Re:Duck DNS – About
by ignoramous on Friday October 28, 2022 @04:49AM
(#33369112)
> They don’t get traffic going through them.
A rouge DNS can reply to select queries with the IP of a middleware that can TLS proxy and/or MitM that traffic.
We built such a thing mostly for anti-censorship purposes (bypass IP blocks): https://github.com/celzero/midway#demo
I use duckdns and the only service I'm accessing through that CNAME is ssh, which checks host keys, so it doesn't have to be a problem.
Re:Duck DNS – About
by drexlspivey on Friday October 28, 2022 @10:49AM
(#33372031)
wouldn’t that invalidate the cerificate?
They don’t get traffic going through them. They mainly exist to point to an IP. With enough data they have information on how an ISP rotates IP’s and who they’ve gone to.
In your case, with a WireGuard VPS, all traffic goes through the server. That’s a very different setup.
In their case, a request goes to them at a regular interval and they update the IP the dns record points to. That’s it.
When someone requests the domain, they simply respond with an IP. At most, if there’s little caching, they could get frequency of usage.