3 ms·
Problem with DNSCrypt is that it also does not solve meaningful problem. Governments can subvert DNSCrypt in exactly same way as they can subvert DNSSEC. Additi
by dfox 11y ago
Problem with DNSCrypt is that it also does not solve meaningful problem. Governments can subvert DNSCrypt in exactly same way as they can subvert DNSSEC. Additionally, DNSCrypt offers no way to verify that the returned RRs realy come from authoritative server and weren't modified (by another DNS server) in transit.
One additional feature that DNSCrypt has over DNSSEC is that it encrypts queries and responses and thus has some privacy value, on the other hand there probably is nothing privacy-sensitive in DNS queries and responses that will not get leaked by IP addresses and SNI anyway.
- sarciszewski 11y agoI'm suggesting CloudFlare support DNSCrypt of their DNSSEC-signed responses to protect end user privacy.
- tptacek 11y agoNo. DNSCrypt doesn't set out, on day one, to thwart NSA's ability to hijack DNS records. DNSCrypt's day-one job is to prevent coffee-shop attackers from MITMing your stub resolver, a job DNSSEC is actually incapable of doing. DNSSEC solves no meaningful problems on day 1. DNSCrypt solves one meaningful problem on day 1. Long term, if DNSCrypt is deployed widely, it will grow to solve more of the NSA problem, as end-to-end chains of DNSCrypt-protected DNS links are deployed connecting clients to authority servers. But over the long term, DNSSEC's problems don't get any better at all.
- FullyFunctional 11y ago"there probably is nothing privacy-sensitive in DNS queries" Actually, there's a lot. You can learn a tremendous amount from just looking at the NS traffic.