Subject: RE: whois and zone enumeration

From: Danny Mayer <[email-masked]>
Date: Tue, 03 Aug 2004 09:53:21 -0400

At 10:53 PM 8/2/2004, Hallam-Baker, Phillip wrote:

> > what we have here is a divergence of vision.  security is not
> > obscurity, and obscurity is not an intended feature of either
> > "dns classic" or any extension ever made to dns.
>
>As a security professional who is engaged as such I can assure
>you that it is a very bad idea to remove security controls
>from an existing system unless you understand their effect.

I agree with Paul. He is not advocating the removal of anything. He's
saying that depending on obscurity for security is no security at all.

>The fact that a control is unintended or is rejected on
>ideological grounds does not mean that it can be dispensed
>with. I am currently dealling with the consequences of
>an industry abandoning certain controls that were present
>in the ATM systems but are not present on the Internet.
>As a result I spend a great deal of time talking to
>law enforcement.

You misread his statement.

>Removing imperfect security controls without replacing them
>is one of the main ways that security protocols fail in
>practice.

Where did he advocate removing imperfect security controls?

>The common sense ideas that preceded the dogmas are still
>generally accepted. But you are advancing a dogmatic interpretation
>that is rejected by the field. It certainly has no place in a
>security design argument.

He's not advancing any dogma. He wants to advance real security.
Preventing zone enumeration through DNSSEC records should not
give the illusion that thereby you are preventing zone enumeration,
just making it more difficult. If the goal is to make it more difficult,
then that should be stated up front.

Danny

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>