Comcast — Owner Of NBC Universal — Admits That DNS Redirects Are Incompatible With DNSSEC

(Mis)Uses of Technology

from the well-look-at-that dept

Well, well, well. Here’s something interesting. Comcast, who owns NBC Universal (one of the main forces behind SOPA/PIPA), is officially a SOPA/PIPA supporter. However, yesterday, Comcast put up a post congratulating itself (deservedly so!) for completing its DNSSEC deployment, making it “the first large ISP in the North America to have fully implemented” DNSSEC across the board. That’s huge, and a clear vote of confidence for DNSSEC, obviously. They also urge others to use DNSSEC:

Now that nearly 20 million households in the U.S. are able to use DNSSEC, we feel it is an important time to urge major domain owners, especially commerce and banking-related sites, to begin signing their domain names. While in the past those domains may have wanted to do so but felt it would have limited effect, they now can work on signing their domains knowing that the largest ISP in the U.S. can validate those signatures on behalf of our customers.

All of this is good… but what may be much more interesting is that, along with this announcement, Comcast has also mentioned that it is shutting down its Domain Helper service. Domain Helper was a somewhat controversial DNS-redirect system, so that when you mistyped something, it would suggest the proper page or alternatives. Many in the internet community complained that these types of redirects mess with the underlying DNS system (which they do). But, as the DNS experts have been saying all along (and NBC Universal has been trying to play down), DNSSEC is incompatible with such DNS redirects. So… that makes this next part a little awkward. Comcast is now admitting, indeed, that DNS redirects, such as Domain Helper, are incompatible with DNSSEC:

When we launched the Domain Helper service, we also set in motion its eventual shutdown due to our plans to launch DNSSEC. Domain Helper has been turned off since DNS response modification tactics, including DNS redirect services, are technically incompatible with DNSSEC and/or create conditions that can be indistinguishable from malicious modifications of DNS traffic (including DNS cache poisoning attacks). Since we want to ensure our customers have the most secure Internet experience, and that if they detect any DNSSEC breakage or error messages that they know to be concerned (rather than not knowing if the breakage/error was “official” and caused by our redirect service or “unofficial” and caused by an attacker), our priority has been placed on DNSSEC deployment — now automatically protecting our customers…

Let’s be doubly clear about this, because it’s important. Just as NBC Universal and other SOPA supporters continue to insist that DNS redirect is completely compatible with DNSSEC… Comcast (and official SOPA/PIPA supporter) has rolled out DNSSEC, urged others to roll out DNSSEC and turned off its own DNS redirect system, stating clearly that DNS redirect is incompatible with DNSSEC, if you want to keep people secure. In the end, this certainly appears to suggest that Comcast is admitting that it cannot comply with SOPA/PIPA, even as the very same company is advocating for those laws.

It would appear that the left hand (people who actually understand technology) isn’t speaking to the right hand (lawyers/lobbyists) within the Comcast family. But, I think that NBC Universal and anyone else insisting that DNS redirects are fine in DNSSEC owe everyone else a pretty big apology… when their own company’s experts are admitting that the two are incompatible.

Filed Under: dns, dns blocking, dnssec
Companies: comcast, nbc universal

Co-Chair Of Congressional Cybersecurity Caucus Says SOPA Would Interfere With Online Security

Say That Again

from the more-and-more-opposition dept

The opposition in Congress against SOPA continues to grow. The latest is a big one: the co-chair of the Congressional Cybersecurity Caucus, Rep. Jim Langevin, has come out against SOPA, stating his fears that the bill would negatively impact “security and openness” online. He noted that it “would interfere with efforts to increase transparency and security online” and specifically noted that it would undermine DNSSEC and similar efforts that “help increase trust online.”

