Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

DNSCrypt – A protocol to improve DNS security

dnscrypt.org

Post reply on HN
Print view View original

41–50 of 77 posts

Re: DNSCrypt – A protocol to improve DNS security

#41

Post by chillydawg »

geocar wrote: post #32
LogicX wrote: post #28

Earlier quoted context omitted.

So much to respond to here. I am one of those companies running a recursive DNS service, DNSFilter.com We are not advertising driven. OpenDNS cut the ads a few years ago. We do not run open resolvers, we just have paying customers who wish to use our service. The DNS extensions you are referring to are the EDNS0 Client Subnet extension. It is in wide use by authoritative servers for major CDNs and is supported by a n…

Hi there, I work in advertising, and I absolutely use the EDNS0 data to track users. I'm okay with a 1:250ish potential error rate since outside of facebook and google, you probably don't go to the same websites as your neighbour. Thanks for your hard work.

How does that work?

Re: DNSCrypt – A protocol to improve DNS security

#42

Post by lsjdfkljdfwkwdf »

robertcope wrote: post #8
fukusa wrote: post #5

Earlier quoted context omitted.

As far as I understand this doesn't encrypt communication but authenticates it to ensure it hasn't been tampered with. So it's still out in the open. I also don't understand what the benefit over DNSSEC is. Edit: Nvm, DNSSEC still has to trust the validating resolver, DNSCrypt solves this.

dnscrypt is an encrypted channel back to the DNS server. They can tell it's going to OpenDNS because of the IP address, but the cannot see the payload.

Why would you forward to opendns with a local dnssec enabled resolver? Just implement dnssec and run a proper dns infrastructure. No DNS operator reading HN? This thread is full of misinformation.

Re: DNSCrypt – A protocol to improve DNS security

#43

Post by geocar »

chillydawg wrote: post #41
geocar wrote: post #32

Earlier quoted context omitted.

Hi there, I work in advertising, and I absolutely use the EDNS0 data to track users. I'm okay with a 1:250ish potential error rate since outside of facebook and google, you probably don't go to the same websites as your neighbour. Thanks for your hard work.

How does that work?

I log the requests to my DNS servers.

My client embeds information I need into the host part and the custom DNS server always returns NXDOMAIN.

Re: DNSCrypt – A protocol to improve DNS security

#44

Post by pfg »

geocar wrote: post #32
LogicX wrote: post #28

Earlier quoted context omitted.

So much to respond to here. I am one of those companies running a recursive DNS service, DNSFilter.com We are not advertising driven. OpenDNS cut the ads a few years ago. We do not run open resolvers, we just have paying customers who wish to use our service. The DNS extensions you are referring to are the EDNS0 Client Subnet extension. It is in wide use by authoritative servers for major CDNs and is supported by a n…

Hi there, I work in advertising, and I absolutely use the EDNS0 data to track users. I'm okay with a 1:250ish potential error rate since outside of facebook and google, you probably don't go to the same websites as your neighbour. Thanks for your hard work.

I'm curious: what's the reason for doing this rather than just logging the IP addresses that hit your server directly? Is this a way to get around VPNs that leak the real IP via DNS? Or does this allow you to get something back from users with ad blockers that block the request, but no the DNS lookup (I don't know if this is the case)? Is it just a performance optimization (just a DNS lookup vs. a HTTP request)?

Re: DNSCrypt – A protocol to improve DNS security

#45

Post by nspassov »

wslh wrote: post #11
openasocket wrote: post #6

Earlier quoted context omitted.

> But even assuming that doesn't happen it's still a huge privacy/data leak. Meh, if an attacker can sniff your packets, they can already tell what IP addresses you're talking to, which certainly narrows down which domain names you're talking to. I'm far more concerned with the possibility of intercepting or hijacking http traffic. Sure, an attacker could do this with any non-TLS connection in theory, but it's way wa…

The IP address does not always tell you to which site you are connecting to. Many different sites can point to the same IP, more when services like Cloudflare are being used.

With increasing IPv6 adoption this would be less and less true.

Re: DNSCrypt – A protocol to improve DNS security

#46

Post by cryptolect »

In case nobody has pointed it out yet.

By default, with Ubuntu's dnscrypt-proxy package - the resolver is "cisco".

That's right, you're encrypting your DNS traffic just so Cisco can read it...

There are alternate resolvers but most people wouldn't change it out of the box.

Re: DNSCrypt – A protocol to improve DNS security

#47

Post by mike-cardwell »

Your default setup probably involves using your ISPs DNS resolver, which leaks your DNS queries to your ISP. Your ISP can also see which IP addresses you are connecting to and which website hostnames you're visiting thanks to unencrypted HTTP, and to SNI.

You could re-point your DNS resolver to one of the public DNSCrypt resolvers, but by doing so, all you're doing is making it so that another party gets to see your traffic. Your ISP still knows what you're doing, but now your DNS provider knows too.

From their own front page:

  Please note that DNSCrypt is not a replacement for a VPN,
  as it only authenticates DNS traffic, and doesn't prevent
  third-party DNS resolvers from logging your activity. By
  design, the TLS protocol, as used in HTTPS and HTTP/2,
  leaks websites host names in plain text, so DNSCrypt is
  not enough to hide this information.

Re: DNSCrypt – A protocol to improve DNS security

#48

Post by feld »

cryptolect wrote: post #46

In case nobody has pointed it out yet. By default, with Ubuntu's dnscrypt-proxy package - the resolver is "cisco". That's right, you're encrypting your DNS traffic just so Cisco can read it... There are alternate resolvers but most people wouldn't change it out of the box.

Cisco doesn't log the traffic. Don't believe me, just ask davidu who founded OpenDNS and resides at Cisco.

Re: DNSCrypt – A protocol to improve DNS security

#49

Post by 72deluxe »

Tepix wrote: post #38
INTPenis wrote: post #34

Earlier quoted context omitted.

Why are you being downvoted? https://kb.isc.org/article/AA-01386/30/DNS-over-TLS.html This article shows how to set it up according to ISC with stunnel. I was hoping for a native implementation in Bind but maybe it's coming.

Bind is still a mess after all these years. It seems to me like I get an update every other week that fixes a trivial DoS that hits an unchecked assertion. bind is a software that is only 80% finished. The missing 20% that take 80% of the time will only be implemented via CVEs.

Do they need help? Or a more rigorous test suite? Or pushing more errors to the compiler to trap these kind of things?

Re: DNSCrypt – A protocol to improve DNS security

#50

Post by arca_vorago »

I'm a bit rusty, and not to knock DNSCrypt or change the subject, but in the past I did a lot of reading and came to the conclusion that DNSCurve is the thing we should be pushing to adopt instead, due to some inherent flaws in DNSCrypt/DNSSEC.

To me, DNS is the current primary weakness of the internet in it's modern form, mainly due to centralization. I think we should also be focused more on secure connection techniques independent of the DNS system.

Post reply on HN