3 ms·

I was gonna reply how we need to prevent DNS queries from being eavesdropped. But it seems, DNSSEC does not support traffic encryption: >DNSSEC does not provid

I was gonna reply how we need to prevent DNS queries from being eavesdropped. But it seems, DNSSEC does not support traffic encryption: >DNSSEC does not provide confidentiality of data; in particular, all DNSSEC responses are authenticated but not encrypted. (From the wiki) However, DNS poisoning attacks are still relevant because not all of the web is on HTTPS.

hsivonen 11y ago
Addressing non-HTTPS Web issues with migration to DNSSEC instead of migration to HTTPS is totally bogus. It's especially bogus as a use case in the Cloudflare case, since Cloudflare had HTTPS first.