Re: How do we get the whole world to upgrade to DNSSEC capable resolvers?

[Ted Lemon <[e-mail]>]

On Jul 23, 2008, at 11:32 AM, bert hubert wrote:
> So - DNS needs only to be strong enough to not be easily subverted  
> in the
> process of transporting plaintext unauthenticated data. This puts an  
> upper
> bound on the overhead (financial, technical and administrative) that  
> we
> should commit to DNS security.

So how to I avoid a situation where, when I type "http://www.bankofexample.com/ 
" in the URL bar of my browser, I get a web page from a phisher who  
provides me with a perfectly valid-looking but completely un-secured  
web site that will phish my password?   Even if your bank ordinarily  
puts up a secure form, if a phisher can subvert your DNS, they can do  
this.

Lest you claim "that's no problem, because people know not to submit  
private data to non-secure forms," answer me this: how often do you, a  
security-savvy person, actually look to see if you are submitting to a  
URL that uses SSL?   Now, how often do you think your friend the  
perfectly intelligent non-computer-geek does it?   How often does your  
elderly great aunt who had a stroke last year check?

Maybe DNSSEC is the wrong answer to this question.   But there needs  
to be an answer.   And it can't be "that's the user's  
responsibility."   Good security does not depend on user education.


--
to unsubscribe send a message to [e-mail] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>