News for hackers. Stuff that matters.

A comment on DNSCrypt – A protocol to improve DNS security. Parent comment

Re:DNSCrypt – A protocol to improve DNS security by openasocket on Wednesday March 29, 2017 @09:45PM (#13992239)
> But even assuming that doesn't happen it's still a huge privacy/data leak.

Meh, if an attacker can sniff your packets, they can already tell what IP addresses you're talking to, which certainly narrows down which domain names you're talking to.

I'm far more concerned with the possibility of intercepting or hijacking http traffic. Sure, an attacker could do this with any non-TLS connection in theory, but it's way way easier to hijack that one DNS response and change the A record.

[ Parent | on HN ]
Re:DNSCrypt – A protocol to improve DNS security by ymhuang0808 on Wednesday March 29, 2017 @10:45PM (#13992475)
Your viewpoint is like the post "DNSCrypt – Not Fundamental Enough" (2011) from TrendMicro.

http://blog.trendmicro.com/trendlabs-security-intelligence/d...

[ Parent | on HN ]
Re:DNSCrypt – A protocol to improve DNS security by wslh on Wednesday March 29, 2017 @10:08PM (#13992317)
The IP address does not always tell you to which site you are connecting to. Many different sites can point to the same IP, more when services like Cloudflare are being used.
[ Parent | on HN ]
Re:DNSCrypt – A protocol to improve DNS security by 0xxon on Wednesday March 29, 2017 @10:22PM (#13992367)
Most clients nowadays sent the "server name indication" (SNI) TLS extension though, which contains the name of the site you are connecting to.

The extension is sent unencrypted, even when using TLS 1.3. So everyone sniffing the traffic can tell where you are surfing to, even without DNS.

[ Parent | on HN ]
Re:DNSCrypt – A protocol to improve DNS security by tedunangst on Wednesday March 29, 2017 @11:47PM (#13992704)
I don't think many people know this, or at least never think about it. "https means encrypted, that means secret."
[ Parent | on HN ]
Re:DNSCrypt – A protocol to improve DNS security by MertsA on Thursday March 30, 2017 @02:03AM (#13993277)
And in order to support clients that don't support SNI, you need to have one domain per IP address so an attacker can just try and connect to that IP and then look at the SSL cert that's sent back to get the domain name.
[ Parent | on HN ]
Re:DNSCrypt – A protocol to improve DNS security by pixl97 on Thursday March 30, 2017 @10:51AM (#13995848)
>And in order to support clients that don't support SNI

There is little reason to support clients that do not support SNI. By supporting those clients you are likely putting your entire encrypted infrastructure at risk. SSL3 should be disabled by now. XP clients are legacy and should be taken out back and shot. Older mobile phones are enormous security risks.

[ Parent | on HN ]
Re:DNSCrypt – A protocol to improve DNS security by nspassov on Thursday March 30, 2017 @06:36AM (#13994251)
With increasing IPv6 adoption this would be less and less true.
[ Parent | on HN ]
Re:DNSCrypt – A protocol to improve DNS security by ac29 on Wednesday March 29, 2017 @11:59PM (#13992764)
>Meh, if an attacker can sniff your packets, they can already tell what IP addresses you're talking to, which certainly narrows down which domain names you're talking to.

Honest question: with an increasing amount of sites being hosted via cloud infrastructure, does an IP really let you know if you are talking to Amazon, Google, or Microsoft vs the multitude of sites hosted by AWS, GCP, or Azure?

I'm assuming they use their own infrastructure, but I could be wrong.

[ Parent | on HN ]
Re:DNSCrypt – A protocol to improve DNS security by Buge on Thursday March 30, 2017 @01:43AM (#13993217)
IPs don't matter. SNI tells eavesdroppers the exact domain you are talking to.
[ Parent | on HN ]
Re:DNSCrypt – A protocol to improve DNS security by Tepix on Thursday March 30, 2017 @05:06AM (#13993905)
Hopefully we will get Encrypted SNI with TLS 1.3

https://www.ietf.org/proceedings/94/slides/slides-94-tls-8.p...

[ Parent | on HN ]
Re:DNSCrypt – A protocol to improve DNS security by minitech on Thursday March 30, 2017 @12:42AM (#13992962)
Yes, VPS services will still assign your instance an IP address of its own.
[ Parent | on HN ]