oss-sec mailing list archives
Re: attacking hsts through ntp
From: Hanno Böck <hanno () hboeck de>
Date: Sat, 18 Oct 2014 11:59:21 +0200
Am Fri, 17 Oct 2014 08:50:57 -0700 schrieb Tim <tim-security () sentinelchicken org>:
It seems to be a better place to put HSTS-like information is the DNS.
I hear this "we need to fix TLS/HTTPS with DNSSEC" a lot. There are a couple of difficulties with that: 1. DNSSEC is currently mostly vapoware. At least since the kaminsky DNS attacks (2008!) I'm hearing "DNSSEC is coming". The reality is: it's not. Adoption is very rare today. This may change, but I don't see anyone rushing to DNSSEC. 2. Even if DNSSEC would work: How exactly do you want a browser to check dnssec records? Should it have its own dns server? Because right now the usual setup is: * Provider runs DNS server * (sometimes) router is running a DNS server which is basically forwarding requests to the provider DNS * Client has no own DNS, just queries router or provider DNS Basically, the current situation doesn't really consider having DNSSEC verified on the client. This could of course be fixed by either having a local DNS resolver running or having the browsers ship their own DNS resolver. However that's a rather huge change and it will likely have some other implications (portal pages come to mind) - and I don't see anybody working on this. That said: I wouldn't entirely throw the idea away of using dnssec to increase tls security. But it's not something we can do today or any time soon. -- Hanno Böck http://hboeck.de/ mail/jabber: hanno () hboeck de GPG: BBB51E42
Attachment:
signature.asc
Description:
Current thread:
- Re: attacking hsts through ntp, (continued)
- Re: attacking hsts through ntp Kurt Seifried (Oct 16)
- Re: attacking hsts through ntp Hanno Böck (Oct 17)
- Re: attacking hsts through ntp Yves-Alexis Perez (Oct 17)
- Re: attacking hsts through ntp Stephen Röttger (Oct 17)
- Re: attacking hsts through ntp Yves-Alexis Perez (Oct 18)
- Re: attacking hsts through ntp Stephen Röttger (Oct 20)
- RE: attacking hsts through ntp Bendler, Ehren (Oct 20)
- Re: attacking hsts through ntp Kurt Seifried (Oct 16)
- Re: attacking hsts through ntp Tim (Oct 17)
- Re: attacking hsts through ntp Phil Pennock (Oct 17)
- Re: attacking hsts through ntp Tim (Oct 17)
- Re: attacking hsts through ntp Hanno Böck (Oct 18)