23 ms·
That's exactly why I created dnscrypt: https://dnscrypt.org https://dnscrypt.org -- Verify that responses you get actually come from the resolver you chose. If
by jedisct1 10y ago
That's exactly why I created dnscrypt: https://dnscrypt.org https://dnscrypt.org -- Verify that responses you get actually come from the resolver you chose. If not, they are ignored.
- kylepdm 10y agoIn this case, would the user just not resolve any DNS queries at all then if their ISP is intercepting all of them? Or am I missing something?
- tlrobinson 10y agoFor the security conscious, failing closed is better than failing open.
- twr 10y agoDNS interception usually takes place by redirecting traffic destined to port 53, like so: iptables -t mangle -A PREROUTING -p {udp,tcp} --dport 53 -j TPROXY --on-ip mitm-ip --on-port 53 Doing this isn't inherently malicious. Most of the time it's done for performance reasons. Bad idea, if you ask me, but whatever. Since dnscrypt transmits DNS requests over port 443, which is also used by HTTPS, ISPs can't redirect the packets without performing more costly fingerprinting, or else websites would break. dnscrypt packets are also encrypted and authenticated, so the worst probable thing an ISP could do is, like you said, drop the requests.
- davidu 10y agoYep.
- avdempsey 10y agoHow do we sponsor an iOS browser extension of this like you mention on your site?