3 ms·

I see.. interesting. I read this from the author: "While not providing end-to-end security, it protects the local network, which is often the weakest point of

I see.. interesting. I read this from the author: "While not providing end-to-end security, it protects the local network, which is often the weakest point of the chain, against man-in-the-middle attacks." https://github.com/jedisct1/dnscrypt-proxy/blob/master/README.markdown https://github.com/jedisct1/dnscrypt-proxy/blob/master/READM... So my guess is that for example your dns requests could be intercepted/re-routed to say another dns server of an attacker and Dnscrypt would not notice/protect you against this. However, indeed your ISP would not be able to see your requests :)

Fnoord 9y ago
I'm not sure whether it does certificate pinning or not. You don't know the security of the recursor either, and there is no E2EE between the nameserver of their domain and you. A hostile recursor could still cause DNS poisoning. An easy way to remember is that DNSCurve protects you between client and recursor whilst DNSSEC protects from (cc)TLD till name server (while also adding gigantic bloat to DNS requests). Trust issues often occur at the first hop: LTE (SS7 for example, lol), (public) WiFi (example: hotel, train station), or plain hostile ISPs who hijack DNS requests (like Comcast has done), inject ads, or government interventions (such as during Arabic revolution). DNSCurve/DNSCrypt can protect against these attacks.