This can't be repeated often enough:
If you have some ssh server somewhere (who hasn't), you can very easily create a 'VPN over ssh' by calling:
sshuttle -r user@remote_host 0.0.0.0/0 --dns
It works nicely together with dnscrypt
DNSCrypt – A protocol to improve DNS security
31–40 of 77 posts
Re: DNSCrypt – A protocol to improve DNS security
#32I prefer http://curvedns.on2it.net This was the original. Other than having to modify their ksh script, it is painless to set up. In my opinion, authoritative nameservers, and therefore DNSCurve forwarders like CurveDNS, are more important than recursive resolvers/caches such as OpenDNS and DNSCrypt. A recursive resolver should be authoritative for nothing. They are middlemen. Companies that offered this "service", s…
So much to respond to here. I am one of those companies running a recursive DNS service, DNSFilter.com We are not advertising driven. OpenDNS cut the ads a few years ago. We do not run open resolvers, we just have paying customers who wish to use our service. The DNS extensions you are referring to are the EDNS0 Client Subnet extension. It is in wide use by authoritative servers for major CDNs and is supported by a n…
Hi there, I work in advertising, and I absolutely use the EDNS0 data to track users. I'm okay with a 1:250ish potential error rate since outside of facebook and google, you probably don't go to the same websites as your neighbour.
Thanks for your hard work.
Re: DNSCrypt – A protocol to improve DNS security
#33The default port of 443 is somewhat bizarre, it's almost guaranteed to conflict on a server. They could have applied to IETF / IANA for port 253 (it currently reserved / unassigned).
As long as you can set it on both ends it doesn't really matter. It's actually better for clients that the servers listen on 443.
If it conflicts then that means you're putting multiple services on your server. Don't.
Personally I've put dnscrypt on my regular dns servers, they only listen on 53.
Re: DNSCrypt – A protocol to improve DNS security
#34Just pointing out, there's now a standardized way to do encrypted DNS via TLS: https://tools.ietf.org/html/rfc7858 Probably more likely that that one will succeed. DNScrypt has been around for a long time and hasn't really seen any significant adoption.
Why are you being downvoted?
https://kb.isc.org/article/AA-01386/30/DNS-over-TLS.html
This article shows how to set it up according to ISC with stunnel.
I was hoping for a native implementation in Bind but maybe it's coming.
Re: DNSCrypt – A protocol to improve DNS security
#35This looks like a great option to validate the seed IP's used to connect to the bitcoin p2p network have not been tampered with. As would be possible with a plain text DNS lookup.
Re: DNSCrypt – A protocol to improve DNS security
#36I prefer http://curvedns.on2it.net This was the original. Other than having to modify their ksh script, it is painless to set up. In my opinion, authoritative nameservers, and therefore DNSCurve forwarders like CurveDNS, are more important than recursive resolvers/caches such as OpenDNS and DNSCrypt. A recursive resolver should be authoritative for nothing. They are middlemen. Companies that offered this "service", s…
I am skeptical to its architecture. This is 2017 and there are compelling reasons for endpoints to do resolving on their own. To get rid of open resolvers would be nice.
"But .. caching", well, the performance of resolvers is perhaps not as clear cut as that. Performance would suffer for some, but they can clearly handle it, and does it really matter?
Some real world testing would surely be beneficial. In the mean time, I'm not sure about solutions to the resolver data leak problem. It is a solution to a problem we should not have.
Re: DNSCrypt – A protocol to improve DNS security
#37Earlier quoted context omitted.
>Meh, if an attacker can sniff your packets, they can already tell what IP addresses you're talking to, which certainly narrows down which domain names you're talking to. Honest question: with an increasing amount of sites being hosted via cloud infrastructure, does an IP really let you know if you are talking to Amazon, Google, or Microsoft vs the multitude of sites hosted by AWS, GCP, or Azure? I'm assuming they us…
IPs don't matter. SNI tells eavesdroppers the exact domain you are talking to.
Hopefully we will get Encrypted SNI with TLS 1.3
https://www.ietf.org/proceedings/94/slides/slides-94-tls-8.p...
Re: DNSCrypt – A protocol to improve DNS security
#38Just pointing out, there's now a standardized way to do encrypted DNS via TLS: https://tools.ietf.org/html/rfc7858 Probably more likely that that one will succeed. DNScrypt has been around for a long time and hasn't really seen any significant adoption.
Why are you being downvoted? https://kb.isc.org/article/AA-01386/30/DNS-over-TLS.html This article shows how to set it up according to ISC with stunnel. I was hoping for a native implementation in Bind but maybe it's coming.
Bind is still a mess after all these years. It seems to me like I get an update every other week that fixes a trivial DoS that hits an unchecked assertion.
bind is a software that is only 80% finished. The missing 20% that take 80% of the time will only be implemented via CVEs.
Re: DNSCrypt – A protocol to improve DNS security
#39This can't be repeated often enough: If you have some ssh server somewhere (who hasn't), you can very easily create a 'VPN over ssh' by calling: sshuttle -r user@remote_host 0.0.0.0/0 --dns It works nicely together with dnscrypt
This only moves the problem slightly. You then have to trust the network surrounding your SSH box.
Re: DNSCrypt – A protocol to improve DNS security
#40Earlier quoted context omitted.
Why are you being downvoted? https://kb.isc.org/article/AA-01386/30/DNS-over-TLS.html This article shows how to set it up according to ISC with stunnel. I was hoping for a native implementation in Bind but maybe it's coming.
Bind is still a mess after all these years. It seems to me like I get an update every other week that fixes a trivial DoS that hits an unchecked assertion. bind is a software that is only 80% finished. The missing 20% that take 80% of the time will only be implemented via CVEs.
What's a good alternative open source DNS that supports views and DDNS updates?