{"id":34921,"date":"2019-10-31T22:01:17","date_gmt":"2019-10-31T19:01:17","guid":{"rendered":"https:\/\/prohoster.info\/blog\/est-mnenie-tehnologiya-dane-dlya-brauzerov-provalilas\/"},"modified":"2019-10-31T22:01:17","modified_gmt":"2019-10-31T19:01:17","slug":"est-mnenie-tehnologiya-dane-dlya-brauzerov-provalilas","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/est-mnenie-tehnologiya-dane-dlya-brauzerov-provalilas","title":{"rendered":"Exist\u0103 o opinie: tehnologia DANE pentru browsere a e\u0219uat","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Discut\u0103m despre ce reprezint\u0103 tehnologia DANE pentru autentificarea numelui de domeniu prin DNS \u0219i de ce nu a avut o r\u0103sp\u00e2ndire larg\u0103 \u00een browsere.<\/p>\n

\"Exist\u0103<\/a><\/noindex><\/a><\/noindex>
\n\/ Unsplash \/ Paulius Dragunas<\/a><\/noindex><\/i><\/p>\n

Ce este DANE<\/h2>\n

\nCentrele de certificare (CA) sunt organiza\u021bii care sunt implicate<\/a><\/noindex> certificatul criptografic certificatelor SSL<\/a><\/noindex>. Ele \u00ee\u0219i aplic\u0103 semn\u0103tura electronic\u0103, confirm\u00e2nd autenticitatea. Totu\u0219i, uneori apar situa\u021bii \u00een care certificatul este eliberat cu \u00eenc\u0103lc\u0103ri. De exemplu, anul trecut Google a initiat o \u201eprocedur\u0103 de \u00eencetare a \u00eencrederii\u201d fa\u021b\u0103 de certificatele Symantec din cauza compromiterii acestora (detalii despre aceast\u0103 poveste sunt prezentate pe blogul nostru \u2014 unu<\/a><\/noindex> \u0219i doi<\/a><\/noindex>).<\/p>\n

Pentru a evita astfel de situa\u021bii, acum c\u00e2\u021biva ani, IETF a \u00eenceput s\u0103 dezvolte<\/a><\/noindex> tehnologia DANE (dar nu a avut o r\u0103sp\u00e2ndire larg\u0103 \u00een browsere \u2014 despre asta vom discuta mai \u00eencolo).<\/p>\n

DANE (Autentificarea Entit\u0103\u021bilor Numele Baz\u0103 DNS) este un set de specifica\u021bii care permite utilizarea DNSSEC (Extensii pentru Securitatea Sistemului de Nume) pentru a controla validitatea certificatelor SSL. DNSSEC este o extensie pentru sistemul de nume de domeniu care minimizeaz\u0103 atacurile legate de substituirea adreselor. Folosind aceste dou\u0103 tehnologii, un webmaster sau un client poate contacta unul dintre operatorii de zone DNS pentru a confirma validitatea certificatului utilizat.<\/p>\n

\u00cen esen\u021b\u0103, DANE func\u021bioneaz\u0103 ca un certificat auto-semnat (garantul fiabilit\u0103\u021bii sale este DNSSEC) \u0219i completeaz\u0103 func\u021biile CA.<\/p>\n

Cum func\u021bioneaz\u0103<\/h2>\n

\nSpecifica\u021bia DANE este descris\u0103 \u00een RFC6698<\/a><\/noindex>. Conform documentului, \u00een \u00eenregistr\u0103rile resurselor DNS<\/a><\/noindex> a fost ad\u0103ugat un nou tip \u2014 TLSA. Acesta con\u021bine informa\u021bii despre certificatul transmis, dimensiunea \u0219i tipul datelor transmise, precum \u0219i datele propriu-zise. Webmasterul creeaz\u0103 o amprent\u0103 digital\u0103 a certificatului, \u00eei aplic\u0103 semn\u0103tura folosind DNSSEC \u0219i o plaseaz\u0103 \u00een TLSA.<\/p>\n

