9 ms·

DNS isn't widely encrypted yet? That's scary. So does that mean if a rogue ISP wanted to, they could serve up Twitter.com on their internal network and return

by Keverw 10y ago

DNS isn't widely encrypted yet? That's scary. So does that mean if a rogue ISP wanted to, they could serve up Twitter.com on their internal network and return their fake DNS record instead assuming the user's cache expired? Kinda like a man in the middle but at the DNS level... Only problem is pretty much every, if not all SSL cert company requires domain verification. So they couldn't probably easily fake the SSL part for Twitter.

hawski 10y ago
With DNS encryption your ISP still sees IPs correct? Then it can do reverse DNS lookup. Then it can also serve whatever it wants on said IP. When I write in browser twitter.com/give-me-lots-of-pr0n does it first connect with twitter.com's port 80 and sends an unencrypted GET request with /give-me-lots-of-pr0n to receive redirect to https://twitter.com/ https://twitter.com/?
- Spoom 10y ago
  > When I write in browser twitter.com/give-me-lots-of-pr0n does it first connect with twitter.com's port 80 and sends an unencrypted GET request with /give-me-lots-of-pr0n to receive redirect to https://twitter.com/ https://twitter.com/? Probably not, in this case, because Twitter has implemented HSTS[1], and are[2] in a list that comes with your browser that specifies never to connect to the site unencrypted. If they're in the browser list, your browser will never actually connect on port 80; it will silently redirect client-side to HTTPS. 1. https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security 2. https://hstspreload.appspot.com/?domain=twitter.com https://hstspreload.appspot.com/?domain=twitter.com