6 ms·
Hmm. Think they'll adopt DNSCrypt next?
by sarciszewski 11y ago
Hmm. Think they'll adopt DNSCrypt next?
- tptacek 11y agoDNSCrypt, which is far better and less costly than DNSSEC and does not cede to the US Government control over TLS keys, was proposed and deployed by a Cloudflare competitor. So, no.
- fweespeech 11y agoWhich competitor?
- sarciszewski 11y agoOpenDNS: https://www.opendns.com/about/innovations/dnscrypt/ https://www.opendns.com/about/innovations/dnscrypt/
- fweespeech 11y agoAs far as I'm aware, OpenDNS doesn't provide CDN-esque security services and is purely a DNS provider?
- jamespo 11y agoOracle don't produce a browser but still compete with Google and Microsoft in other areas
- fweespeech 11y agoYeah, but unless its something like Incapsula that functions as a direct replacement ... its not really competitive with Cloudflare's value proposition. You don't use Cloudflare as a DNS provider. Their value proposition [imho] is as a CDN/WAF. I was genuinely hoping someone like Sucuri or Incapsula had picked it up.
- xxdesmus 11y agoMany many people use CloudFlare as their DNS provider. We are among the fastest if not the fastest authoritative DNS provider in the world.
- deleted 11y ago[deleted]
- xxdesmus 11y agoOpenDNS provides recursive DNS, CloudFlare provides authoritative. They're complimentary, not competitive. We don't provide split horizon DNS, that's correct. That is easily resolved for more orgs by running our own internal DNS if you need that. http://www.datanyze.com/market-share/DNS/ http://www.datanyze.com/market-share/DNS/ claims we have 42% of the top 1M domains using our DNS. I'm not sure I actually believe that number, but a lot of people use us for their DNS.
- fweespeech 11y agoI deleted my post 'cause I think at this point you don't seem to get what I meant originally.
- rdl 11y agoWe are basically friends with OpenDNS. Complementary products, not competitors. Now that they are owned by Cisco, there is some competition (on premise network hardware vs. what CloudFlare offers), but that wouldn't prevent us from using a good open source tool they develop.
- eastdakota 11y agoOpenDNS isn't a competitor in any way. They provide recursive DNS, not authoritative DNS. CloudFlare provides authoritative DNS, not recursive. Simplistically: Their customers are web surfers, ours are websites. We've partnered with them on multiple initiatives, supported their technical work, and I consider David Ulevitch, their founder and CEO, a personal friend.
- FiloSottile 11y ago> and does not cede to the US Government control over TLS keys Hold on. This is actively conflating DNSSEC and DANE. I know your point that the "main feature" of DNSSEC is enabling DANE, and I respect that. But the two domains are still distinct: DNS security and the PKI built on top of that. DNSCrypt only addresses DNS security, so it should be compared to pure DNSSEC, which obviously does not "cede to the US Government control over TLS keys".
- sarciszewski 11y agoFilo: How do you feel about pushing for enabling DNSCrypt on your DNS servers, and working with the folks at Mozilla to make sure Firefox supports it? ;)
- tptacek 11y agoI don't agree with you. The top-down PKI DNSSEC expresses is inextricable from the DNS lookup security it attempts to provide. That DNSCrypt does a better job of solving lookup security without resorting to a government-controlled PKI is germane.
- jgrahamc 11y agowas proposed and deployed by a Cloudflare competitor. So, no. Bad reasoning. You think we'll not deploy HTTP/2 because the head of the committee works for Akamai? Cmon. DNSCrypt needs a secure resolver and client software. CloudFlare doesn't have either of those things which rather hampers us deploying DNSCrypt.
- sarciszewski 11y ago> CloudFlare doesn't have either of those things which rather hampers us deploying DNSCrypt. Behold: * https://dnscrypt.org/ https://dnscrypt.org/ * https://github.com/bitbeans/SimpleDnsCrypt https://github.com/bitbeans/SimpleDnsCrypt I'm sure with Filo on your team you could make that happen.
- jamespo 11y agoHow are cloudflare going to distribute this proxy to end users?
- sarciszewski 11y agoI don't understand your question. I'm asking if they can consider supporting it and help browser vendors (i.e. Firefox) support the client side of DNSCrypt. What does CloudFlare have to distribute?
- tptacek 11y agoCan you at least give me credit for not saying "EXTRA! EXTRA! INTERNET'S LARGEST DDOS PROTECTION SERVICE SUPPORTS DEPLOYMENT OF INTERNET'S WORST DDOS AMPLIFIER"? :)
- jgrahamc 11y agoJust this once.
- dsl 11y agoOpenDNS will happily send you queries over DNSCrypt. Thats like 3-4% of the internet right there. They also open sourced client implementations for end boxes to talk to them or any other recursive securely. jedisct1 is also looking for work right now, he'd happily implement it all for you I'm sure.
- _jomo 11y agoAFAIK DNSCrypt (as the name suggests) encrypts transfer of DNS data between client & server whereas DNSSEC authenticates (to some level) the validity of DNS data, but does not encrypt it. How do both compare ("far better")?
- akerro 11y agoDNSCrypt is to secure your connection client-server and server-client. DNSSEC is for server-server, to propagate existing addressbook.
- tptacek 11y agoThat's not entirely true. DNSCrypt also aims for end-to-end security. The real difference is that DNSSEC is a top-down protocol that doesn't work until every link between your browser and the DNS roots agree, and DNSCrypt is a bottom-up protocol that provides value even if just a few people use it.
- FullyFunctional 11y agoIt's far from the only difference, but it worth calling out: Only DNSCrypt protects your privacy!
- dfox 11y agoProblem with DNSCrypt is that it also does not solve meaningful problem. Governments can subvert DNSCrypt in exactly same way as they can subvert DNSSEC. Additionally, DNSCrypt offers no way to verify that the returned RRs realy come from authoritative server and weren't modified (by another DNS server) in transit. One additional feature that DNSCrypt has over DNSSEC is that it encrypts queries and responses and thus has some privacy value, on the other hand there probably is nothing privacy-sensitive in DNS queries and responses that will not get leaked by IP addresses and SNI anyway.
- sarciszewski 11y agoI'm suggesting CloudFlare support DNSCrypt of their DNSSEC-signed responses to protect end user privacy.
- tptacek 11y agoNo. DNSCrypt doesn't set out, on day one, to thwart NSA's ability to hijack DNS records. DNSCrypt's day-one job is to prevent coffee-shop attackers from MITMing your stub resolver, a job DNSSEC is actually incapable of doing. DNSSEC solves no meaningful problems on day 1. DNSCrypt solves one meaningful problem on day 1. Long term, if DNSCrypt is deployed widely, it will grow to solve more of the NSA problem, as end-to-end chains of DNSCrypt-protected DNS links are deployed connecting clients to authority servers. But over the long term, DNSSEC's problems don't get any better at all.
- FullyFunctional 11y ago"there probably is nothing privacy-sensitive in DNS queries" Actually, there's a lot. You can learn a tremendous amount from just looking at the NS traffic.
- rdl 11y agoCertainly looking at it.
- jedisct1 11y agoIrrelevant. Cloudflare provides authoritative DNS services, not recursive. We should rather encourage people to use a local, validating resolver.