Clientul se conecteaz\u0103 la site-ul de internet \u0219i compar\u0103 certificatul s\u0103u cu \u201ecopie\u201d, ob\u021binut\u0103 de la operatorul DNS. Dac\u0103 acestea coincid, resursa este considerat\u0103 de \u00eencredere.<\/p><\/blockquote>\n

\nPe pagina wiki a DANE este prezentat urm\u0103torul exemplu de cerere DNS c\u0103tre serverul example.org prin portul TCP 443:<\/p>\n

IN TLSA _443._tcp.example.org<\/code><\/pre>\n
\nR\u0103spunsul la aceasta arat\u0103 astfel:<\/p>\n
 _443._tcp.example.com. IN TLSA (\n   3 0 0 30820307308201efa003020102020... )\n<\/code><\/pre>\n
\nDANE are c\u00e2teva extensii care lucreaz\u0103 cu alte \u00eenregistr\u0103ri DNS \u00een afar\u0103 de TLSA. Prima \u2014 \u00eenregistrarea DNS SSHFP pentru verificarea cheilor \u00een conexiuni SSH. Aceasta este descris\u0103 \u00een RFC4255<\/a><\/noindex>,\u00a0RFC6594<\/a><\/noindex>\u00a0\u0219i\u00a0RFC7479<\/a><\/noindex>. Al doilea \u2014 \u00eenregistrarea OPENPGPKEY pentru schimbul de chei folosind PGP (RFC7929<\/a><\/noindex>). \u00cen cele din urm\u0103, al treilea \u2014 \u00eenregistrarea SMIMEA (\u00een RFC standardul nu este formulat, exist\u0103 numai un draft al s\u0103u<\/a><\/noindex>) pentru schimbul criptografic de chei prin S\/MIME.<\/p>\n
Care este problema cu DANE<\/h2>\n
\nLa mijlocul lunii mai a avut loc conferin\u021ba DNS-OARC (aceasta este o organiza\u021bie non-profit care se ocup\u0103 cu problemele de securitate, stabilitate \u0219i dezvoltare a sistemului de nume de domeniu). La una dintre paneluri, exper\u021bii au ajuns la concluzia<\/a><\/noindex>, c\u0103 tehnologia DANE a e\u0219uat \u00een browsere (cel pu\u021bin \u00een varianta actual\u0103 de implementare). Particip\u00e2nd la conferin\u021b\u0103, Geoff Huston, cercet\u0103tor principal APNIC<\/a><\/noindex>, unul dintre cei cinci registratori de internet regionali, s-a exprimat<\/a><\/noindex> despre DANE ca fiind o \u00abtehnologie moart\u0103\u00bb.<\/p>\n
Browserele populare nu suport\u0103 autentificarea certificatelor prin DANE. Pe pia\u021b\u0103 exist\u0103 plugin-uri speciale<\/a><\/noindex>, care dezv\u0103luie func\u021bionalitatea \u00eenregistr\u0103rilor TLSA, \u00eens\u0103 \u0219i suportul acestora se reduce treptat<\/a><\/noindex>.<\/p><\/blockquote>\n
\nProblemele cu r\u0103sp\u00e2ndirea DANE \u00een browsere sunt legate de durata procesului de validare prin DNSSEC. Sistemul este obligat s\u0103 efectueze calcule criptografice pentru a confirma autenticitatea certificatului SSL \u0219i s\u0103 treac\u0103 prin \u00eentreaga ierarhie de servere DNS (de la zona r\u0103d\u0103cin\u0103 p\u00e2n\u0103 la domeniul gazdei) la prima conectare la resurs\u0103.<\/p>\n
\"Exist\u0103
\n\/ Unsplash \/ Kaley Dykstra<\/a><\/noindex><\/i><\/p>\n
Aceast\u0103 deficien\u021b\u0103 a fost \u00eencercat\u0103 s\u0103 fie remediat\u0103 \u00een Mozilla prin mecanismul DNSSEC Chain Extension<\/a><\/noindex> pentru TLS. Acesta ar fi trebuit s\u0103 reduc\u0103 num\u0103rul de \u00eenregistr\u0103ri DNS pe care clientul trebuia s\u0103 le consulte \u00een timpul autentific\u0103rii. Totu\u0219i, \u00een interiorul grupului de dezvoltare au ap\u0103rut ne\u00een\u021belegeri care nu au putut fi rezolvate. \u00cen cele din urm\u0103, proiectul a fost abandonat, de\u0219i a fost aprobat de IETF \u00een martie 2018.<\/p>\n
