Universal DNSSEC: Secure DNS for Every Domain

Re:Universal DNSSEC: Secure DNS for Every Domain by dfox on Tuesday November 10, 2015 @10:27AM (#10539860)

Problem with DNSCrypt is that it also does not solve meaningful problem. Governments can subvert DNSCrypt in exactly same way as they can subvert DNSSEC. Additionally, DNSCrypt offers no way to verify that the returned RRs realy come from authoritative server and weren't modified (by another DNS server) in transit.

One additional feature that DNSCrypt has over DNSSEC is that it encrypts queries and responses and thus has some privacy value, on the other hand there probably is nothing privacy-sensitive in DNS queries and responses that will not get leaked by IP addresses and SNI anyway.

[ Parent | on HN ]

Re:Universal DNSSEC: Secure DNS for Every Domain by tptacek on Tuesday November 10, 2015 @11:40AM (#10540349)

No. DNSCrypt doesn't set out, on day one, to thwart NSA's ability to hijack DNS records. DNSCrypt's day-one job is to prevent coffee-shop attackers from MITMing your stub resolver, a job DNSSEC is actually incapable of doing.

DNSSEC solves no meaningful problems on day 1. DNSCrypt solves one meaningful problem on day 1. Long term, if DNSCrypt is deployed widely, it will grow to solve more of the NSA problem, as end-to-end chains of DNSCrypt-protected DNS links are deployed connecting clients to authority servers. But over the long term, DNSSEC's problems don't get any better at all.

[ Parent | on HN ]

Re:Universal DNSSEC: Secure DNS for Every Domain by FullyFunctional on Tuesday November 10, 2015 @12:28PM (#10540737)

"there probably is nothing privacy-sensitive in DNS queries"

Actually, there's a lot. You can learn a tremendous amount from just looking at the NS traffic.

[ Parent | on HN ]

Re:Universal DNSSEC: Secure DNS for Every Domain by sarciszewski on Tuesday November 10, 2015 @10:33AM (#10539894)

I'm suggesting CloudFlare support DNSCrypt of their DNSSEC-signed responses to protect end user privacy.

[ Parent | on HN ]