Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

DNSCrypt – A protocol to improve DNS security

dnscrypt.org

Post reply on HN
Print view View original

61–70 of 77 posts

Re: DNSCrypt – A protocol to improve DNS security

#61

Post by MichaelGG »

GTP wrote: post #58
LogicX wrote: post #28

Earlier quoted context omitted.

So much to respond to here. I am one of those companies running a recursive DNS service, DNSFilter.com We are not advertising driven. OpenDNS cut the ads a few years ago. We do not run open resolvers, we just have paying customers who wish to use our service. The DNS extensions you are referring to are the EDNS0 Client Subnet extension. It is in wide use by authoritative servers for major CDNs and is supported by a n…

From section 11 of the draft: "To protect users' privacy, Recursive Resolvers are strongly encouraged to conceal part of the IP address of the user by truncating IPv4 addresses to 24 bits. 56 bits are recommended for IPv6, based on [RFC6177]. ISPs should have more detailed knowledge of their own networks. That is, they might know that all 24-bit prefixes in a /20 are in the same area. In those cases, for optimal cach…

It's to return local DNS records so you resolve to a nearby server.

Re: DNSCrypt – A protocol to improve DNS security

#62

Post by tptacek »

bluejekyll wrote: post #26
fukusa wrote: post #5

Earlier quoted context omitted.

As far as I understand this doesn't encrypt communication but authenticates it to ensure it hasn't been tampered with. So it's still out in the open. I also don't understand what the benefit over DNSSEC is. Edit: Nvm, DNSSEC still has to trust the validating resolver, DNSCrypt solves this.

An easy way to think about this stuff is: DNSSec => Authenticity of resource records DNSCrypt, DNSoverTLS => Privacy of the connection

That's a little of an oversimplification. DNSSEC is indeed limited to authenticity. But the idea of DNSCrypt is that with very widespread deployment, you get most of the benefit of resource integrity, in the same way that we do with TLS even though no system in TLS explicitly "signs" HTML pages.

Re: DNSCrypt – A protocol to improve DNS security

#63

Post by tptacek »

arca_vorago wrote: post #50

I'm a bit rusty, and not to knock DNSCrypt or change the subject, but in the past I did a lot of reading and came to the conclusion that DNSCurve is the thing we should be pushing to adopt instead, due to some inherent flaws in DNSCrypt/DNSSEC. To me, DNS is the current primary weakness of the internet in it's modern form, mainly due to centralization. I think we should also be focused more on secure connection techn…

DNSCrypt is unrelated to DNSSEC.

Re: DNSCrypt – A protocol to improve DNS security

#64

Post by tptacek »

sliken wrote: post #13
fukusa wrote: post #5

Earlier quoted context omitted.

As far as I understand this doesn't encrypt communication but authenticates it to ensure it hasn't been tampered with. So it's still out in the open. I also don't understand what the benefit over DNSSEC is. Edit: Nvm, DNSSEC still has to trust the validating resolver, DNSCrypt solves this.

Right, but what advantage does DNSCrypt have over a local DNSSEC aware resolver? If you can't trust the local resolver you have more serious problems than DNS.

DNSSEC provides no privacy. In fact, DNSSEC provides in the real world very few benefits of any kind, which is one of the reasons it's seen so little uptake in the 22 years during which the IETF has been working on it. Its most credible technical application is as a replacement for the CA system (which is a terrible idea).

https://sockpuppet.org/blog/2015/01/15/against-dnssec/

In the real world, for privacy, there are essentially two competing approaches: DNSCrypt and DNS-Privacy. Both are unrelated to DNSSEC. DNSCrypt uses a custom protocol to encrypt DNS transactions, and DNS-Privacy uses TLS. Neither require, or even benefit from, deployment of DNSSEC.

Re: DNSCrypt – A protocol to improve DNS security

#65

Post by fidget »

bluejekyll wrote: post #59
MertsA wrote: post #27

Earlier quoted context omitted.

>The reason? Advertising. Or the ability to accurately direct users to the nearest POP.

Yes, for people who don't know, this is how many things like directing users to a closer TLS endpoint for HTTP such that the overall connection suffers less latency.

Isn't anycast ip usually used for that instead?

Re: DNSCrypt – A protocol to improve DNS security

#66

Post by bluejekyll »

fidget wrote: post #65
bluejekyll wrote: post #59

Earlier quoted context omitted.

Yes, for people who don't know, this is how many things like directing users to a closer TLS endpoint for HTTP such that the overall connection suffers less latency.

Isn't anycast ip usually used for that instead?

It entirely depends, anycast is great for getting a request to the closest DNS endpoint via routing weight rules.

After that, there are many options. But the GP was specifically mentioning a valid use case where this is applicable and not shady.

Re: DNSCrypt – A protocol to improve DNS security

#67

Post by bluejekyll »

tptacek wrote: post #62
bluejekyll wrote: post #26

Earlier quoted context omitted.

An easy way to think about this stuff is: DNSSec => Authenticity of resource records DNSCrypt, DNSoverTLS => Privacy of the connection

That's a little of an oversimplification. DNSSEC is indeed limited to authenticity. But the idea of DNSCrypt is that with very widespread deployment, you get most of the benefit of resource integrity, in the same way that we do with TLS even though no system in TLS explicitly "signs" HTML pages.

Sure. But who's running every node in the DNSCrypt graph? I've never been clear about what that looks like.

I still see DNSSec as providing value before the entire graph of DNSCrypt or DNSoverTLS exists.

Re: DNSCrypt – A protocol to improve DNS security

#68

Post by arca_vorago »

tptacek wrote: post #63
arca_vorago wrote: post #50

I'm a bit rusty, and not to knock DNSCrypt or change the subject, but in the past I did a lot of reading and came to the conclusion that DNSCurve is the thing we should be pushing to adopt instead, due to some inherent flaws in DNSCrypt/DNSSEC. To me, DNS is the current primary weakness of the internet in it's modern form, mainly due to centralization. I think we should also be focused more on secure connection techn…

DNSCrypt is unrelated to DNSSEC.

Wasn't saying it was, perhaps I could have worded that more carefully.

Re: DNSCrypt – A protocol to improve DNS security

#69

Post by tptacek »

bluejekyll wrote: post #67
tptacek wrote: post #62

Earlier quoted context omitted.

That's a little of an oversimplification. DNSSEC is indeed limited to authenticity. But the idea of DNSCrypt is that with very widespread deployment, you get most of the benefit of resource integrity, in the same way that we do with TLS even though no system in TLS explicitly "signs" HTML pages.

Sure. But who's running every node in the DNSCrypt graph? I've never been clear about what that looks like. I still see DNSSec as providing value before the entire graph of DNSCrypt or DNSoverTLS exists.

There isn't one DNSCrypt graph. It's a forest of graphs that, in the event DNSCrypt became mainstream, would effectively converge. But, unlike DNSSEC, DNSCrypt doesn't require universal adoption to provide value.

DNSSEC provides no value at all until graph coverage is reached, and even then provides absolutely no privacy.

Re: DNSCrypt – A protocol to improve DNS security

#70

Post by WadeJohnson »

riquito wrote: post #55

Is there any plan to let smartphones, both Android and iOS, tu support changing the DNS at system level without rooting the device? So that it works with cellular data and that you don't need to change it for every wifi?

I am waiting for this as well.
Post reply on HN