| |||||||||||||
SSL fix flags forged certificates before they're accepted by browsers (Ars Technica)SSL fix flags forged certificates before they're accepted by browsers (Ars Technica)Posted May 25, 2012 22:45 UTC (Fri) by Cyberax (✭ supporter ✭, #52523)In reply to: SSL fix flags forged certificates before they're accepted by browsers (Ars Technica) by Lennie Parent article: SSL fix flags forged certificates before they're accepted by browsers (Ars Technica)
Incorrect. DNSSEC is _hierarchical_ unlike SSL CAs.
I.e. you have one DNSSEC root and a lot of other entities maintaining security of subdomains. And what's good, upper levels of hierarchy do not control lower levels directly.
So you can create a subdomain in .se zone and in practice you'll only need to trust your DNS registrar and .se zone operators. There's no practical way for The Evil Government to subvert your trust chain except by forcing your registrar to create fake records in its zone.
(Log in to post comments)
SSL fix flags forged certificates before they're accepted by browsers (Ars Technica) Posted May 25, 2012 22:53 UTC (Fri) by Lennie (subscriber, #49641) [Link]
There currently is nothing stopping the root from removing .se or taking over .se completely with new nameservers (and removing DNSSEC or replacing it with a new DNSSEC key).
That way they can publish anything at .se they want including everything which is currently at .se (even signed with a new DNSSEC key) ;-)
Obviously this would be noticed, but there is no technical limit which would prevents this.
SSL fix flags forged certificates before they're accepted by browsers (Ars Technica) Posted May 26, 2012 11:16 UTC (Sat) by Cyberax (✭ supporter ✭, #52523) [Link]
>There currently is nothing stopping the root from removing .se or taking over .se completely with new nameservers (and removing DNSSEC or replacing it with a new DNSSEC key).
I've specifically said that there are no _practical_ attacks. Completely taking over a domain of a sovereign state is not practical and it won't be covert.
SSL fix flags forged certificates before they're accepted by browsers (Ars Technica) Posted May 26, 2012 11:29 UTC (Sat) by Lennie (subscriber, #49641) [Link]
We agree, I was just mentioning there is no technical barrier.
|
|||||||||||||