Re: [gentoo-user] Secure DNS servers

[Rich Freeman]

On Mon, Jun 16, 2014 at 2:49 PM, Michael Orlitzky <mjo@g.o> wrote:
> The benefits of DNSSEC are debatable. We're moving the centralized trust
> from one group of scumbags (the CAs) to another group of scumbags (the
> registrars). So the benefits to authentication are not entirely clear-cut.
>
> But, DNSSEC will eventually allow us to do away with the SSL racket, and
> that can only improve security through the widespread adoption of
> encryption. So it's a good thing either way.

While I agree with your concerns about trust, I think the good thing
about DNSSEC is that you don't have to trust as many people.

With the current SSL racket I need to trust all the folks in my
browser's CA list to not mess with my connection.  Any one of them has
the power to spoof any website on the planet, and have you seen how
long the list is?

With DNSSEC the only person who can tamper with a connection is the
domain owner, registrar, and TLD owner.  So, while Verisign can tamper
with a .com domain, they can't mess with a .uk domain, and at least
the folks who buy a .com domain know who they're getting involved
with.  With SSL Verisign can spoof any domain there is anywhere, since
the trust relationship in SSL is not limited to some domain.

I'd like to see things improved further still, but DNSSEC is a big
step in the right direction.

Rich