Re: SA Internet security issues

> On 04 Jul 2017, at 12:19, Daniel Schroder <[email protected]> wrote:
> 
>   Just want to point out the obvious, DNSEC helps finding sources of DNS
>   spoofing,

um….no.
a DNSSEC signed reponse will be something that can be validated to determine accuracy of the answer received.
that’s not the same as finding the source of what/whom is doing spoofing.  


>  which is often used by high tier ISPs to redirect traffic, or
>   on compromised hardware.

citation needed please.


>   It's useful to have a DNS server that chases
>   DNS queries, and have some form of trusting the reply, if you do your
>   online banking, from a [1]co.za second level domain, you can't do the
>   query via dnsec, so your only other option is using other open dns
>   servers,

not quite;  you can also use your ISP’s DNS servers, or, run your own.


> however it's easy to spoof or hijack queries from there as well.

yes, considerably easier, than if you used your ISP, whom you, presumably trust.


>   Also I have a feeling Ipv6 is also going to become a problem.
>   Especially in terms of routing, the primaries for za do not all route
>   locally,

that’s a broad statement, with little evidence.  from a pretty well connnected, dual-stacked host in JNB, i see: 
nishal@jnb:~$ dig +nssearch za | awk -F ' ' '{print $11, $12, $13, $14}'
194.146.106.78 in 0 ms.
204.61.216.55 in 1 ms.
2001:67c:1010:19::53 in 1 ms.
2001:500:14:6055:ad::1 in 1 ms.
196.4.160.27 in 3 ms.
2001:4200:ffff:a::1 in 17 ms.
196.21.79.50 in 17 ms.
2001:500:2e::1 in 170 ms.
192.5.4.1 in 179 ms.

for good measure, i also pasted in the results from a host in CPT below [2].  
all of this tells me that 1 host isn’t dual stacked (naughty 3741 !), and one host is likely hosted out of ZA.  i don’t see any of the IPv6 problems you allude to.
since there is no requirement to have all secondaries inside your country, and i recognise three of those hosts as anycast, i’ll ask again - what IPv6 problem are you seeing, and are you sure it’s not just from your perspective? 

—n.

[2]  nishal@cpt:~$ dig +nssearch za | awk -F ' ' '{print $11, $12, $13, $14}'
196.21.79.50 in 0 ms.
204.61.216.55 in 7 ms.
2001:500:14:6055:ad::1 in 7 ms.
194.146.106.78 in 16 ms.
2001:67c:1010:19::53 in 16 ms.
196.4.160.27 in 17 ms.
2001:4200:ffff:a::1 in 32 ms.
2001:500:2e::1 in 156 ms.
192.5.4.1 in 282 ms.

_______________________________________________
IOZ mailing list
[email protected]
http://lists.internet.org.za/mailman/listinfo/ioz