Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

DNSCrypt: A tool for securing communications between a client and a DNS resolver

dnscrypt.org

Post reply on HN
Print view View original

21–30 of 31 posts

Re: DNSCrypt: A tool for securing communications between a client and a DNS resolver

#21

Post by dfc »

tptacek wrote: post #19
dfc wrote: post #17

Earlier quoted context omitted.

I am curious about "but not remain so." You don't think that increased adoption of DNSSEC will make dns spoofing less practical for zones that are signed (assuming properly configured local resolvers eg unbound on 127.0.0.1:53)? Side note:† In the past I recall you supporting developers "pinning" certificates by rolling their own CAs and bundling the keys with their applications. I have always thought that DANE/TLSA…

I meant that DNS spoofing vulnerabilities that are currently impractical against unencrypted DNS might not always be impractical against unencrypted DNS. In the recent discussions about NSA surveillance, a technological anchor we could repeatedly point to was the fact that Google baked the identities of their keys directly into the binaries for Google Chrome. Firefox has adopted the same approach. I don't think it's…

step forward

Duh, thank you. I don't know why I was approaching it as if the clients had the DNSSEC keys hardcoded for each zone. It seems that there is not a lot of hope for a solution that is easily interoperable (BYO Browser/MTA) when your threat model includes nation state and sub-nation state threats.

Re: DNSCrypt: A tool for securing communications between a client and a DNS resolver

#22

Post by tptacek »

dfc wrote: post #21
tptacek wrote: post #19

Earlier quoted context omitted.

I meant that DNS spoofing vulnerabilities that are currently impractical against unencrypted DNS might not always be impractical against unencrypted DNS. In the recent discussions about NSA surveillance, a technological anchor we could repeatedly point to was the fact that Google baked the identities of their keys directly into the binaries for Google Chrome. Firefox has adopted the same approach. I don't think it's…

step forward Duh, thank you. I don't know why I was approaching it as if the clients had the DNSSEC keys hardcoded for each zone. It seems that there is not a lot of hope for a solution that is easily interoperable (BYO Browser/MTA) when your threat model includes nation state and sub-nation state threats.

This is what's good about DNSCurve; it provides value immediately and deploys incrementally without boiling the ocean, and it doesn't come with a whole new PKI that would (for instance) force every .LY app to trust the government of Libya.

Re: DNSCrypt: A tool for securing communications between a client and a DNS resolver

#24

Post by anonymous »

dsl wrote: post #9
bcl wrote: post #6

This isn't any better than using Google's DNS, your ISP's or OpenDNS directly. All your requests eventually go through a central location where they can be logged. Better to install your own caching dns server so they at least can't do traffic analysis on your repeat requests.

OpenDNS has open sourced technology that allows you to secure DNS against eavesdropping, something no other technology will let you do at the DNS level (DNSSEC only does security, not privacy). They are also a major backer of DNSCrypt which provides transport security between recursive and authoritative servers. Without OpenDNS'es work, your cute little caching DNS server at home is still subject to the same intercep…

In all fairness, their "work" is based on djb's (dnscurve). In fact, the entire company OpenDNS was built off of dnscache. And djb gives it all away fro free. That's what I call community.

If your "cute little DNS server at home" is dnscache, then I'd say you're on equal footing with OpenDNS. And if you configure CurveDNS or some other implementation of dnscurve then I'd say you're achieveing everything you could achieve with DNSCrypt. And it won't cost you anything... like OpenDNS spying on your queries and serving you ads.

The truth is, there are hardly any authoritative servers on the internet that support encrypted queries from dnscurve clients; dnscurve, as impressive as it is, remains obscure. If you're worried about someone sniffing or modifying queries off the wire as they travel from OpenDNS's or your home dnscache server to authoritative DNS servers, you'll have to restrain yourself to querying an extraordinarily small number of domains that have configured dnscurve. All other queries will fall back to being sent unencrypted.

Why not just do TCP queries over SSL?

Re: DNSCrypt: A tool for securing communications between a client and a DNS resolver

#25

Post by jedisct1 »

simcop2387 wrote: post #16
ds9 wrote: post #4

It would be nice to have encrypted DNS, but it is pointless if the server is untrustworthy. This defaults to Open DNS, a commercial service that gives false results (replacing NXDOMAIN) unless the user signs up giving personal info! And for the same reason I don't want to use my ISP's DNS. I did a quick websearch for public DNS servers that give honest results without requiring an account, but did not see any mention…

The best i've been able to come up with is using something like dnsmasq plus a public resolver. it'll filter the results for you so that you can have their fake A records get turned into nxdomains. it's not a perfect solution (they can change the a records and you have to reconfigure) but it certainly seems to help.

You don't need dnsmasq for that. dnscrypt ships with the ldns-blocking plugin to block list of domains and IPs: https://github.com/jedisct1/dnscrypt-proxy/blob/master/src/p...

Re: DNSCrypt: A tool for securing communications between a client and a DNS resolver

#26

Post by jedisct1 »

apendleton wrote: post #8
bcl wrote: post #6

This isn't any better than using Google's DNS, your ISP's or OpenDNS directly. All your requests eventually go through a central location where they can be logged. Better to install your own caching dns server so they at least can't do traffic analysis on your repeat requests.

Depends on what you're trying to do. If you're trying to avoid logging, then sure, this doesn't get you much. If you're trying to secure yourself against local-network DNS attacks, this could be useful. There's also nothing to stop you from using a caching DNS server with DNScrypt (in fact, they give you instructions to do so).

Run dnscrypt-wrapper or unbound on your router. Then run dnscrypt-proxy or dnssec-trigger on your clients. You get secured against local-network DNS attacks, and this let you use any upstream resolvers (or none).

Re: DNSCrypt: A tool for securing communications between a client and a DNS resolver

#27

Post by jedisct1 »

blibble wrote: post #10
dsl wrote: post #9

Earlier quoted context omitted.

OpenDNS has open sourced technology that allows you to secure DNS against eavesdropping, something no other technology will let you do at the DNS level (DNSSEC only does security, not privacy). They are also a major backer of DNSCrypt which provides transport security between recursive and authoritative servers. Without OpenDNS'es work, your cute little caching DNS server at home is still subject to the same intercep…

let's be honest here: they've released this in an attempt to stop/muddle DNSSEC adoption, as DNSSEC represents an existential threat to their business: messing with the answers to DNS requests

I wrote dnscrypt-proxy as a weekend project, and I still work on it on my spare time. And I'm a strong supporter of DNSSEC.

Unbound didn't support SSL back then, so that was a quick hack to achieve something similar. Let Unbound do caching, DNSSEC validation and filtering, and still authenticate DNS queries&responses between my remote Unbound server and my laptop.

Re: DNSCrypt: A tool for securing communications between a client and a DNS resolver

#30

Post by ecesena »

jedisct1 wrote: post #28
ecesena wrote: post #23

How does it compare to DNSCurve ( http://dnscurve.org )?

How does it compare to DNSSIG? ( http://dnssig.org )?

I think DNSSIG is (at least designed) more for relationships among DNS servers and especially to protect the integrity of the DNS records, while this project seems more for securing the client-to-relay channel, with (I guess) focus on confidentiality.
Post reply on HN