5 ms·
The encrypted DNS proposals only cover securing the route to the recursive resolver. So the recursive resolver (your ISP, google, cloudflare) will still see all
by Ienuur4i 8y ago
The encrypted DNS proposals only cover securing the route to the recursive resolver. So the recursive resolver (your ISP, google, cloudflare) will still see all the sites you're visiting.
We also need encrypted DNS for the recursive lookup itself so you can run your own resolver somewhere.
- blattimwind 8y ago> So the recursive resolver (your ISP, google, cloudflare) Why not yourself? Your ISP can still see the RR working, of course. > We also need encrypted DNS for the recursive lookup itself so you can run your own resolver somewhere. This would indeed be optimal but would require upgrading a significant portion of authoritative name servers, sooo... might take a while.
- Ienuur4i 8y ago> Why not yourself? Well, then what attacker do you defend against if your laptop asks your router via DoT but then the router does an unencrypted recursive lookup anyway?
- ajnin 8y agoWho said laptop ? You can have a DNS resolver on a server somewhere you own, that way it can remain encrypted on your ISP's network.
- tscs37 8y agoThe resolver is less of an issue because you have free choices there, ISP is harder to change. Plus you increase the number of parties that need to collude (ISP + RR provider) to spy on your traffic.
- devoply 8y agoTrue. However these days pretty much everyone is colluding so there is that. Data bonanza.