3 ms·

> Not if you use DNSCrypt That's not correct; Dnscrypt prevents against man-in-the-middle attacks, meaning your dns requests can not be manipulated. However, i

> Not if you use DNSCrypt That's not correct; Dnscrypt prevents against man-in-the-middle attacks, meaning your dns requests can not be manipulated. However, it does not provide end-to-end encryption.

Fnoord 9y ago
DNSCrypt is an implementation of DNSCurve. DNSCurve.org mentions: "DNSCurve uses high-speed high-security elliptic-curve cryptography to drastically improve every dimension of DNS security: Confidentiality: DNS requests and responses today are completely unencrypted and are broadcast to any attacker who cares to look. DNSCurve encrypts all DNS packets. Integrity: DNS today uses "UDP source-port randomization" and "TXID randomization" to create some speed bumps for blind attackers, but patient attackers and sniffing attackers can easily forge DNS records. DNSCurve cryptographically authenticates all DNS responses, eliminating forged DNS packets. Availability: DNS today has no protection against denial of service. A sniffing attacker can disable all of your DNS lookups by sending just a few forged packets per second. DNSCurve very quickly recognizes and discards forged packets, so attackers have much more trouble preventing DNS data from getting through. Protection is also needed for SMTP, HTTP, HTTPS, etc., but protecting DNS is the first step." Your ISP will see encrypted traffic on say port 443 TCP or UDP, and that's it.
- DavideNL 9y ago
  I see.. interesting. I read this from the author: "While not providing end-to-end security, it protects the local network, which is often the weakest point of the chain, against man-in-the-middle attacks." https://github.com/jedisct1/dnscrypt-proxy/blob/master/README.markdown https://github.com/jedisct1/dnscrypt-proxy/blob/master/READM... So my guess is that for example your dns requests could be intercepted/re-routed to say another dns server of an attacker and Dnscrypt would not notice/protect you against this. However, indeed your ISP would not be able to see your requests :)
  - Fnoord 9y ago
    I'm not sure whether it does certificate pinning or not. You don't know the security of the recursor either, and there is no E2EE between the nameserver of their domain and you. A hostile recursor could still cause DNS poisoning. An easy way to remember is that DNSCurve protects you between client and recursor whilst DNSSEC protects from (cc)TLD till name server (while also adding gigantic bloat to DNS requests). Trust issues often occur at the first hop: LTE (SS7 for example, lol), (public) WiFi (example: hotel, train station), or plain hostile ISPs who hijack DNS requests (like Comcast has done), inject ads, or government interventions (such as during Arabic revolution). DNSCurve/DNSCrypt can protect against these attacks.

Fnoord 9y ago

DNSCrypt is an implementation of DNSCurve. DNSCurve.org mentions: "DNSCurve uses high-speed high-security elliptic-curve cryptography to drastically improve every dimension of DNS security: Confidentiality: DNS requests and responses today are completely unencrypted and are broadcast to any attacker who cares to look. DNSCurve encrypts all DNS packets. Integrity: DNS today uses "UDP source-port randomization" and "TXID randomization" to create some speed bumps for blind attackers, but patient attackers and sniffing attackers can easily forge DNS records. DNSCurve cryptographically authenticates all DNS responses, eliminating forged DNS packets. Availability: DNS today has no protection against denial of service. A sniffing attacker can disable all of your DNS lookups by sending just a few forged packets per second. DNSCurve very quickly recognizes and discards forged packets, so attackers have much more trouble preventing DNS data from getting through. Protection is also needed for SMTP, HTTP, HTTPS, etc., but protecting DNS is the first step." Your ISP will see encrypted traffic on say port 443 TCP or UDP, and that's it.

DavideNL 9y ago
I see.. interesting. I read this from the author: "While not providing end-to-end security, it protects the local network, which is often the weakest point of the chain, against man-in-the-middle attacks." https://github.com/jedisct1/dnscrypt-proxy/blob/master/README.markdown https://github.com/jedisct1/dnscrypt-proxy/blob/master/READM... So my guess is that for example your dns requests could be intercepted/re-routed to say another dns server of an attacker and Dnscrypt would not notice/protect you against this. However, indeed your ISP would not be able to see your requests :)
- Fnoord 9y ago
  I'm not sure whether it does certificate pinning or not. You don't know the security of the recursor either, and there is no E2EE between the nameserver of their domain and you. A hostile recursor could still cause DNS poisoning. An easy way to remember is that DNSCurve protects you between client and recursor whilst DNSSEC protects from (cc)TLD till name server (while also adding gigantic bloat to DNS requests). Trust issues often occur at the first hop: LTE (SS7 for example, lol), (public) WiFi (example: hotel, train station), or plain hostile ISPs who hijack DNS requests (like Comcast has done), inject ads, or government interventions (such as during Arabic revolution). DNSCurve/DNSCrypt can protect against these attacks.