News for hackers. Stuff that matters.

A comment on Universal DNSSEC: Secure DNS for Every Domain. Parent comment

Re:Universal DNSSEC: Secure DNS for Every Domain by _jomo on Tuesday November 10, 2015 @10:24AM (#10539829)
AFAIK DNSCrypt (as the name suggests) encrypts transfer of DNS data between client & server whereas DNSSEC authenticates (to some level) the validity of DNS data, but does not encrypt it.

How do both compare ("far better")?

[ Parent | on HN ]
Re:Universal DNSSEC: Secure DNS for Every Domain by akerro on Tuesday November 10, 2015 @11:28AM (#10540253)
DNSCrypt is to secure your connection client-server and server-client.

DNSSEC is for server-server, to propagate existing addressbook.

[ Parent | on HN ]
Re:Universal DNSSEC: Secure DNS for Every Domain by tptacek on Tuesday November 10, 2015 @11:32AM (#10540292)
That's not entirely true. DNSCrypt also aims for end-to-end security. The real difference is that DNSSEC is a top-down protocol that doesn't work until every link between your browser and the DNS roots agree, and DNSCrypt is a bottom-up protocol that provides value even if just a few people use it.
[ Parent | on HN ]
Re:Universal DNSSEC: Secure DNS for Every Domain by FullyFunctional on Tuesday November 10, 2015 @12:24PM (#10540705)
It's far from the only difference, but it worth calling out:

  Only DNSCrypt protects your privacy!
[ Parent | on HN ]