That was very enlightening, thank you for your help.
I can see it won't improve my trust on the OCSP responses or CRLs, but would it not be desirable to encrypt as much traffic (i.e. DNS queries) as I can in an effort to prohibit a potential attacker from employing traffic analysis techniques with the goal to learn something? This hypothetical scenario doesn't seem so farfetched to me.
Eventually, my encrypted DNS query will be forwarded to a DNS resolver that doesn't employ encryption and it will be in the clear, but how would the attacker know where to look next? If the original DNS query is encrypted, an attacker sniffing the network will not be able to know which DNS resolver the query was forwarded to, right? If so then he can't follow up on that and I've successfully disabled it from learning what the DNS query was about.
In short, I am not trying to increase my trust in the exchanges, but rather hide them as much as possible for the sake of obscurity. Is this reasonable?
I will make sure that's the case. What I didn't explain yet is that I am doing this for a university project and I am fishing for extra points. So I was trying to justify running my own DNS server. Is it reasonable?
> I don't think there's much more you can really do (as the DNS queries/responses will travel over the Internet "in the clear" -- and, thus, subject to tampering/modification).
I really should have done more research on this, but I imagined I could encrypt the DNS queries themselves and forward them to a public recursive DNS server. Could I not use DNSCRYPT or DNS-over-TLS for this purpose?
> Also, an attacker could block your HTTP requests (for CRL downloads/OCSP queries). How does your application react when it doesn't get a response? "Fail open" or "fail closed"?
Assuming the server has at least downloaded an initial CRL, I could always fallback to that. I haven't played much with this yet, but I think that's the big advantage of a CRL versus an OCSP query, no?
I guess I should "fail closed" to cover all holes but then I'm basically letting the attacker DoS the server. What is best?
I am working on a system with a typical client-server architecture. In this scenario the server has to validate a client's certificate, including checking if it has been revoked. To do this the server has to send an HTTP request to download CRLs or make an OCSP query. Naturally, it has to resolve the domain via DNS.I want to secure the DNS resolution process. Intuitively I think I should not be...
I am researching indicators of a software's popularity and good qualities. How do you determine that some piece of software is good and popular?Think in terms of how you might decide which framework you should use for a long-term project. I don't want to bias you too much, but here are some examples (which may not always be applicable). Feel free to go a bit outside the box.- great...
This PR will reduce the size down to 18KB.
I'm getting into machine learning and neural networks but I don't have a powerful computer with a GPU.What are the cheapest options to train neural networks?
I'm working on a bash script and I want to make available a simple one-liner that automatically downloads and runs the install script. I've seen many variations of this one-liner. For example oh-my-zsh usessh -c "$(curl -fsSL https://raw.githubusercontent.com/robbyrussell/oh-my-zsh/master/tools/install.sh)"What's the best way to do it? Or the most simple/pure? Is there maybe a blog post...
It really annoys me that I have to maintain an account per each Slack community. Honestly it has actually put me off from using Slack. It's too much work. And the increased internet footprint bothers me, I'd like to be able to instantly vanish from all Slack communities in one click.Single sign in seems like a no brainer to me. Why do they insist on new accounts?
Privacy Badger
The Great Suspender
No History
HTTPS Everywhere
Refined Wikipedia
What are some good strategies for an AI that plays a 1vs1 game of Snake?
What's a good reference for marking up a website with good semantics and all the neat new HTML5 tags?
I only need my .bashrc and .vimrc with me on a UNIX machine to get around. It makes me feel all warm and fuzzy inside because it's so minimal and portable. I love it.But I have not mastered vim yet. In particular, going back and forth between files and directories is really cumbersome in larger, more complex projects. When time is critical in a project I just install Atom or something with a...