5 ms·
Please correct me if I'm wrong, but isn't this strictly worse than DNSCurve & DNSCrypt? Those protocols are secure even over a hostile network. The only traffic
by erpellan 9y ago
Please correct me if I'm wrong, but isn't this strictly worse than DNSCurve & DNSCrypt? Those protocols are secure even over a hostile network. The only traffic visible is an end-to-end encrypted DNS request.
- deleted 9y ago[deleted]
- chrissnell 9y agoI don't know much about DNS over TLS but one thing I like about DNSCrypt is the certificate pinning. The one thing I don't really like about DNScrypt, or privacy-oriented DNS in general, is the lack of transparency of the remote end. I wish that more of the DNScrypt endpoints were run by organizations that I trust (EFF, etc) instead of by some random dude out on the internet. We need a highly transparent, non-commercial foundation for this.
- jedisct1 9y agoIndeed, that would be neat.
- kpcyrd 9y agoIf you need something that works everytime, you're stuck with http and https due to outbound firewalls. Even installing a dns recursor on your laptop might not work. I'm tempted to setup a corporate-y network as a weekend project, I think I'm getting out of touch with what some people have to bear with.
- chrissnell 9y agoA recursive DNS server on your laptop does next to nothing for privacy. It's still sending out the requests in plaintext to the root and authoritative nameservers. The only time it might help you is if the name is cached and it doesn't have to go to the wire to resolve it. Your best bet is to set up your own DNScrypt service instance on your own public server running on a network that you trust.