Re: NSEC3 salt lifetime (and some other DNSSEC params): sane value?

2010-09-21 Thread Kalman Feher
On 22/09/10 4:14 AM, "Doug Barton" wrote: > On 9/21/2010 7:46 AM, Kalman Feher wrote: >> It may well be analogous to that (though I disagree), but the quote does not >> substantiate why knowing public information is bad. In the example above, >> you've simply saved your switchboard and the cal

Re: NSEC3 salt lifetime (and some other DNSSEC params): sane value?

2010-09-21 Thread Warren Kumari
On Sep 21, 2010, at 10:14 PM, Doug Barton wrote: > On 9/21/2010 7:46 AM, Kalman Feher wrote: >> It may well be analogous to that (though I disagree), but the quote does not >> substantiate why knowing public information is bad. In the example above, >> you've simply saved your switchboard and the

Re: NSEC3 salt lifetime (and some other DNSSEC params): sane value?

2010-09-21 Thread Doug Barton
On 9/21/2010 7:46 AM, Kalman Feher wrote: It may well be analogous to that (though I disagree), but the quote does not substantiate why knowing public information is bad. In the example above, you've simply saved your switchboard and the caller some time. If you don't want someone to know it, don

Re: NSEC3 salt lifetime (and some other DNSSEC params): sane value?

2010-09-21 Thread Phil Mayers
On 21/09/10 16:40, Lightner, Jeff wrote: I always liken arguments such as this to a leaky boat. While one certainly does more to eliminate the boat filling with water by plugging the big holes that does NOT mean there is no value is caulking the small ones. Over time enough of the small ones m

RE: NSEC3 salt lifetime (and some other DNSSEC params): sane value?

2010-09-21 Thread Lightner, Jeff
I always liken arguments such as this to a leaky boat. While one certainly does more to eliminate the boat filling with water by plugging the big holes that does NOT mean there is no value is caulking the small ones. Over time enough of the small ones might be enough to swamp the boat. -Ori

Re: NSEC3 salt lifetime (and some other DNSSEC params): sane value?

2010-09-21 Thread Phil Mayers
On 21/09/10 14:43, Niobos wrote: On 2010-09-21 15:32, Kalman Feher wrote: On 21/09/10 8:43 AM, "Niobos" wrote: I personally find protection against zone enumeration to be a false sense of security. If it's public people will find it. Ask your self what it is that you want publically accessible

Re: NSEC3 salt lifetime (and some other DNSSEC params): sane value?

2010-09-21 Thread Kalman Feher
On 21/09/10 3:43 PM, "Niobos" wrote: > On 2010-09-21 15:32, Kalman Feher wrote: >> On 21/09/10 8:43 AM, "Niobos" wrote: >> I personally find protection against zone enumeration to be a false sense of >> security. If it's public people will find it. Ask your self what it is that >> you want pu

Re: NSEC3 salt lifetime (and some other DNSSEC params): sane value?

2010-09-21 Thread Niobos
On 2010-09-21 15:32, Kalman Feher wrote: > On 21/09/10 8:43 AM, "Niobos" wrote: > I personally find protection against zone enumeration to be a false sense of > security. If it's public people will find it. Ask your self what it is that > you want publically accessible yet you don't want others to

Re: NSEC3 salt lifetime (and some other DNSSEC params): sane value?

2010-09-21 Thread Kalman Feher
On 21/09/10 8:43 AM, "Niobos" wrote: > Thank you for the excellent advice! > > On 2010-09-20 18:09, Kevin Oberman wrote: >> I recommend anyone attempting to secure their DNS read the NIST Computer >> Security Resource Center document SP800-81 Rev.1, "Secure Domain Naming >> System (DNS) Guide