Comment by AnthonyMouse | Hacker News Reader

Comment by AnthonyMouse | Hacker News Reader

Parent Full thread

>something does need to be done.

Can you elaborate on why that is?

"Something must be done" is the refrain of private defense contractors seeking new revenue streams following the tapering off of our most recent foreign excursions. "Cyber war" is total B.S. It's just taking the same industrial espionage issues that have existed forever and adding "on a computer" to it in order to increase the hype level.

There are a ton of things the government could actually do to help with information security. Some of them are even in the bill -- I don't think anyone has a problem with government providing threat information to the private sector. Or how about more funding for security research. Incentives to implement protocols like DNSSEC.

But there is no excuse for exempting corporations from all privacy laws using extremely vague language. The problem with this bill is very much the implementation rather than the intent, but "good intentions" are no justification for bad legislation.

> "Something must be done" is the refrain of private defense contractors seeking new revenue streams...

TechDirt points out a key Congressman's wife is in security contracting, an industry very interested in the outcome of this bill:

... as we've noted all along, all attempts at cybersecurity legislation have always been about money. Mainly, money to big defense contractors aiming to provide the government with lots of very expensive "solutions" to the cybersecurity "problem" -- a problem that still has not been adequately defined beyond fake scare stories. Just last month, Rogers accidentally tweeted (and then deleted) a story about how CISPA supporters, like himself, had received 15 times more money from pro-CISPA group that the opposition had received from anti-CISPA groups.

So it seems rather interesting to note that Rogers' wife, Kristi Clemens Rogers, was, until recently, the president and CEO of Aegis LLC a "security" defense contractor company, whom she helped to secure a $10 billion (with a b) contract with the State Department. The company describes itself as "a leading private security company, provides government and corporate clients with a full spectrum of intelligence-led, culturally-sensitive security solutions to operational and development challenges around the world."

Hmm. Sounds like a company like that would benefit greatly to seeing a big ramp up in cybersecurity FUD around the globe, and, with it, big budgets by various government agencies to spend on such things.

-- http://www.techdirt.com/articles/20130417/16253022748/oh-loo...

Of course, now it's up to the Senate.

Incidentally, not to get me started on another topic that will result in 18,000 new comments from me, but DNSSEC is a boondoggle that won't help the Internet and is a massive favor to the largest registrars. We should be thankful that we dodged the bullet of a bill that mandated DNSSEC.

That's interesting. Have you (or someone else) written about the issues with DNSSEC somewhere? It always seemed to me that the role of the registrars wouldn't change much.

I've written a lot about DNSSEC, but we tore the blog down so I can't cite it; the best I can do is:

https://news.ycombinator.com/item?id=4071178

It seems like your argument is that TLS is better than DNSSEC, so use that instead. But how is that better than using both?

I'll give you that DNSSEC is imperfectly designed, but given that it hasn't been widely deployed, why not just make DNSSECv2 which addresses the concerns (like have the end user device verify the signature)?

TLS isn't simply better than DNSSEC: DNSSEC still requires TLS. If you use just DNSSEC, and you stipulate that DNSSEC does what it's supposed to do (spoiler: it doesn't) then all you've done is protect your DNS lookup. So TLS is a non-optional component in the web stack even in the very unlikely event DNSSEC is deployed.

So the problems with DNSSEC then boil down to:

* TLS isn't designed to depend on the security of the DNS. How you know that is, TLS works today, and nobody uses DNSSEC. So if everything needs TLS anyways, why forklift in a new DNS when we could instead work on making TLS better?

* DNSSEC actually degrades the DNS. In a couple ways. First, DNSSEC changes the security model of DNS records; they're now signed, but also they're public. For a long time, DNSSEC advocates claims that DNS records were always public, but that's clearly not true; try to dump Bank of America's zone files. When the advocates lost the argument, they introduced a grotesque hack that turned DNS zones into crackable password files (this is "NSEC3"). That's just one example; there are better examples.

There is a proposed alternative to DNSSEC that I like: DNSCurve. DNSCurve gives up on the idea of signing DNS records and instead just allows any DNS client to create a secure connection to any DNS server. That's a totally sane improvement to the DNS which inexplicably isn't included in DNSSEC (your DNS lookups in a DNSSEC world are still unprotected!). We should do that instead of DNSSEC.

>So if everything needs TLS anyways, why forklift in a new DNS when we could instead work on making TLS better?

For one thing, not everything uses TLS (even if it should). TLS normally requires support by the application, securing DNS could be done in the OS. You could fix DNS and have at least that fixed even for all the legacy applications that nobody is ever going to update to use TLS. It would also make IPSec easier to deploy to the same effect because it would allow the DNS to be used for key distribution. And likewise for distributing ssh host keys.

I'll give you that DNSSEC is poorly designed, but I don't necessarily want "DNSSEC" in particular, I'm just looking for something that allows client devices to securely verify DNS query responses. Does DNSCurve do that? The Wikipedia entry doesn't clearly distinguish whether it's securing the connection to the server or the query response. In other words, does DNSCurve allow you to detect if your ISP's DNS resolver is compromised?

That is exactly what DNSCurve does, and is something DNSSEC does not do.

See, this is why I like this place. People who can teach me things. OK then, so why haven't we deployed DNSCurve?

Reply on news.ycombinator.com