All Questions
Tagged with dnssec man-in-the-middle
11 questions
2
votes
0
answers
95
views
Does DNSSEC prevent man-in-the-middle at all? [duplicate]
I just watched a video on DNS that explained that if there is a man-in-the-middle or if someone has taken over your resolver, DNSSEC can prevent the responses from being tampered with because the ...
- 23
1
vote
0
answers
412
views
Detecting a web based MITM attack?
I've been looking into ways to detect a Man In the Middle attack, when the client has "duped" into trusting third party CA. Examples of this are, anti-virus applications and corporate ...
- 11
1
vote
1
answer
247
views
How does DNSCurve protect against forgery in a man-in-the-middle attack scenario?
This Question is about DNSCurve. I thought of DNSCurve as "HTTPS for DNS" (like in this Answer) but had some resent thoughts about the trust-relationship between resolvers and nameservers serving the ...
- 11
0
votes
1
answer
302
views
DNSSEC ZSK compromisation (man-in-the-middle attack)
Assuming I am administering a DNS zone and I operate an authoritative name server that is secured with DNSSEC (split ZSK/KSK setup).
When the Zone-Signing-Key (ZSK) ever gets compromised, would it be ...
- 333
3
votes
3
answers
17k
views
Is there a point to Dnscrypt when using VPN?
If a computer is already connected to the internet through VPN, is there point in encrypting DNS queries? From DNScrypt:
DNSCrypt is a protocol that authenticates communications between a DNS
...
- 57
7
votes
2
answers
1k
views
Opt into strict DNSSEC checking - does DNSSEC provide a way for a zone to request strict signature validation?
Is there a way for a domain good.com to promise that it will sign all of its DNS records, and that any unsigned records for any host *.good.com should be rejected? In other words, is there a way for ...
- 100k
7
votes
2
answers
6k
views
Can you force your PC or device to use only DNSSec-verified lookup results?
Okay, I'll admit something first-off: I don't really understand some of the practical aspects of how DNSSec protections work very well.(Even after reading resources like this.)
Well, I certainly ...
- 2,815
2
votes
2
answers
374
views
Security of certificate when using DNSSEC
When setting up secure server, it is suggested not to use self-signed certs and instead to be signed by a CA. Of course, post-Snowden we now know that there may be problems with CA's that could allow ...
- 261
5
votes
1
answer
1k
views
Is DNSSEC immune to stripping signatures?
In my opinion, it should be possible to forge DNS reply so it doesn't include DS/RRSIG/... parts for any request, thus bypassing DNSSEC validation of resolved domain.
Is DNSSEC system immune to this ...
- 2,253
7
votes
2
answers
2k
views
How does a client know that a DNS zone is DNSSEC protected?
Recently, I've been reading about DNSSEC and how it works. I found other questions and some very interesting answers on this and other websites related to this matter.
However, I have a question to ...
- 173
18
votes
4
answers
5k
views
Does Tor Hidden Service Protocol provide more threat protection than a standard HTTPS session?
DuckDuckGo is a search engine that has a Tor Exit Enclave and hidden service. This site is focused on the safe, secure searching of its users.
Since DNS is not used in Tor, it appears that HTTPS is ...
- 51.1k