Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

DNS-on-Blockchain is the next step after DNS-over-HTTPS

diode.io

Post reply on HN
Print view View original

61–69 of 69 posts

Re: DNS-on-Blockchain is the next step after DNS-over-HTTPS

#61

Post by troquerre »

dogma1138 wrote: post #5
troquerre wrote: post #3

Handshake is another DNS on blockchain project that's taking a different approach — it's aiming to decentralize the root zone (TLDs) instead of domains, because the root zone is where the centralization happens. This MIT Tech Review article gives a good overview of Handshake's goals: https://www.technologyreview.com/s/613446/the-ambitious-plan...

Every time I see an article claiming that someone is building some “decentralized” system to make censorship harder I wonder if anyone of those people even understands how the internet is censored at scale in places like China. For the censorship we have in the west e.g. blacklisting torrent sites a non-ISP DNS and or CDN already solve that problem, for anything beyond that nothing would help.

The real innovation of Handshake is that is allows you to verify the public key associated with a name. This opens the door to enabling SSL/TLS without relying on Certificate Authorities, which is a vulnerability point in the security of the Internet today. The additional benefit is that the names are difficult to censor. Governments can still censor by IP of course, but the point is that it forces bad actors to censor at a deeper level (and there are other projects tackling solving that).

Re: DNS-on-Blockchain is the next step after DNS-over-HTTPS

#62

Post by _8j50 »

zaarn wrote: post #57
_8j50 wrote: post #56

Earlier quoted context omitted.

You have to keep in mind ipfs is content-addressed. Instead of resolving names you can resolve certificates by their content addressed thumbprint. 1) boostrap 2) find the cert thumbprint for site.com 3) find the cert by the thumbprint and connect to one if IP SAN records

How do you securely get the cert thumbprint?

You don't need to,even if you get a malicious thumbprint,the associated cert still needs to be signed by a trusted CA. CA list for TLDs will be distributed with the resolver software just like browsers ship with such a list (or rely on your browser/client preferred list)

Re: DNS-on-Blockchain is the next step after DNS-over-HTTPS

#63

Post by bouncycastle »

SAI_Peregrinus wrote: post #49
bouncycastle wrote: post #40

Earlier quoted context omitted.

Yes, the proof would be some sort of signature. No, public key cryptography means that the key doesn't need to be shared. A blockchain is only needed if parties need to write to the database in a decentralized manner, and the order of the writes is important & can't be tampered with.

The public key still needs to be shared.

Of course. The OP didn't mention which key, so assumed they are talking about the private key, especially when they mentioned out-of-bound sharing, usually terminology used for asymmetric cryptography. Public keys don't need to be shared out-of-band, in fact they are always published along with the transaction on the blockchain. (well technically, only the curve points and the hash are, but using these, we can re-create the public key)

Re: DNS-on-Blockchain is the next step after DNS-over-HTTPS

#64

Post by momack2 »

zaarn wrote: post #22
_8j50 wrote: post #11

Earlier quoted context omitted.

Ipfs.io can solve this easily.

Ipfs requires a DNS server to bootstrap the P2P network, not a good idea. Plus, Ipfs isn't that good when it comes to authentic data, if it's signed, there is only one key, so it's centralized again.

There are capabilities to use the existing DNS system (or an EthDNS system in the works) for human readable names with IPFS, but you can also use other channels like pubsub to resolve mutable content like IPNS names quickly - so IPFS doesn't actually require DNS at all. Multiwriter IPNS records are also a work in progress, though I disagree with your characterization that somehow only allowing one key to edit a particular signed record somehow makes the network itself centralized...

Re: DNS-on-Blockchain is the next step after DNS-over-HTTPS

#65

Post by zaarn »

momack2 wrote: post #64
zaarn wrote: post #22

Earlier quoted context omitted.

Ipfs requires a DNS server to bootstrap the P2P network, not a good idea. Plus, Ipfs isn't that good when it comes to authentic data, if it's signed, there is only one key, so it's centralized again.

There are capabilities to use the existing DNS system (or an EthDNS system in the works) for human readable names with IPFS, but you can also use other channels like pubsub to resolve mutable content like IPNS names quickly - so IPFS doesn't actually require DNS at all. Multiwriter IPNS records are also a work in progress, though I disagree with your characterization that somehow only allowing one key to edit a parti…

This isn'T about the IPFS Application Layer but the Link layer.

Bootstrapping a P2P system efficiently requires known P2P nodes and those will require DNS unless you want to shell out for a static IP permanently (and hope nobody poisons ARP!)

Re: DNS-on-Blockchain is the next step after DNS-over-HTTPS

#66

Post by tinybeagle »

Causality1 wrote: post #31

Correct me if I'm wrong, but wouldn't DNS-on-blockchain make lookups orders of magnitude slower than they are now, especially with many DNS services advertising based on speed?

Yes, DNS-on-blockchain would likely make lookups orders of magnitude slower than they are now -- it's making a trade-off between security and performance.

Re: DNS-on-Blockchain is the next step after DNS-over-HTTPS

#67

Post by tinybeagle »

jeffk_teh_haxor wrote: post #6

So every DNS change is stored into the blockchain, forever? Will you have to download terabytes and terabytes of the blockchain in order to serve as a node? Why is that kind of audit history necessary? Why is the solution to every problem "blockchain" these days?

You don’t necessarily need to store DNS changes into the blockchain. The blockchain will only keep the current state and would prune the changes. According to Diode’s blog posts, 20kb of storage is all it needs with BlockQuick, the newly developed light-client protocol.

The point is less about storing the audit history, but more about preventing Man-in-the-Middle attacks and solving the timestamp-certificate chicken-egg problem.

Re: DNS-on-Blockchain is the next step after DNS-over-HTTPS

#68

Post by tinybeagle »

zaarn wrote: post #25

DoB will have to deal with some problems, especially bad actors; people will squat on domains, register typos (fscebook.com) or even bitflips (fabebook.com, b is one bitflip from c). Malware owners will run their C&C servers on domains. Malicious domains will require someone removing them or blocking them even, unless you want the DoB namespace to turn into a cesspool of malware, phishing and nazis. Not something the…

There are some proposals that use mechanisms like Harberger tax to combat squatting. https://discuss.ens.domains/t/highlight-robin-hansons-more-o...

Re: DNS-on-Blockchain is the next step after DNS-over-HTTPS

#69

Post by theamk »

tinybeagle wrote: post #68
zaarn wrote: post #25

DoB will have to deal with some problems, especially bad actors; people will squat on domains, register typos (fscebook.com) or even bitflips (fabebook.com, b is one bitflip from c). Malware owners will run their C&C servers on domains. Malicious domains will require someone removing them or blocking them even, unless you want the DoB namespace to turn into a cesspool of malware, phishing and nazis. Not something the…

There are some proposals that use mechanisms like Harberger tax to combat squatting. https://discuss.ens.domains/t/highlight-robin-hansons-more-o...

For DNS, does that mean that if Facebook wants any domain I own, like my homepage for the last 20 years, they'll just get it?

Because an amount of money I can afford to protect it is tiny compared to FB's marketing budgets.

Post reply on HN