Articles
Likes on articles
Willem Toorop is a developer and researcher at NLnet Labs. NLnet Labs is a non-profit research lab dedicated to the development of Open Source software and open standards for the benefit of the Internet. NLnet Labs mission is to provide globally recognized innovations and expertise for those technologies that turn a network of networks into an Open Internet for All. At NLnet Labs, Willem's topics of interest are end-user security and privacy. Willem has actively researched how DNSSEC may be hampered for end-users and looked into strategies to overcome such roadblocks. The results of this research are incorporated in the getdns resolver library and its associates stub resolver Stubby. Besides his work on getdns and Stubby, Willem is also the primary maintainer and developer of the other NLnet Labs DNS libraries: ldns and Net::DNS.
• 10 min read
DNS Flag Day was the result of a collaborative effort and agreement of DNS implementers and DNS resolver operators to commit to no longer providing workarounds for non-standards-compliant authoritative nameservers as of 1 February 2019. In the lead up to DNS Flag Day, and as part of the outreach…
• 8 min read
The ISOC African regional bureau has been organising hackathons at the last three editions of the Africa Internet Summit. This year we were given the opportunity to lead a track there at: "Measuring DNS and DoH". This is a report on the event and it's valuable and contributory outcome.
• 11 min read
Is DNSSEC still needed when you get your DNS over TLS? DNSSEC's original design goals could also be met in a future DoT-only world. However, DNSSEC's aspirations have moved on with DANE. Unfortunately DNSSEC and DANE are hardly ever available at end-user devices. DoT brings liable delivery of DNS, …
Showing 3 article(s)
DNSSEC is not only just a security measure, it is also a viable alternative for the flawed PKIX based on Certificate Authorities. With DANE (the DNSSEC based PKIX) domain owners can vouch for their own services themselves, without needing the third party Certificate Authority. DANE is already increasingly used with infrastructural services such as SMTP, but currently uptake on end-points is hampered by interfering middle-boxes. Benno Overeinder wrote an excellent blog-post on these matters earlier this year: https://labs.ripe.net/Members/benno_overeinder/bringing-dns-security-and-privacy-to-the-end-user Work to overcome the issues in bringing DNSSEC to the end-user devices is in progress. For example with the DNSSEC chain TLS extension with which the DANE record including all DNSSEC data needed to authenticate a TLS session is transferred in band in the TLS session, bypassing the DNSSEC hampering middleboxes: https://datatracker.ietf.org/doc/draft-ietf-tls-dnssec-chain-extension/
Showing 1 comment(s)