Filed Under: congress, cybersecurity, dns blocking, jim langevin, pipa, protect ip, security, sopa

'Nerds' Finally Get Their SOPA Hearings Over Technical Impact… But Not At The Judiciary Committee

(Mis)Uses of Technology

from the good-to-see dept

While Lamar Smith and the House Judiciary Committee still have refused to hear from the actual technology experts, Rep. Issa has now scheduled a SOPA-related hearing… in his House Oversight Committee, and it will finally allow tech experts to speak about the technological impact of SOPA. It’s a good list of speakers including: famed security researcher Dan Kaminsky (who co-authored the paper about problems of SOPA with Paul Vixie and others), Stewart Baker (former DHS/NSA top official, who has warned about SOPA harming internet security), Dr. Leonard Napolitano (from Sandia National Labs, who also warned about the security problems), Michael Macleod-Ball (from the ACLU). And representing the startup world, we’ve got Brad Burnham (from Union Square Ventures — probably the most sought after VC firm for startups today) and Alexis Ohanian, the entrepreneur behind Reddit, Hipmunk and Breadpig, and who has been an outstanding advocate for why SOPA is dangerous. Think of this as the hearing that Lamar Smith didn’t want you to hear. Update: Reasonable point in the comments: this hearing is extremely one-sided as well. Perhaps that’s fitting “counter-balance” for the pro-SOPA hearing that the Judiciary Committee held, but it still would be nice to have at least some “pro-” voices on the hearing. Of course, can you think of an actual, respected technologist who is in favor of SOPA? Yeah… didn’t think so…

Filed Under: alexis ohanian, brad burnham, cybersecurity, dan kaminsky, darrell issa, dns blocking, dnssec, leonard napolitano, michael macleod-ball, pipa, protect ip, security, sopa, stewart baker

Harvard Researchers Explain That SOPA Supporters Are Misusing Their Research To Support SOPA

Say That Again

from the not-so-fast,-daniel-castro dept

We recently discussed how ITIF’s Daniel Castro (who’s been credited with pushing a SOPA-style censorship program to government officials in the first place) bizarrely used the web censorship done by 13 of the most oppressive governments to support his case that censorship under SOPA would work. The argument was based on a Harvard/OpenNet Initiative to study how the internet is censored and used in various repressive nations. The authors of that study have now come out pretty strongly against Castro for his misuse of their report, and have explained in detail how Castro’s assumptions are wrong and his quoting their study is done entirely out of context.

we disagree with the way that Mr. Castro applies our findings to the SOPA debate. His presumption that people will work as hard or harder to access political content than they do to access entertainment content deeply misunderstands how and why most people use the internet. Far more users in open societies use the Internet for entertainment than for political purposes; it is unreasonable to assume different behaviors in closed societies. Our research offers the depressing conclusion that comparatively few users are seeking blocked political information and suggests that the governments most successful in blocking political content ensure that entertainment and social media content is widely available online precisely because users get much more upset about blocking the ability watch movies than they do about blocking specific pieces of political content.

Rather than comparing usage of circumvention tools in closed societies to predict the activities of a given userbase, Mr. Castro would do better to consider the massive userbase of tools like bit torrent clients, which would make for a far cleaner analogy to the problem at hand. Likewise, the long line of very popular peer-to-peer sharing tools that have been incrementally designed to circumvent the technical and political measures used to prevent sharing copyrighted materials are a stronger analogy than our study of users in authoritarian regimes seeking to access political content.

Furthermore, they argue that the bill that Castro is so desperately in favor of would have disastrous consequences, in that it would deny important circumvention tools to those in repressive countries:

Second, our research has consistently shown that those who really wish to evade Internet filters can do so with relatively little effort. The problem is that these activities can be very dangerous in certain regimes. Even though our research shows that relatively few people in autocratic countries use circumvention tools, this does not mean that circumvention tools are not crucial to the dissident communities in those countries. 19 million people is not large in relation to the population of the Internet, but it is still a lot of people absolutely who have freer access to the Internet through the tools. We personally know many people in autocratic countries for whom these tools provide a crucial (though not perfect) layer of security for their activist work. Those people would be at much greater risk than they already are without access to the tools, but in addition to mandating DNS filtering, SOPA would make many circumvention tools illegal. The single biggest funder of circumvention tools has been and remains the U.S. government, precisely because of the role the tools play in online activism. It would be highly counter-productive for the U.S. government to both fund and outlaw the same set of tools.

We noted that Castro’s paper read like a joke from the beginning, and the more people dig into it, the more ridiculous it seems.

Filed Under: daniel castro, dns, dns blocking, dnssec, jillian york, john palfrey, pipa, protect ip, sopa