3 ms·
Local DNSSEC validation allows your software to reject modified responses (provided the domain is DNSSEC signed). In the future, DNS over TLS, will also preven
by phicoh 10y ago
Local DNSSEC validation allows your software to reject modified responses (provided the domain is DNSSEC signed).
In the future, DNS over TLS, will also prevent this kind of tampering, and additionally prevent snooping on your DNS-to-resolver traffic.
- feld 10y agoOnly in an imaginary world where everyone signed their zones
- phicoh 10y agoYou always have to do something to make things secure. TLS certificates don't show up out of thin air. So, yes systems that don't bother to use security mechanisms will be insecure. That's normal.
- feld 10y agoWhich increases your security more: using DNSSEC, or using OpenDNS which automatically blocks malware domains / botnet C&C, etc? Right now there are real, tangible benefits to just using OpenDNS. There are very few benefits to setting up your own resolver with DNSSEC due to the limited amount of zones signing with it. I know these protect you from two different types of attacks, but for the average user the OpenDNS solution is more likely to protect them from harm (malware, ransomware, etc) than DNSSEC stopping a state actor doing a MITM (between end user and OpenDNS) which wouldn't be possible if you used OpenDNS via dnscrypt anyway; the state actor would have to successfully and undetectably poison OpenDNS's cache. tl;dr: To the average user DNSSEC has a miniscule security impact in their everyday internet usage.
- deleted 10y ago[deleted]