DNSCrypt – A protocol to improve DNS security
dnscrypt.org
DNSCrypt – A protocol to improve DNS security
1–10 of 77 posts
Re: DNSCrypt – A protocol to improve DNS security
#2For all the attention that https gets, I'm amazed how little (relatively speaking) attention plaintext dns gets.
If a site is https then even if an attacker is MITM-ing DNS to their own site they presumably won't have a valid cert for the site they're intercepting, although it has happened many times before, and 50% of the internet is still unencrypted. But even assuming that doesn't happen it's still a huge privacy/data leak.
Re: DNSCrypt – A protocol to improve DNS security
#3For all the attention that https gets, I'm amazed how little (relatively speaking) attention plaintext dns gets. If a site is https then even if an attacker is MITM-ing DNS to their own site they presumably won't have a valid cert for the site they're intercepting, although it has happened many times before, and 50% of the internet is still unencrypted. But even assuming that doesn't happen it's still a huge privacy/…
> If a site is https then even if an attacker is MITM-ing DNS to their own site they presumably won't have a valid cert for the site they're intercepting
Kinda. It still can add a CNAME there, and make you go into another site for what it has a valid cert.
Re: DNSCrypt – A protocol to improve DNS security
#4For all the attention that https gets, I'm amazed how little (relatively speaking) attention plaintext dns gets. If a site is https then even if an attacker is MITM-ing DNS to their own site they presumably won't have a valid cert for the site they're intercepting, although it has happened many times before, and 50% of the internet is still unencrypted. But even assuming that doesn't happen it's still a huge privacy/…
None of the commercial entities involved stand to gain from providing encrypted DNS lookups. It would just be one fewer bullet point in their personal-data sales packages.
Re: DNSCrypt – A protocol to improve DNS security
#5For all the attention that https gets, I'm amazed how little (relatively speaking) attention plaintext dns gets. If a site is https then even if an attacker is MITM-ing DNS to their own site they presumably won't have a valid cert for the site they're intercepting, although it has happened many times before, and 50% of the internet is still unencrypted. But even assuming that doesn't happen it's still a huge privacy/…
As far as I understand this doesn't encrypt communication but authenticates it to ensure it hasn't been tampered with. So it's still out in the open. I also don't understand what the benefit over DNSSEC is.
Edit: Nvm, DNSSEC still has to trust the validating resolver, DNSCrypt solves this.
Re: DNSCrypt – A protocol to improve DNS security
#6For all the attention that https gets, I'm amazed how little (relatively speaking) attention plaintext dns gets. If a site is https then even if an attacker is MITM-ing DNS to their own site they presumably won't have a valid cert for the site they're intercepting, although it has happened many times before, and 50% of the internet is still unencrypted. But even assuming that doesn't happen it's still a huge privacy/…
> But even assuming that doesn't happen it's still a huge privacy/data leak.
Meh, if an attacker can sniff your packets, they can already tell what IP addresses you're talking to, which certainly narrows down which domain names you're talking to.
I'm far more concerned with the possibility of intercepting or hijacking http traffic. Sure, an attacker could do this with any non-TLS connection in theory, but it's way way easier to hijack that one DNS response and change the A record.
Re: DNSCrypt – A protocol to improve DNS security
#7Oddly they never say that DNSCrypt encrypts your DNS traffic, just that it's cryptographically secure.
The OpenDNS page on DNSCrypt does state that traffic is encrypted.
Confusing...
Re: DNSCrypt – A protocol to improve DNS security
#8For all the attention that https gets, I'm amazed how little (relatively speaking) attention plaintext dns gets. If a site is https then even if an attacker is MITM-ing DNS to their own site they presumably won't have a valid cert for the site they're intercepting, although it has happened many times before, and 50% of the internet is still unencrypted. But even assuming that doesn't happen it's still a huge privacy/…
As far as I understand this doesn't encrypt communication but authenticates it to ensure it hasn't been tampered with. So it's still out in the open. I also don't understand what the benefit over DNSSEC is. Edit: Nvm, DNSSEC still has to trust the validating resolver, DNSCrypt solves this.
dnscrypt is an encrypted channel back to the DNS server. They can tell it's going to OpenDNS because of the IP address, but the cannot see the payload.
Re: DNSCrypt – A protocol to improve DNS security
#9For all the attention that https gets, I'm amazed how little (relatively speaking) attention plaintext dns gets. If a site is https then even if an attacker is MITM-ing DNS to their own site they presumably won't have a valid cert for the site they're intercepting, although it has happened many times before, and 50% of the internet is still unencrypted. But even assuming that doesn't happen it's still a huge privacy/…
> If a site is https then even if an attacker is MITM-ing DNS to their own site they presumably won't have a valid cert for the site they're intercepting Kinda. It still can add a CNAME there, and make you go into another site for what it has a valid cert.
A CNAME isn't a redirect; if you add a CNAME record from thing1.example.net pointing to thing2.example.com, the browser still uses the domain name thing1.example.net for certificates, and just does a DNS lookup on thing2.example.com.
Re: DNSCrypt – A protocol to improve DNS security
#10Earlier quoted context omitted.
As far as I understand this doesn't encrypt communication but authenticates it to ensure it hasn't been tampered with. So it's still out in the open. I also don't understand what the benefit over DNSSEC is. Edit: Nvm, DNSSEC still has to trust the validating resolver, DNSCrypt solves this.
dnscrypt is an encrypted channel back to the DNS server. They can tell it's going to OpenDNS because of the IP address, but the cannot see the payload.
Good to know, couldn't find that on their website.