Za uporabo teh dodatkov potrebujete Firefox.

Prijava
Ikona dodatka

Ocene za DNSSEC

DNSSEC — Antoine POPINEAU

3,1 od 5 zvezdic
5
10
4
8
3
3
2
12
1
6
Ocena uporabnika Uporabnik Firefoxa 13645153
— Uporabnik Firefoxa 13645153, pred 7 leti
Using fixed remote/public DNSSEC DNS Server/Resolver over unencrypted connection is NOT secure habit/procedure. And Google is known to LOG/record usage for-ever ! https://developers.google.com/speed/public-dns/privacy
Please add option for users, to specify their own local DNSSEC DNS validating servers/resolvers (like: Unbound, BIND, etc) or redirectors/resolvers (like: Stubby, GetDNS, etc) in this addon. Local DNSSEC resolvers or redirectors can run/respond on IP 127.0.0.1, 127.0.0.2, etc, Port 53.
ISP corporations can see+record/log (aka, profile) user's all DNS resolving IP data, etc usage, when DNS query/answer going over UDP/TCP unencryptedly into their or any other DNS server/resolver. If a trustworthy 3rd-Party(3P) public DNSSEC-DNS Server/Resolver service(s) is(are) used (who has publicly publicized that they absolutely do not record user's any DNS usage), then that(those) service(s) can help to maintain privacy (little bit better). When encrypted/TLS connections are used, then ISP cannot see data inside encrypted packet (but can see+record(profile) IP adrs of "from"/"source" and "to"/"destination") unless ISP also obtained required+related decryption cert+key. But tracking/recording/profiling still possible (from 3P to DNS-servers/resolvers traffic), as all DNS servers/resolvers are not yet using DNS-over-TLS, and, DNS by nature need to connect with known/established IP addresses.
When DNS Data & Content Data authenticity can be verified by using unchangeable (but updateable with newer data) records from public p2p ledger (i.e: blockchain), and content data is obtained via multiple random p2p network based multiple peer computers, then full/complete profiling will not be possible.
Unbound DNSSEC server/resolver software also supports Encrypted DNSSEC resolving (DNS-over-TLS https://tools.ietf.org/html/rfc7858 ) on Port 853 when user will use+specify+load custom cert+key in Unbound-resolver & in client (firefox/unbound/libunbound, etc). And when SOCKS5 (tunnel/proxy etc) used by firefox/user/host-computer, then Encrypted DNSSSEC resolving is very necessary.
If this addon (will be) using "libunbound", then also please add option for users to manually specify/add their own "root.key", and/or add PEM/cert for dnssec-rootkey webpage/site, and add/specify cert+key for encrypted/TLS DNS-resolving, etc.
Unbound: https://www.unbound.net/
Quad9 https://quad9.net/ DNSSEC resolving (online) service supports (Encrypted) DNS over TLS, on IP 9.9.9.9 & 2620:fe::fe , Port 853. And GetDnsApi https://getdnsapi.net/ service supports (Encrypted) DNSSEC DNS over TLS on IP 185.49.141.37 & 2a04:b900:0:100::37 , Port 853. Both Quad9 & GetDnsApi also supports unencrypted DNS over UDP/TCP on Port 53. More IP: https://dnsprivacy.org/wiki/display/DP/DNS+Privacy+Test+Servers
The "getdns"/"Stubby" https://getdnsapi.net/ , https://github.com/getdnsapi/getdns , https://github.com/getdnsapi/stubby , etc redirectors/resolvers software can also be used (instead of Unbound/BIND server software) to forward/resolve all local DNS queries over TLS/encrypted connection.
Almost all OS have option to load Unbound (or other Full Validating DNSSEC DNS Server/Resolver, etc), either directly, or thru 3rd-party(3P) package-management software (CygWin, MacPorts, HomeBrew, etc).
Also check out the alternative DNSSEC-Validator (XUL based) firefox addon/extension https://www.dnssec-validator.cz/ which allows using custom/local/remote DNSSEC resolver/server with firefox below v57, (and dnssec-validator does not yet have a Web-Extension (W-E) based addon/extension for firefox v57+ (when i posted this message here Dec-30-2017), but their chrome extension should+can be converted to be used with firefox v57+).
DANE/TLSA is best part of DNSSEC. if this addon is already not doing this, then please also add these options: Display DANE verification related status ICONs in toolbar for HTTPS based websites which are DNSSEC signed, so that user can know/view different ICONs for different types of verification/unverification status.

Odgovor razvijalca

objavljeno ob pred 7 leti
Firstly, we do not use unencrypted connections, everything is done through HTTPS.

Then, the developers of the former DNSSEC-Validator said themselves they would not port their extension because of missing APIs in Firefox 57+. As mentionned in another comment, as far as we know, there is no way of crafting and executing a raw UDP or TCP packet in Firefox 57+. We are therefore forced to use HTTPS to perform all DNS queries through HTTP resolvers.

That being said, I agree using Google by default is not a good choice, and a choice that was made as a proof of concept. I am in the process of forking OpenDNS HTTP resolver to support reporting DNSSEC status, so you can self-host your resolver and use it with this extension instead of Google's.

