to tptacek's point - an attacker doesn't need to change the root zone.
to tptacek's point - an attacker doesn't need to change the root zone. All they need is the root key. (This argument could be equally made of the CA system.) Then they can sign anything they like, anytime they like, and only for some small targeted set of the population - and for DNSSEC, that's ONLY if you're checking it anyway. (and if you don't control your recursive resolver or patch your browser, tough cookies). @danyork your edge checking is great.. so I presume you never bring your laptop to a coffee shop. ;) Let's not be naive.. as far as root keys go, Verisign is a big company and will promptly hand over any and all keys upon receipt of an NSL or court order and probably just an administrative subpoena. That's how you win and keep massive, government-mandated monopolies to run the world. (To be fair, it's not Verisign's fault that the entire CA system is broken. Oh, wait, actually.. it's exactly Verisign's fault. https://en.wikipedia.org/wiki/Verisign#History )
Posted by jamiesonbecker on Apr 14, 2015, 9:38 PM
Tags
Related issues
- Huh, this is not my experience.
- For some reason an Azure outage does not faze me in the same way that an AWS outage does.
- The triplet of wind, pole, dragon appears multiple times in the same order, so is possibly a single phrase that has been broken up into t...
- Option to skip refreshing resource instances whose configuration hasn't changed since the last apply
- [YouTube] Unable to extract uploader id
- Add ability to prioritize GitHub Action runners
Raise real-world problems, find people facing the same issue, and discuss solutions.7,000 issues0 comments
reliability (E-commerce)
Huh, this is not my experience.
For some reason an Azure outage does not faze me in the same way that an AWS outage does.
The triplet of wind, pole, dragon appears multiple times in the same order, so is possibly a single phrase that has been broken up into t...
Option to skip refreshing resource instances whose configuration hasn't changed since the last apply
[YouTube] Unable to extract uploader id
Add ability to prioritize GitHub Action runners
Microsoft Flight Simulator (2020) (1250410)
Codegen collaboration with Apollo Codegen and GraphQL Code Generator
to tptacek's point - an attacker doesn't need to change the root zone.
to tptacek's point - an attacker doesn't need to change the root zone. All they need is the root key. (This argument could be equally made of the CA system.) Then they can sign anything they like, anytime they like, and only for some small targeted set of the population - and for DNSSEC, that's ONLY if you're checking it anyway. (and if you don't control your recursive resolver or patch your browser, tough cookies). @danyork your edge checking is great.. so I presume you never bring your laptop to a coffee shop. ;) Let's not be naive.. as far as root keys go, Verisign is a big company and will promptly hand over any and all keys upon receipt of an NSL or court order and probably just an administrative subpoena. That's how you win and keep massive, government-mandated monopolies to run the world. (To be fair, it's not Verisign's fault that the entire CA system is broken. Oh, wait, actually.. it's exactly Verisign's fault. https://en.wikipedia.org/wiki/Verisign#History )
Comments (0)
No comments yet. Start the discussion.