O alt\u0103 cauz\u0103 a popularit\u0103\u021bii sc\u0103zute a DANE se consider\u0103 a fi r\u0103sp\u00e2ndirea slab\u0103 a DNSSEC \u00een lume \u2014 numai 19% din resurse func\u021bioneaz\u0103 cu acesta<\/a><\/noindex>. Exper\u021bii au apreciat c\u0103 aceasta nu este suficient\u0103 pentru promovarea activ\u0103 a DANE.<\/p>\n
Cel mai probabil, industria se va dezvolta \u00een alte direc\u021bii. \u00cen loc s\u0103 foloseasc\u0103 DNS pentru a verifica certificatele SSL\/TLS, juc\u0103torii de pe pia\u021b\u0103, dimpotriv\u0103, vor promova protocoalele DNS-over-TLS (DoT) \u0219i DNS-over-HTTPS (DoH). Ultimul a fost men\u021bionat \u00eentr-unul dintre materialele noastre anterioare<\/a><\/noindex> pe Habr. Ace\u0219tia criptau \u0219i verificau solicit\u0103rile utilizatorilor c\u0103tre serverul DNS, \u00eempiedic\u00e2nd atacatorii s\u0103 \u00eenlocuiasc\u0103 datele. La \u00eenceputul anului, DoT deja integrarea cu Mastodon, ceea ce a determinat reac\u021bii mixte din partea utilizatorilor. Din fericire, a\u0219a cum este specificat \u00een software-ul liber, aceasta este op\u021bional\u0103 \u0219i se decide de c\u0103tre administratorul serverului.<\/a><\/noindex> \u00een Google pentru DNS-ul s\u0103u public. \u00cen ceea ce prive\u0219te DANE \u2014 dac\u0103 tehnologia va reu\u0219i s\u0103 \u201erevin\u0103 \u00een joc\u201d \u0219i s\u0103 devin\u0103 popular\u0103, r\u0103m\u00e2ne de v\u0103zut \u00een viitor.<\/p>\n
Ce mai avem pentru lecturi suplimentare:<\/b><\/p>\n
\"Exist\u0103 Cum s\u0103 automatiz\u0103m gestionarea infrastructurii IT \u2014 discut\u0103m despre trei tendin\u021be<\/a><\/noindex>
\n\"Exist\u0103 JMAP \u2014 protocolul deschis va \u00eenlocui IMAP \u00een schimbul mesajelor electronice<\/a><\/noindex><\/p>\n
\"Exist\u0103 Cum s\u0103 economise\u0219ti cu ajutorul unei interfe\u021be de programare a aplica\u021biilor<\/a><\/noindex>
\n\"Exist\u0103 DevOps \u00een serviciul de cloud pe exemplul 1cloud.ru<\/a><\/noindex>
\n\"Exist\u0103 Evolu\u021bia arhitecturii cloud 1cloud<\/a><\/noindex><\/p>\n
\"Exist\u0103 Cum func\u021bioneaz\u0103 suportul tehnic 1cloud<\/a><\/noindex>
\n\"Exist\u0103 Mituri despre tehnologiile cloud<\/a><\/noindex><\/p><\/blockquote>\n
Sursa: habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"
\u0413\u043e\u0432\u043e\u0440\u0438\u043c \u043e \u0442\u043e\u043c, \u0447\u0442\u043e \u0441\u043e\u0431\u043e\u0439 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u044f DANE \u0434\u043b\u044f \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0434\u043e\u043c\u0435\u043d\u043d\u044b\u0445 \u0438\u043c\u0435\u043d \u043f\u043e DNS \u0438 \u043f\u043e\u0447\u0435\u043c\u0443 \u043e\u043d\u0430 \u043d\u0435 \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0430 \u0448\u0438\u0440\u043e\u043a\u043e\u0433\u043e \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u0432 \u0431\u0440\u0430\u0443\u0437\u0435\u0440\u0430\u0445. \/ Unsplash \/ Paulius Dragunas \u0427\u0442\u043e \u0442\u0430\u043a\u043e\u0435 DANE \u0421\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0435 \u0446\u0435\u043d\u0442\u0440\u044b (CA) \u2014 \u044d\u0442\u043e \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0437\u0430\u043d\u0438\u043c\u0430\u044e\u0442\u0441\u044f \u0443\u0434\u043e\u0441\u0442\u043e\u0432\u0435\u0440\u0435\u043d\u0438\u0435\u043c \u043a\u0440\u0438\u043f\u0442\u043e\u0433\u0440\u0430\u0444\u0438\u0447\u0435\u0441\u043a\u0438\u0445 SSL-\u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0432. \u041e\u043d\u0438 \u0441\u0442\u0430\u0432\u044f\u0442 \u043d\u0430 \u043d\u0438\u0445 \u0441\u0432\u043e\u044e \u044d\u043b\u0435\u043a\u0442\u0440\u043e\u043d\u043d\u0443\u044e \u043f\u043e\u0434\u043f\u0438\u0441\u044c, \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0430\u044f \u043f\u043e\u0434\u043b\u0438\u043d\u043d\u043e\u0441\u0442\u044c. \u041e\u0434\u043d\u0430\u043a\u043e \u043f\u043e\u0440\u043e\u0439 \u0432\u043e\u0437\u043d\u0438\u043a\u0430\u044e\u0442 \u0441\u0438\u0442\u0443\u0430\u0446\u0438\u0438, […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":26289,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-34921","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Exist\u0103 p\u0103reri: tehnologia DANE pentru browsere a e\u0219uat | ProHoster","description":"Discut\u0103m despre ce reprezint\u0103 tehnologia DANE pentru autentificarea numelui de domeniu prin DNS \u0219i de ce nu a avut o r\u0103sp\u00e2ndire larg\u0103 \u00een browsere.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/est-mnenie-tehnologiya-dane-dlya-brauzerov-provalilas","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0415\u0441\u0442\u044c \u043c\u043d\u0435\u043d\u0438\u0435: \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u044f DANE \u0434\u043b\u044f \u0431\u0440\u0430\u0443\u0437\u0435\u0440\u043e\u0432 \u043f\u0440\u043e\u0432\u0430\u043b\u0438\u043b\u0430\u0441\u044c | ProHoster","og:description":"\u0413\u043e\u0432\u043e\u0440\u0438\u043c \u043e \u0442\u043e\u043c, \u0447\u0442\u043e \u0441\u043e\u0431\u043e\u0439 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u044f DANE \u0434\u043b\u044f \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0434\u043e\u043c\u0435\u043d\u043d\u044b\u0445 \u0438\u043c\u0435\u043d \u043f\u043e DNS \u0438 \u043f\u043e\u0447\u0435\u043c\u0443 \u043e\u043d\u0430 \u043d\u0435 \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0430 \u0448\u0438\u0440\u043e\u043a\u043e\u0433\u043e \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u0432 \u0431\u0440\u0430\u0443\u0437\u0435\u0440\u0430\u0445.","og:url":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/est-mnenie-tehnologiya-dane-dlya-brauzerov-provalilas","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:01:17+00:00","article:modified_time":"2019-10-31T19:01:17+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"34921","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-21 21:07:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 02:12:28","updated":"2026-01-21 21:07:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/34921","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=34921"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/34921\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media\/26289"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=34921"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=34921"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=34921"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}