[Cryptography] DNSSEC = completely unnecessary?

[Ben Laurie]

On 6 November 2013 19:13, Kelly John Rose <iam at kjro.se> wrote:
> On 11/6/2013 10:52 AM, Ben Laurie wrote:
>> On 6 November 2013 01:48, Paul Wouters <paul at cypherpunks.ca> wrote:
>>> That's a nonsense argument. Abuse of such powers, unlike the plethora of
>>> CA certs, would need to be world visible, that is untargetted. It would
>>> be very very visible. It is a huge win over CAcerts that can target
>>> individuals with specifically crafted signed certs.
>>>
>>> With dnssec, if the Government of Canada causes my nohats.ca to be
>>> modified (appear red on your above map), then my domain's public
>>> information changes. I would notice that. This is not an invisible
>>> MITM like some CA cert injection.
>>
>> How did DNS get this magic un-MITM-able property?
>>
>> Surely if the GoC wants to cause nohats.ca to be modified, for some
>> specific target(s), they can do that?
>
> He didn't say it isn't MITM-able. He said that it cannot do so
> invisibly. In his model Eve would be able to perform a MITM attack, but
> it would be immediately apparent to any party since the public
> information would have to change.

I got what he said. Its not true.