Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

DNSCrypt – A protocol to improve DNS security

dnscrypt.org

Post reply on HN
Print view View original

21–30 of 77 posts

Re: DNSCrypt – A protocol to improve DNS security

#21

Post by gwu78 »

I prefer http://curvedns.on2it.net

This was the original.

Other than having to modify their ksh script, it is painless to set up.

In my opinion, authoritative nameservers, and therefore DNSCurve forwarders like CurveDNS, are more important than recursive resolvers/caches such as OpenDNS and DNSCrypt.

A recursive resolver should be authoritative for nothing. They are middlemen. Companies that offered this "service", such as OpenDNS, had to pander to advertisers, or were run by advertising companies themselves, e.g., Google.

The "rules" of DNS are easily broken. This applies to caches. One does not need to look very far to find resolvers that someone has designated as "authoritative". dnsq: "weird ra". This often means an open resolver IME.

A while back some companies including the ones named above if I am not mistaken were pushing for extensions in DNS to put at least part of user IP addresses into DNS packets so cache operators could track them. The reason? Advertising. (Although maybe they would cite other reasons.) Not sure what ever happened with that. BIND had started to implement it. Thankfully djbdns will never support this garbage.

This kind of nonsense is why I cannot get excited about the latest extensions to internet protocols anymore.

Too often they are for the benefit of web companies and advertisers, not users.

The "encrypted DNS revolution", if it ever comes, is not going to be initiated by companies running recursive resolvers. (Unless they also run authoritative nameservers.)

Note: When the user runs their own cache on localhost there is no need to determine nearest POP.

Re: DNSCrypt – A protocol to improve DNS security

#22

Post by papaf »

gwu78 wrote: post #21

I prefer http://curvedns.on2it.net This was the original. Other than having to modify their ksh script, it is painless to set up. In my opinion, authoritative nameservers, and therefore DNSCurve forwarders like CurveDNS, are more important than recursive resolvers/caches such as OpenDNS and DNSCrypt. A recursive resolver should be authoritative for nothing. They are middlemen. Companies that offered this "service", s…

It quite easy to setup DNSCrypt with OpenNIC[1] and then a lot of the downsides that you mention go away.

Here is some background and setup instructions:

https://markbrown778.wordpress.com/2014/08/08/dns-privacy-us...

[1] https://www.opennicproject.org/

Re: DNSCrypt – A protocol to improve DNS security

#23

Post by sanehatter »

snowpanda wrote: post #17

When you use a VPN (OpenVPN) is there still a way to use DNSCrypt? My VPN provider seems to force their own DNS. Tried OpenVPN config manual pages to no help.

Manually updating you network settings after connecting will do the trick.

Use --script-security and --up if you'd like to script the DNS update and have it run everytime after you connect

Re: DNSCrypt – A protocol to improve DNS security

#24

Post by Buge »

ac29 wrote: post #19
openasocket wrote: post #6

Earlier quoted context omitted.

> But even assuming that doesn't happen it's still a huge privacy/data leak. Meh, if an attacker can sniff your packets, they can already tell what IP addresses you're talking to, which certainly narrows down which domain names you're talking to. I'm far more concerned with the possibility of intercepting or hijacking http traffic. Sure, an attacker could do this with any non-TLS connection in theory, but it's way wa…

>Meh, if an attacker can sniff your packets, they can already tell what IP addresses you're talking to, which certainly narrows down which domain names you're talking to. Honest question: with an increasing amount of sites being hosted via cloud infrastructure, does an IP really let you know if you are talking to Amazon, Google, or Microsoft vs the multitude of sites hosted by AWS, GCP, or Azure? I'm assuming they us…

IPs don't matter. SNI tells eavesdroppers the exact domain you are talking to.

Re: DNSCrypt – A protocol to improve DNS security

#25

Post by MertsA »

0xxon wrote: post #12
wslh wrote: post #11

Earlier quoted context omitted.

The IP address does not always tell you to which site you are connecting to. Many different sites can point to the same IP, more when services like Cloudflare are being used.

Most clients nowadays sent the "server name indication" (SNI) TLS extension though, which contains the name of the site you are connecting to. The extension is sent unencrypted, even when using TLS 1.3. So everyone sniffing the traffic can tell where you are surfing to, even without DNS.

And in order to support clients that don't support SNI, you need to have one domain per IP address so an attacker can just try and connect to that IP and then look at the SSL cert that's sent back to get the domain name.

Re: DNSCrypt – A protocol to improve DNS security

#26

Post by bluejekyll »

fukusa wrote: post #5
arkadiyt wrote: post #2

For all the attention that https gets, I'm amazed how little (relatively speaking) attention plaintext dns gets. If a site is https then even if an attacker is MITM-ing DNS to their own site they presumably won't have a valid cert for the site they're intercepting, although it has happened many times before, and 50% of the internet is still unencrypted. But even assuming that doesn't happen it's still a huge privacy/…

As far as I understand this doesn't encrypt communication but authenticates it to ensure it hasn't been tampered with. So it's still out in the open. I also don't understand what the benefit over DNSSEC is. Edit: Nvm, DNSSEC still has to trust the validating resolver, DNSCrypt solves this.

An easy way to think about this stuff is:

  DNSSec => Authenticity of resource records
  DNSCrypt, DNSoverTLS => Privacy of the connection

Re: DNSCrypt – A protocol to improve DNS security

#27

Post by MertsA »

gwu78 wrote: post #21

I prefer http://curvedns.on2it.net This was the original. Other than having to modify their ksh script, it is painless to set up. In my opinion, authoritative nameservers, and therefore DNSCurve forwarders like CurveDNS, are more important than recursive resolvers/caches such as OpenDNS and DNSCrypt. A recursive resolver should be authoritative for nothing. They are middlemen. Companies that offered this "service", s…

>The reason? Advertising.

Or the ability to accurately direct users to the nearest POP.

Re: DNSCrypt – A protocol to improve DNS security

#28

Post by LogicX »

gwu78 wrote: post #21

I prefer http://curvedns.on2it.net This was the original. Other than having to modify their ksh script, it is painless to set up. In my opinion, authoritative nameservers, and therefore DNSCurve forwarders like CurveDNS, are more important than recursive resolvers/caches such as OpenDNS and DNSCrypt. A recursive resolver should be authoritative for nothing. They are middlemen. Companies that offered this "service", s…

So much to respond to here.

I am one of those companies running a recursive DNS service, DNSFilter.com

We are not advertising driven. OpenDNS cut the ads a few years ago.

We do not run open resolvers, we just have paying customers who wish to use our service.

The DNS extensions you are referring to are the EDNS0 Client Subnet extension. It is in wide use by authoritative servers for major CDNs and is supported by a number of recursive DNS providers. See the spec here: https://tools.ietf.org/html/draft-ietf-dnsop-edns-client-sub... Section 11 addresses your concerns about IP addresses being shared: It is encouraged to provide only as much granularity as is necessary based on network architecture. At no time is there a reason to share the last octect of an address (since Internet BGP routing is limited to a /24)

We do not run an authoritative DNS service, yet are working to improve encrypted communications... in coordination with industry authoritative partners. Very early stages, but we are driven to protect our customers and the Internet at large. Every time I hear someone misunderstanding what DNSSEC is, and why they think they want it, I'm encouraged to work on solutions such as dnscrypt or DNS over TLS: https://tools.ietf.org/html/rfc7858

Post reply on HN