24 Feb
2019
24 Feb
'19
11:42 p.m.
On Mon, Feb 25, 2019, 1:30 PM John Levine <johnl@iecc.com> wrote:
You are right, if you can compromise a registrar that permits DNSSEC to be disabled (without notification/confirmation to POCs etc), then you only have a limited period (max of DS TTL) of protection for those resolvers that have already cached the DS.
As far as I can tell, that's roughly all of them. If you have the credentials to log in and change the NS, you can change or remove the DS, too.
And, that wouldn't change in the nearest future, because the concept of "hostile pinning" as it was present with HTTPS Public Key Pinning could also be ported to DNSSEC this way. "Hostile signing"... doesn't that sound scary. -- Töma