But that self-hosted resolver will always be an option. The extension has to work on first run, for non-technical people, and must use a publicly-hosted HTTP-based DNS resolver. If you have any service that does that outside Google, I'll be happy to integrate it.
39 ocen
  • — Korwin, pred 9 meseci
    While cloudflare.com/ssl/encrypted-sni/#results tells me that "DNSSEC. Attackers cannot trick you into visiting a fake website by manipulating DNS responses for domains that are outside their control," this extension claims that "cloudflare.com not secure by DNSSEC. Domain www.cloudflare.com is not secure through DNSSEC. Your connection is prone to man-in-the-middle attacks."
  • — Wolfizen, pred enim letom
    Results inaccurate when choosing Cloudflare as the resolver, but can be worked around by choosing Google as the resolver. No option for custom resolver or even native recursive resolution.
  • — Uporabnik Firefoxa 18361289, pred enim letom
    Can hopefully be made even better with https://bugzilla.mozilla.org/show_bug.cgi?id=1852752
  • — PSYCHOPATHiO, pred enim letom
    this is only a choice of 1.1.1.1 or 8.8.8.8 that i can manually enter in settings, poitless i guess
  • — Popi, pred 2 letoma
    Unfortunately we never got to choose the resolver, and now it just stopped providing accurate results altogether.
  • — JB, pred 3 leti
    This use to work... but now no longer works.
  • — Uporabnik Firefoxa 7035052, pred 3 leti
    Wow! A DNSSEC extension that works! And no extra steps to install either.
  • — CognitiveFeline, pred 3 leti
    used to display info and change but now it just always stays at NOPE doubt it's nope and 99% sure it's not me causing it.
  • — ploedman, pred 3 leti
    Recently the Addon shows my Domain as "not secure by DNSSEC". But 3 Website to test the DNSSEC status says the Domain is secured by DNSSEC.
  • — MarSanMar, pred 3 leti
    Actualmente, esta extensión no funciona. La usé mucho tiempo y estaba contento con su funcionamiento, pero ahora mismo he tenido que buscar una alternativa.
  • — Jernej, pred 4 leti
  • — Uporabnik Firefoxa 13662450, pred 5 leti
    No longer works. Was good in the past, but these days say 100% of websites are not secured by DNSSEC, which is outright wrong.
  • — Trashify, pred 5 leti
  • — Asclepius, pred 5 leti
    Thank you for this add-on. I just hope (since it isn't a "recommended" extension) that it is trustworthy. Aside from that concern, it serves its purpose. It would be nice if Firefox had built-in DNSSEC validation.
  • — Boris Volkov, pred 5 leti
  • — Uporabnik Firefoxa 15136226, pred 5 leti
    This add on works well, however there are some issues as pointed out by other reviewers. I would like to note that ECDSAP256SHA256 works for me. It would also be nice if the add on verified https sites with DANE pinned certificates.
  • — Uporabnik Firefoxa 14672905, pred 6 leti
    It's great! And yes, would be even better once we have custom DNS, over TLS or not.
    But this is a feature I have been waiting for so long, so I'm not going to hide my current feeling about this extension, it's awesome!!
  • — _ztv, pred 6 leti
    Well there, the future has not come yet?
  • — Uporabnik Firefoxa 13680056, pred 6 leti
    It will be nice to choose a custom DNSSec, I don't trust on google, and some ISP redirect the 1.1.1.1 to his own DNS.
  • — Uporabnik Firefoxa 15299958, pred 6 leti
  • — Renaud, pred 6 leti
    Using Cloudflare and Google for validation is not a good idea.
    But also, validation fails for some kind of signatures, exemple: those using ECDSAP256SHA256.
  • — Uporabnik Firefoxa 14754691, pred 6 leti
  • — Uporabnik Firefoxa 14514156, pred 6 leti
    I would give at least 4 stars, if it would use my local resolver instead of using google/cloudflare for DNS lookups.

    Reason behind the downgrade:
    1. it introduces a single point of failure:
    if either of those sites can't answer, _ALL_ users of this extension (who have configured that site) can't use it, if it would use the local resolver and that failed it would be just the users of the local machine who experience that problem.

    2. it is a privacy hazard:
    a hacker needs to crack only a single (ok: two) machine(s) to get a complete log of who on this world tried to communicate with which web server....
    if it would use the local configured resolver that _might_ still be a problem, depending on the configuration of said resolver, but mostly (I hope) those will contact multiple authoritative servers to walk from the root to the leaf containing the desired information and only the _last_ server will know which site I wanted to contact, but there it's irrelevant, since _that_ site knows it anyway.... (btw.: _THIS_ is the reason why I disabled this extension)

    3. it can't verify local domains
    according to 'dig' my own domains are DNSSEC enabled and working correctly, still your extension reports them as unsigned because there is no global glue record, as such while it is reachable from the world (via dyndns), the world doesn't see the DNSSEC information stored on my local dns-server.
  • — IPv777, pred 7 leti
    Please let the user choose (a text input) his own DNS resolver(s)
  • — Uporabnik Firefoxa 13310694, pred 7 leti