DNS brought trust to the internet by enabling the mapping of human typable/readable/friendly domain names to IP addresses. But in this model, there are a lot of trust assumptions that we make in typing in a domain name into a browser:
- Correct Mapping: We trust that the Domain Name System (DNS) correctly maps the domain name to the correct IP address. This means that when we type in a domain name, we trust that we are being directed to the correct server and not being redirected to a malicious site.
- Security of the DNS: We trust that the DNS itself is secure and has not been compromised. DNS hijacking, where an attacker redirects queries to a different domain, is a known threat. We assume that protections are in place to prevent this.
- Authenticity of the Website: We trust that the website we reach is the authentic one that it claims to be, and not a phishing site or a site created for malicious purposes.
- Privacy: We trust that our interactions with the website are private and not being monitored or intercepted by third parties.
- Data Integrity: We trust that the data we send and receive has not been tampered with during transmission.
- Secure Transactions: If we're conducting transactions, we trust that our financial and personal information is being securely handled and stored.
- Certificate Authorities: We trust that the Certificate Authorities (CAs) that issue SSL/TLS certificates to the website have properly validated the website's identity before issuing the certificate.
- Browser Security: We trust that our web browser correctly implements security protocols and will warn us if we're trying to visit a potentially dangerous site.
- Up-to-date Information: We trust that the information we're accessing is up-to-date and accurate.
Based on this list, to interact directly with a website, we as consumers place trust in intermediaries such as DNS server operators, CAs and browser developers.
While DNSSEC provides a model to create integrity on data transmitted between a user and a website ensuring the “pathway” has not been compromised and messages are relayed with integrity, it does not provide a model where the end point participants themselves are authentic, validated and are who they say they are.