News for hackers. Stuff that matters.
Re:Universal DNSSEC: Secure DNS for Every Domain by jessaustin on Tuesday November 10, 2015 @03:02PM (#10542030)
Even if they were old-n-busted, your network must also use a DNS resolving server that supports DNSSEC. So even if your client has the right stub resolver, the network you connect to determines whether your client can make a secure connection or not.

Good point! I didn't know that. Perhaps that's what you're running into, since Android 5.0 seems to be working fine for me? For a long time we all just used whatever DNS server we got from DHCP, but I think the time for that has passed. At this point we should choose our own recursive DNS provider, and reconsider using networks that don't allow that.

Re:Universal DNSSEC: Secure DNS for Every Domain by peterwwillis on Tuesday November 10, 2015 @03:39PM (#10542299)
> At this point we should choose our own recursive DNS provider

Assuming you control your device (non-corporate non-government users) and know how to configure your DNS server (elite users only) and wanted to do this extra step (privacy-conscious people?), this will break for hotels, airports, cafes/restaurants, corporate/government networks, anyone with an ISP that intercepts public DNS requests, and various home routers. Not to mention making surfing the web much slower and less reliable, since we distribute name servers specifically to rely on caching to lower latency and increase availability in case of various network failures.

But otherwise, sure, that works.

Re:Universal DNSSEC: Secure DNS for Every Domain by jessaustin on Thursday November 12, 2015 @08:07AM (#10552840)
Assuming you control your device...

If this isn't the case, then I know that the device operates not in my interest, but in that of whoever controls it. So, I probably won't be entering any sensitive information into it.

Re:Universal DNSSEC: Secure DNS for Every Domain by peterwwillis on Thursday November 12, 2015 @10:16AM (#10553603)
Like your work e-mail?
Re:Universal DNSSEC: Secure DNS for Every Domain by jessaustin on Thursday November 12, 2015 @12:07PM (#10554426)
Email is rarely a good place for sensitive information. DNSSEC is not a panacea, but it does make Eve's job harder. https://insights.sei.cmu.edu/cert/2014/09/-probable-cache-po...