Re:Universal DNSSEC: Secure DNS for Every Domain
by tptacek on Tuesday November 10, 2015 @11:40AM
(#10540349)
No. DNSCrypt doesn't set out, on day one, to thwart NSA's ability to hijack DNS records. DNSCrypt's day-one job is to prevent coffee-shop attackers from MITMing your stub resolver, a job DNSSEC is actually incapable of doing.
DNSSEC solves no meaningful problems on day 1. DNSCrypt solves one meaningful problem on day 1. Long term, if DNSCrypt is deployed widely, it will grow to solve more of the NSA problem, as end-to-end chains of DNSCrypt-protected DNS links are deployed connecting clients to authority servers. But over the long term, DNSSEC's problems don't get any better at all.
DNSSEC solves no meaningful problems on day 1. DNSCrypt solves one meaningful problem on day 1. Long term, if DNSCrypt is deployed widely, it will grow to solve more of the NSA problem, as end-to-end chains of DNSCrypt-protected DNS links are deployed connecting clients to authority servers. But over the long term, DNSSEC's problems don't get any better at all.