having the old IP address will still not be able to impersonate them.

Also, even if you don't cache the entries within Firefox, your own resolver is going to cache them. You cannot count on a DNS change being immediately visible to all clients - so anyone moving their site from one IP address to another should keep a cache or a redirect going at the old IP address for a while, in order to prevent just this.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .