Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

DNSCrypt: A tool for securing communications between a client and a DNS resolver

dnscrypt.org

Post reply on HN
Print view View original

11–20 of 31 posts

Re: DNSCrypt: A tool for securing communications between a client and a DNS resolver

#11

Post by dsl »

blibble wrote: post #10
dsl wrote: post #9

Earlier quoted context omitted.

OpenDNS has open sourced technology that allows you to secure DNS against eavesdropping, something no other technology will let you do at the DNS level (DNSSEC only does security, not privacy). They are also a major backer of DNSCrypt which provides transport security between recursive and authoritative servers. Without OpenDNS'es work, your cute little caching DNS server at home is still subject to the same intercep…

let's be honest here: they've released this in an attempt to stop/muddle DNSSEC adoption, as DNSSEC represents an existential threat to their business: messing with the answers to DNS requests

Thats just overly cynical. https://yourlogicalfallacyis.com/genetic

DNSSEC is only signatures for DNS. It provides no secrecy of queries or responses. In light of the current PRISM disaster, DNSSEC does nothing to protect you.

I'll copy a snippet from OpenDNS' original announcement [1] here: Our support for DNSCurve doesn’t prevent our adoption of DNSSEC — they are not mutually exclusive. While we have reservations about DNSSEC, we can and will implement it when we see more demand and traction, but in the meantime, when we see a viable technology that can be quickly implemented to improve security for DNS users, that’s a no-brainer in our book.

1. http://blog.opendns.com/2010/02/23/opendns-dnscurve/

Re: DNSCrypt: A tool for securing communications between a client and a DNS resolver

#12

Post by dfc »

dsl wrote: post #11
blibble wrote: post #10

Earlier quoted context omitted.

let's be honest here: they've released this in an attempt to stop/muddle DNSSEC adoption, as DNSSEC represents an existential threat to their business: messing with the answers to DNS requests

Thats just overly cynical. https://yourlogicalfallacyis.com/genetic DNSSEC is only signatures for DNS. It provides no secrecy of queries or responses. In light of the current PRISM disaster, DNSSEC does nothing to protect you. I'll copy a snippet from OpenDNS' original announcement [1] here: Our support for DNSCurve doesn’t prevent our adoption of DNSSEC — they are not mutually exclusive. While we have reservations a…

In light of the current PRISM disaster, DNSSEC does nothing to protect you.

Let's say Nation State A has all the data that prism has collected and Nation State B has the same exact dataset minus DNS traffic. Do you really think there is a lot that A can do that B can not?

EDIT: Changed hypothetical actors from me/you to state a/ state b. It made it seem personal and its not i was just being lazy.

Re: DNSCrypt: A tool for securing communications between a client and a DNS resolver

#13

Post by tptacek »

bcl wrote: post #6

This isn't any better than using Google's DNS, your ISP's or OpenDNS directly. All your requests eventually go through a central location where they can be logged. Better to install your own caching dns server so they at least can't do traffic analysis on your repeat requests.

If you install your own cache server, not only can all of your DNS request be logged off the wire, but you're vulnerable to DNS spoofing attacks. Those attacks are probably impractical today, but might not remain so.

I think securing the DNS is a poor approach in general, and we should instead concentrate on making an insecure DNS a chronic inconvenience rather than a fatal flaw. But if you're going to try to secure the DNS, the DNSCurve hop-by-hop approach is superior to DNSSEC's approach.

Re: DNSCrypt: A tool for securing communications between a client and a DNS resolver

#14

Post by tptacek »

blibble wrote: post #10
dsl wrote: post #9

Earlier quoted context omitted.

OpenDNS has open sourced technology that allows you to secure DNS against eavesdropping, something no other technology will let you do at the DNS level (DNSSEC only does security, not privacy). They are also a major backer of DNSCrypt which provides transport security between recursive and authoritative servers. Without OpenDNS'es work, your cute little caching DNS server at home is still subject to the same intercep…

let's be honest here: they've released this in an attempt to stop/muddle DNSSEC adoption, as DNSSEC represents an existential threat to their business: messing with the answers to DNS requests

Is DNSCurve an existential threat to Daniel Bernstein somehow? Because this is just a consumer-friendly implementation of DNSCurve.

Re: DNSCrypt: A tool for securing communications between a client and a DNS resolver

#15

Post by tptacek »

dfc wrote: post #12
dsl wrote: post #11

Earlier quoted context omitted.

Thats just overly cynical. https://yourlogicalfallacyis.com/genetic DNSSEC is only signatures for DNS. It provides no secrecy of queries or responses. In light of the current PRISM disaster, DNSSEC does nothing to protect you. I'll copy a snippet from OpenDNS' original announcement [1] here: Our support for DNSCurve doesn’t prevent our adoption of DNSSEC — they are not mutually exclusive. While we have reservations a…

In light of the current PRISM disaster, DNSSEC does nothing to protect you. Let's say Nation State A has all the data that prism has collected and Nation State B has the same exact dataset minus DNS traffic. Do you really think there is a lot that A can do that B can not? EDIT: Changed hypothetical actors from me/you to state a/ state b. It made it seem personal and its not i was just being lazy.

There's nothing you can do with the DNS at all, regardless of whether we use DNSSEC, DNSCurve, DNSCrypt, or 1995 BIND where the query IDs increase monotonically, that will deter any nation state actor. DNS security is marginally relevant to online crime, and to nothing else.

Re: DNSCrypt: A tool for securing communications between a client and a DNS resolver

#16

Post by simcop2387 »

ds9 wrote: post #4

It would be nice to have encrypted DNS, but it is pointless if the server is untrustworthy. This defaults to Open DNS, a commercial service that gives false results (replacing NXDOMAIN) unless the user signs up giving personal info! And for the same reason I don't want to use my ISP's DNS. I did a quick websearch for public DNS servers that give honest results without requiring an account, but did not see any mention…

The best i've been able to come up with is using something like dnsmasq plus a public resolver. it'll filter the results for you so that you can have their fake A records get turned into nxdomains. it's not a perfect solution (they can change the a records and you have to reconfigure) but it certainly seems to help.

Re: DNSCrypt: A tool for securing communications between a client and a DNS resolver

#17

Post by dfc »

tptacek wrote: post #13
bcl wrote: post #6

This isn't any better than using Google's DNS, your ISP's or OpenDNS directly. All your requests eventually go through a central location where they can be logged. Better to install your own caching dns server so they at least can't do traffic analysis on your repeat requests.

If you install your own cache server, not only can all of your DNS request be logged off the wire, but you're vulnerable to DNS spoofing attacks. Those attacks are probably impractical today, but might not remain so. I think securing the DNS is a poor approach in general, and we should instead concentrate on making an insecure DNS a chronic inconvenience rather than a fatal flaw. But if you're going to try to secure…

I am curious about "but not remain so." You don't think that increased adoption of DNSSEC will make dns spoofing less practical for zones that are signed (assuming properly configured local resolvers eg unbound on 127.0.0.1:53)?

Side note:† In the past I recall you supporting developers "pinning" certificates by rolling their own CAs and bundling the keys with their applications. I have always thought that DANE/TLSA records are an application layer agnostic method for certificate pinning. Do you think I have placed too much trust in DANE?

Given widespread adoption of DNSSEC, DANE records seem like an easier way to manage "certificate pinning" than having to push application updates. Plus I can use the same DANE records that my mobile app uses to protect the third party API for my service. Whereas embedding keys into apps leaves the API unprotected.

I realize "Assuming widespread adoption of DNSSEC" is the big "if" when speaking about the public in general. However for controlled environments (I'm thinking of anything ending in .gov/.mil) DANE records seem like an easy win.

† In this section I am shoveling words into your mouth so I apologize if I have misconstrued/misremembered previous posts.

Re: DNSCrypt: A tool for securing communications between a client and a DNS resolver

#18

Post by dfc »

tptacek wrote: post #15
dfc wrote: post #12

Earlier quoted context omitted.

In light of the current PRISM disaster, DNSSEC does nothing to protect you. Let's say Nation State A has all the data that prism has collected and Nation State B has the same exact dataset minus DNS traffic. Do you really think there is a lot that A can do that B can not? EDIT: Changed hypothetical actors from me/you to state a/ state b. It made it seem personal and its not i was just being lazy.

There's nothing you can do with the DNS at all, regardless of whether we use DNSSEC, DNSCurve, DNSCrypt, or 1995 BIND where the query IDs increase monotonically, that will deter any nation state actor. DNS security is marginally relevant to online crime, and to nothing else.

This was my point but I was leaving open the possibility that I was completely oblivious to something. The only situation where I can think of DNS privacy having any impact is with an overlay (VPN/Tor) that leaks DNS requests at the client endpoint.

Re: DNSCrypt: A tool for securing communications between a client and a DNS resolver

#19

Post by tptacek »

dfc wrote: post #17
tptacek wrote: post #13

Earlier quoted context omitted.

If you install your own cache server, not only can all of your DNS request be logged off the wire, but you're vulnerable to DNS spoofing attacks. Those attacks are probably impractical today, but might not remain so. I think securing the DNS is a poor approach in general, and we should instead concentrate on making an insecure DNS a chronic inconvenience rather than a fatal flaw. But if you're going to try to secure…

I am curious about "but not remain so." You don't think that increased adoption of DNSSEC will make dns spoofing less practical for zones that are signed (assuming properly configured local resolvers eg unbound on 127.0.0.1:53)? Side note:† In the past I recall you supporting developers "pinning" certificates by rolling their own CAs and bundling the keys with their applications. I have always thought that DANE/TLSA…

I meant that DNS spoofing vulnerabilities that are currently impractical against unencrypted DNS might not always be impractical against unencrypted DNS.

In the recent discussions about NSA surveillance, a technological anchor we could repeatedly point to was the fact that Google baked the identities of their keys directly into the binaries for Google Chrome. Firefox has adopted the same approach. I don't think it's hyperventilation to suggest that NSA has at least one trusted CA key in its possession, but despite that, NSA probably can't invisibly MITM Google Mail sessions because Chrome's trust anchor for Google Mail isn't a CA certificate.

In a DNSSEC world where DANE was used for key pinning, we'd be back to trusting a PKI root. Moreover, the PKI root we'd most often be trusting is one controlled by the US Government. How, exactly, is that a step forward?

Re: DNSCrypt: A tool for securing communications between a client and a DNS resolver

#20

Post by mike-cardwell »

dsl wrote: post #9
bcl wrote: post #6

This isn't any better than using Google's DNS, your ISP's or OpenDNS directly. All your requests eventually go through a central location where they can be logged. Better to install your own caching dns server so they at least can't do traffic analysis on your repeat requests.

OpenDNS has open sourced technology that allows you to secure DNS against eavesdropping, something no other technology will let you do at the DNS level (DNSSEC only does security, not privacy). They are also a major backer of DNSCrypt which provides transport security between recursive and authoritative servers. Without OpenDNS'es work, your cute little caching DNS server at home is still subject to the same intercep…

"Without OpenDNS'es work, your cute little caching DNS server at home is still subject to the same interception as queries flowing to your ISPs DNS cache."

Encrypting your DNS queries and responses doesn't help much when they log the IP addresses and ports you connect to.

Encryption by default is a good thing. I might get around to playing with DNSCurve at some point, but it's not a priority for me, because practically speaking it doesn't give me that much benefit and I already have DNSSEC support.

Post reply on HN