5

How can I explain a non-technical person the purpose of Domain Name System Security Extensions (DNSSEC) and the risks of not using DNSSEC? It would be nice to use a metaphor, so that it's also easy to remember for a non-technical person.

0

3 Answers 3

9

Regular DNS responses are like business cards - while you can generally trust them when someone hands theirs to you, they're actually just ink and card stock, and anyone who is even a little motivated can get their own made by a print shop. And there's no way to enforce their validity; I can go to (for example) VistaPrint and they'll ship my "He-Man, Master of the Universe" cards right to me.

DNSSEC DNS responses are like drivers licenses. They've got a picture. They've got a mag strip with a copy of the information. They've got holographs that are difficult to forge. They've got layers printed in special ink that only show up under ultraviolet light. In short, a number of technical measures have been taken to make them hard to forge.

When authentic data is important, DNSSEC/licenses are preferred. Just as the Post Office requires a license and not a business card for identification, so your business might require DNSSEC data for use in connecting to your bank.

1

At the request of @schroeder (I'll also give it a shot myself).

A customer goes weekly to a local store because a friend told him that company A (who runs the store) is trustworthy. The customer does not actually know company A, he just knows the local store because the store is in his area.

One day, company A got bankrupt and a not so trustworthy company B buys the local store, continuing it's original business exactly the same as before. The customer doesn't notice a difference and keeps buying at the local store that is now owned by a not so trustworthy company B, without knowing the difference.

When the local store was protected with DNSSEC, the local store would actually notify the customer that company A changed to company B and reject the customer from entering the store.

4
  • 1
    For the benefit of the techies out here who may not be DNSSEC experts, can you clarify what the Store and the Company represent? I assume the Store is the website and the Company is the webserver? Nov 1, 2016 at 18:46
  • I think the store is the recursive DNS server whereas the company behind it is the authoritative DNS server. But I have been wrong before. Good analogy either way.
    – INV3NT3D
    Nov 1, 2016 at 18:54
  • @GeorgeBailey yes, metaphorically "the store" is the registered domain and the "company" is the web server indeed.
    – Bob Ortiz
    Feb 22, 2017 at 1:11
  • dnssec wouldn't really protect against this scenario. If you were to sell your DNS name to someone else (i.e. you sell the store) the new owner would also get a DNSSEC signed DNS entry. The analogy would be more like someone hijacking your entries in the yellow pages or billboards with your business name, but using a different address across town. DNS Sec is more like an ID for a business, like gowenfawr alludes to that you present to the yellow pages publishers when creating an advertisement. Jun 28, 2017 at 20:21
0

Security (in exchange of data, and DNS is data) boils down generally to three properties:

  • authenticity: making sure the data is received from the real party it should come from and not from a third party trying to mimic the real part
  • confidentiality: making sure no third party of the conversation can understand what is discussed
  • integrity: making sure no third party can alter the conversation (even without understanding it), which is most often translated to making sure to detect any tampering immediately IF any third party is indeed altering the conversation.

There 3 properties are related, but separated. Sometimes you need one, sometimes all 3.

Contrary to popular belief, authenticity is often more "important" than confidentiality or said differently confidentiality without authenticity is often of dubious merits: even if you got data in such a way that noone saw it, if you don't really know where it came from for real, what is the difference if you get it in the clear as it could have come from anyone?

DNS exchanges happen between two parties but data flows through many intermediate systems. Hence, when arrived, by default, you have no guarantee about authenticity, nor confidentiliaty, nor integrity.

DNSSEC was designed to solve only the authenticity problems. It adds to all DNS data a "signature", exactly like in real world, that authentifies the content. You get the data you requested and you get (if everything is setup correctly) the guarantee that the data did in fact come from the true owner of the data (and you get also in part the guarantee it has not been altered in transit). You specifically DO NOT get any guarantee about confidentiality, that is even with DNSSEC, "anyone" sees what names you have requested. For that, DNS over TLS and DNS over HTTPS have been designed, they offer no guarantee on authenticity but offer guarantees on confidentiality and integrity.

Comics

If you need metaphors and things more graphical the below can help.

You can find starting page 3 at https://meetings.icann.org/en/marrakech55/schedule/sun-dnssec-everybody/presentation-dnssec-everybody-06mar16-en.pdf a presentation of DNSSEC using cave men and blue smoke signals.

It is given in many forums, but is clearly very high level, with its blue smoke. It may help to start discussing things in more details if needed.

You can find a more recent one, graphical at: https://howdnssec.works/ about "Why do we need DNSSEC?" and it is open to future more works.

1
  • Regardless if they are comics, images or whatever, answers saying "your answer is in this link" are not accepted. You need to have content here. Thanks for adding content.
    – schroeder
    Dec 27, 2021 at 22:21

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .