Re: [Resolverless-dns] 103 Unofficial Side-meeting Notes

["Ralf Weber" <[e-mail]>]

Moin!

On 6 Nov 2018, at 21:42, Justin Henck wrote:

> Hi all,
> Thanks for attending the side-meeting today. Though there are clearly 
> some
> issues to resolve, there were three specific proposals put forward 
> during
> and after the meeting for pushing DNS records or similar information.
> (Listed below in the order they were presented.) Since I'm a newcomer, 
> what
> seems like a good goal for 104?
>
> Proposal 1: DNSSEC-signed: Any outbound link or resource from a site
This has the problem that the information the http server has might be 
signed, but still could lead the user to a bad endpoint from a CDN 
perspective as the DNS query probably was done with the IP of the http 
server and not the client. Yeah I know there is ECS for this, but most 
authoritative servers only accept that when you are whitelisted.

> Proposal 2: ??: CDN-local links or resources
This is the only way that potentially could work, but even then you 
loose all the security properties your resolver normally provides you 
and it totally is possible for bad guys to serve traffic over a CDN.

> Proposal 3: Within TLS: Any automatically loaded resource, perhaps in 
> the
> HTML
Seems similar to 2, maybe a bit wider, but still could be used to attack 
you.

I think we have to recognise the case that an attacker controls the 
endpoint you connect to and can circumvent security measures you have in 
a your resolver which might be protection agains DNS rebinding (sneaking 
in a public name to point to your RFC1918) for homes and enterprises, or 
might start a phishing attack by sneaking in a IDN near identical name 
(goᴏgle.com. - look closely if you would have catched this real domain 
is xn--gogle-n29a.com. ) and then directing you there.

In both cases your security properties possibly get worse when using 
resolver less DNS.

So long
-Ralf
—--
Ralf Weber