I fought my ISP's bad behavior and won

Re:I fought my ISP's bad behavior and won by mike-cardwell on Wednesday January 01, 2014 @05:51PM (#6997155)

DNSCrypt is useless. Yeah, they can't see that you did a DNS A record lookup for www.example.com, but they can still see your subsequent TCP connection to the IP you received in your encrypted DNS response, and see the HTTP Host header that your browser sends. Even if it's a HTTPS connection, modern browsers leak the hostname then too, due to SNI.

Signing DNS responses has much more value than encrypting them.

If you set up DNSCrypt with OpenDNS, you're not improving the situation. You're just adding an additional third party that can see what you're doing.

[ Parent | on HN ]

Re:I fought my ISP's bad behavior and won by ars_technician on Thursday January 02, 2014 @02:34AM (#6998612)

Why do you keep posting this? It's irrelevant because the idea isn't to hide what site you're visiting, it's to prevent the ISP from modifying the DNS responses. Signing DNS responses would be helpful if that was actually enforced anywhere.

DNSCrypt is a perfectly fine solution for this threat model.

[ Parent | on HN ]

Re:I fought my ISP's bad behavior and won by mike-cardwell on Thursday January 02, 2014 @04:52AM (#6998906)

"Why do you keep posting this?"

I posted a similar comment twice in response to different people. There is nothing wrong with this.

The rest of your comment is irrelevant as it assumes I'm replying to the article rather than to the parent comment. The parent stated that he uses "DNSCrypt in all situations." I don't want people to think this is a good idea.

[ Parent | on HN ]