CAcert System Admins discussion list

[samj AT samj.net]

On 8/17/08, Philipp Guehring 
<philipp AT cacert.org>
 wrote:
> Hi,
>> interesting to see you aleady went through much of the process I just
>> did about adding DNS services etc. And came to the same conclusions.
>>
>> Actually registrars like .se are finding they can charge more for
>> secured domains, which is both good and bad for adoption.
>>
> Do they provide whois over SSL for secured domains?

Secured == DNSSEC

>> I guess encrypting the probes is useless if they already have to log
>> in to respond to one, as they should.
>>
> Well, it helps for privacy, but it is unlikely that it helps for security.
>> Sampling the DNS from multiple points would help without imposing
>> delay
> Yes, I think we should implement that.
> Can anyone implement a whois and DNS proxy service, that
> does not do any caching and checks for coherence?
>> and randomly delaying the probe would too, while also slowing
>> down attacks
> How long would you delay those probes? Seconds? Minutes? Hours? Days? Weeks?
> What's the exact threat-scenario that the delays help against?

DNS attacks often rely on knowing when a query will be done so
delaying it even seconds should help. The other one is where I walk
into your office while you fetch a coffee and use the window to
respond to a probe, this hijacking your address. Delaying the probe
will slow you down, but you could always just visit in advance and set
up a filter.

>> involving intermittent access to a victim's email, but it
>> affects the user experience and could probably be foiled by filters.
>>
> Yes.
>
> Best regards,
> Philipp GÜhring
>