<html><head><meta http-equiv="Content-Type" content="text/html charset=us-ascii"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;">In all my readings on it I kept walking away thinking that I understood its purpose, but I'd then come back at myself with the same question: what does it give us over HTTPS?<div><br></div><div>I kept not being able to answer this question so I searched more, and eventually stumbled across these two comments on an article about DNSSEC:</div><div><br></div><div><a href="http://www.circleid.com/posts/securing_a_domain_ssl_vs_dnssec/#5830">http://www.circleid.com/posts/securing_a_domain_ssl_vs_dnssec/#5830</a></div><div><a href="http://www.circleid.com/posts/securing_a_domain_ssl_vs_dnssec/#5841">http://www.circleid.com/posts/securing_a_domain_ssl_vs_dnssec/#5841</a></div><div><div><br class="webkit-block-placeholder"></div><div>Selected quotes:</div><div><br></div></div><blockquote style="margin: 0 0 0 40px; border: none; padding: 0px;"><div><div><p>Unfortunately, <b>DNSSEC isn't actually providing additional security against a genuine MITM attack</b>: SSL/TLS is still the weak link in the chain when DNSSEC is used!
</p><p>
DNSSEC plus SSL/TLS is therefore <em>not</em> defence in depth against general MITM attacks. </p></div></div></blockquote><blockquote style="margin: 0 0 0 40px; border: none; padding: 0px;"><div><div>[..]</div></div><div><br></div><div><p>No, that's precisely wrong. Cache poisoning isn't a serious threat if
SSL/TLS is working correctly. In the presence of functional SSL/TLS, DNS
cache poisoning can only produce a denial of service attack. The
scenario we're trying to prevent is, "A thinks he is talking with B, but
is actually talking with C." Cache poisoning can give A the address of C
instead of B, which is a start, but C can't pass himself off as B
unless he compromises the SSL/TLS process.
</p><p>
SSL/TLS provides end-to-end security. It catches DNS forgery. It catches
route hijacking. It catches an arbitrary man in the middle. If SSL/TLS
is working, every security compromise that DNSSEC can prevent has
already been covered, and then some. </p></div></blockquote><div><div><br class="webkit-block-placeholder"></div><div>What say you list? To me, the DNSSEC thing seems like it might be mostly a waste of a bunch of people's time.</div><div><br></div><div>- Greg</div><div>
<br>--<br>Please do not email me anything that you are not comfortable also sharing with the NSA.<br>
</div>
<br></div></body></html>