5 ms·

DNSCurve - https://en.wikipedia.org/wiki/DNSCurve https://en.wikipedia.org/wiki/DNSCurve

randomusr 11y ago
you do realize that not even 0.001% of people use that, right? DNS has to be encrypted by default for everyone. As in client -> recursor. Without any 3rd party software.
- icebraining 11y ago
  Then you must ask the OS vendors to include it, not startup developers. And in any case, encrypting DNS won't solve the surveillance issue, since the HTTPS handshake sends the domain in clear-text, so that the server knows which certificate to send (https://en.wikipedia.org/wiki/Server_Name_Indication https://en.wikipedia.org/wiki/Server_Name_Indication)
  - malka 11y ago
    One could use a single certificate that is valid for all domain on the server
    - icebraining 11y ago
      The client would still send the domain, since it doesn't known the server only has one certificate (the domain is sent in the first message, the ClientHello).
      - malka 11y ago
        oh yes very true. Had not thougth of that.
- tptacek 11y ago
  Unlike DNSSEC (which does not solve the problem the root comment complains about), DNSCurve/DNSCrypt doesn't require universal deployment to function. The 0.001% of people who use DNSCurve get most of the benefits of DNSCurve, despite being in a tiny minority.
  - xorcist 11y ago
    The fact that DNSSEC is not universally deployed, yet secures important infrastructure in big organizations, would suggest your argument is false. In practice it is a bit more complex as DNSSEC is globally deployed and widely available, and that's a large part of the reason you can trust it. Any global initiative takes a full ten years to deploy as we've repeatedly seen.
    - tptacek 11y ago
      What is the most important resource secured today by DNSSEC? I can name thousands of critically important resources that do not use DNSSEC. For instance: any credit card transaction you make on the Internet will not, at any step in the process, involve DNSSEC. The same is true of any stock order at any retail brokerage, or any FIX connection between an exchange and a broker/dealer.
      - xorcist 11y ago
        I've worked with banks and financial institutions for quite a while, and I would never pretend to be that sure about one bank, let alone all of them. You picked a bad example. I can assure you that the clearing following that very card transaction would involve DNSSEC at least at one point, at least at one bank.
nly 11y ago
Nobody is adopting DNSCurve anytime soon. The current two contenders are: DNSCrypt: https://dnscrypt.org/ https://dnscrypt.org/ (pushed for ages by OpenDNS and supported by PowerDNS's dnsdist among others) and, DNS over TLS: https://datatracker.ietf.org/doc/draft-ietf-dprive-dns-over-tls/ https://datatracker.ietf.org/doc/draft-ietf-dprive-dns-over-...

you do realize that not even 0.001% of people use that, right? DNS has to be encrypted by default for everyone. As in client -> recursor. Without any 3rd party software.

icebraining 11y ago
Then you must ask the OS vendors to include it, not startup developers. And in any case, encrypting DNS won't solve the surveillance issue, since the HTTPS handshake sends the domain in clear-text, so that the server knows which certificate to send (https://en.wikipedia.org/wiki/Server_Name_Indication https://en.wikipedia.org/wiki/Server_Name_Indication)
- malka 11y ago
  One could use a single certificate that is valid for all domain on the server
  - icebraining 11y ago
    The client would still send the domain, since it doesn't known the server only has one certificate (the domain is sent in the first message, the ClientHello).
    - malka 11y ago
      oh yes very true. Had not thougth of that.
tptacek 11y ago
Unlike DNSSEC (which does not solve the problem the root comment complains about), DNSCurve/DNSCrypt doesn't require universal deployment to function. The 0.001% of people who use DNSCurve get most of the benefits of DNSCurve, despite being in a tiny minority.
- xorcist 11y ago
  The fact that DNSSEC is not universally deployed, yet secures important infrastructure in big organizations, would suggest your argument is false. In practice it is a bit more complex as DNSSEC is globally deployed and widely available, and that's a large part of the reason you can trust it. Any global initiative takes a full ten years to deploy as we've repeatedly seen.
  - tptacek 11y ago
    What is the most important resource secured today by DNSSEC? I can name thousands of critically important resources that do not use DNSSEC. For instance: any credit card transaction you make on the Internet will not, at any step in the process, involve DNSSEC. The same is true of any stock order at any retail brokerage, or any FIX connection between an exchange and a broker/dealer.
    - xorcist 11y ago
      I've worked with banks and financial institutions for quite a while, and I would never pretend to be that sure about one bank, let alone all of them. You picked a bad example. I can assure you that the clearing following that very card transaction would involve DNSSEC at least at one point, at least at one bank.

nly 11y ago

Nobody is adopting DNSCurve anytime soon. The current two contenders are: DNSCrypt: https://dnscrypt.org/ https://dnscrypt.org/ (pushed for ages by OpenDNS and supported by PowerDNS's dnsdist among others) and, DNS over TLS: https://datatracker.ietf.org/doc/draft-ietf-dprive-dns-over-tls/ https://datatracker.ietf.org/doc/draft-ietf-dprive-dns-over-...