News for hackers. Stuff that matters.

A comment on Enhancing SSL Security for IRC: DANE Support.

Re:Enhancing SSL Security for IRC: DANE Support by gwu78 on Saturday September 14, 2013 @10:35PM (#6387933)
"... where the client relies on a trusted source (their ISP's DNS server..."

Well, for several major ISP's, maybe even most ISP's worldwide, you can't trust them not to use their DNS servers to show you ads or a sponsored "search engine" if you type a domain name that is not registered.

If a user really wanted a "trusted source" for DNS RR's she would be best to contact the appropriate authoritative nameserver directly, not an ISP's resolver.

[ Parent | on HN ]
Re:Enhancing SSL Security for IRC: DANE Support by ahf on Sunday September 15, 2013 @05:18AM (#6388546)
It's true that we still haven't secured the connection between the user and his ISP's DNS server, which I agree is a problem. DNSSEC only helps between the DNS servers themselves.

We are now down to either a) run your own DNS server locally on your machine or b) use a third-party DNS server that we trust.

Personally, I use Thomas' (the person mentioned in the article itself) free, uncensored, DNS service called CensurFriDNS. You can read more about it here: http://censurfridns.dk/

[ Parent | on HN ]