4 ms·
It basically comes down to being insecure. It's all plain-text over UDP. This is easily exploited for various purposes: spoofing (DDoS attacks), surveillance (
by jlgaddis 9y ago
It basically comes down to being insecure.
It's all plain-text over UDP. This is easily exploited for various purposes: spoofing (DDoS attacks), surveillance (such as by ISPs), hijacking/tampering, censorship, privacy concerns, and so on.
As everything else relies on DNS, the DNS must also be secure.
- jason_slack 9y agoAre there replacement options being worked on? What about wrapping each request and unwrapping on the other end. Something like how Tor wraps requests in many layers?
- written 9y agohttps://en.wikipedia.org/wiki/Domain_Name_System_Security_Extensions https://en.wikipedia.org/wiki/Domain_Name_System_Security_Ex... + DNS-over-TLS for privacy
- jlgaddis 9y agoYes, several: DNS-over-TLS, DNS-over-HTTPS, DNSSEC, DNSCrypt, DNSCurve, and probably a few others I'm forgetting at the moment.
- jedisct1 9y agohttps://dnscrypt.info/faq/ https://dnscrypt.info/faq/