4 ms·

DNSCrypt has been around for a decade and works really well. Did everyone forget about it? It's objectively better than running DNS queries over HTTPS: still U

DNSCrypt has been around for a decade and works really well. Did everyone forget about it? It's objectively better than running DNS queries over HTTPS: still UDP based, no need to trust a CA but only the DNS server public key, can be cached locally or network-wise, perfect forward secrecy. There are clients[1] for Windows, Android, BSD, Linux, macOS and lots of providers[2]. It's really a shame it hasn't been made into a standard. [1]: https://github.com/jedisct1/dnscrypt-proxy https://github.com/jedisct1/dnscrypt-proxy [2]: https://dnscrypt.info/public-servers https://dnscrypt.info/public-servers

detaro 8y ago
Some would argue "still UDP based" is objectively worse, since it can be blocked. I don't think DNSCrypt is better for caching, doesn't it just protect one "leg" from a client (which can be a local cache) to a resolver (which also can be a cache) just like DoH? Similarly for pinning keys (although I think DNSCrypt made exchanging keys easier).
- gsich 8y ago
  Major advantage is the latency. TCP needs 3 trips, TLS an additional 4. With dnscrypt you have one request and one response. Then again, Cloudflare and Quad9 terminate the connection almost instantly after finishing your request. Tested this with DoT though. (stubby with high timeout set)
  - icebraining 8y ago
    Are you sure that's not a problem with the client? It seems Cloudflare supports leaving the connection open just fine (at least using the cloudflared client).
- michaelt 8y ago
  In the internet of the future, DNS will move from UDP to TCP because it's better, and HTTP/3 will move from TCP to UDP because it's better. Web 4.0 will consolidate these improvements, producing DNS over HTTP over QUIC over UDP.
  - detaro 8y ago
    Probably, yes. The key from that perspective is to have it in the same format as the content traffic.
  - Arnavion 8y ago
    We already have DNS over HTTP(S) now.
  - svsucculents 8y ago
    What a mess.
- em-bee 8y ago
  blocking or not blocking DNS is a two edged sword. as we see in the discussion about the chromecast ultra: https://news.ycombinator.com/item?id=19170671 https://news.ycombinator.com/item?id=19170671 it is not necessarily desirable to have a way for apps to resolve DNS that can't be blocked at all.
phicoh 8y ago
The discussion is not so much about which encryption technology to use, but on whether browsers should silently redirect DNS traffic to big US companies.
hd4 8y ago
>works really well Yes it works, but the setup can get messy. It used to break Ubuntu for me (like beyond repair and needed a full reinstall). I agree, I wish there was more consensus about how to lock down DNS traffic. It's surprising to me that it's taken this long to start getting mainstream recognition. DNSCrypt is probably best positioned to become a standard if anything. I'm going to give the latest version a try (the one that broke for me was a couple of years ago) hopefully it's better than before.
- driverdan 8y ago
  That's interesting. How did it break your system? I've been using it on OS X / macOS for years. Occasionally I'd run into an ISP that blocked it or a resolver that was slow or down but the software was always solid.
  - hd4 8y ago
    It messed up the network-manager/DNS iirc, though this was a while ago as I mentioned. The problem had something to do with the configuration of the Ubuntu package which was kinda fucked up so that didn't help matters, this is pre-16.04 so I'm hoping it got sorted out later on.

detaro 8y ago

Some would argue "still UDP based" is objectively worse, since it can be blocked. I don't think DNSCrypt is better for caching, doesn't it just protect one "leg" from a client (which can be a local cache) to a resolver (which also can be a cache) just like DoH? Similarly for pinning keys (although I think DNSCrypt made exchanging keys easier).

gsich 8y ago
Major advantage is the latency. TCP needs 3 trips, TLS an additional 4. With dnscrypt you have one request and one response. Then again, Cloudflare and Quad9 terminate the connection almost instantly after finishing your request. Tested this with DoT though. (stubby with high timeout set)
- icebraining 8y ago
  Are you sure that's not a problem with the client? It seems Cloudflare supports leaving the connection open just fine (at least using the cloudflared client).
michaelt 8y ago
In the internet of the future, DNS will move from UDP to TCP because it's better, and HTTP/3 will move from TCP to UDP because it's better. Web 4.0 will consolidate these improvements, producing DNS over HTTP over QUIC over UDP.
- detaro 8y ago
  Probably, yes. The key from that perspective is to have it in the same format as the content traffic.
- Arnavion 8y ago
  We already have DNS over HTTP(S) now.
- svsucculents 8y ago
  What a mess.
em-bee 8y ago
blocking or not blocking DNS is a two edged sword. as we see in the discussion about the chromecast ultra: https://news.ycombinator.com/item?id=19170671 https://news.ycombinator.com/item?id=19170671 it is not necessarily desirable to have a way for apps to resolve DNS that can't be blocked at all.

phicoh 8y ago

The discussion is not so much about which encryption technology to use, but on whether browsers should silently redirect DNS traffic to big US companies.

hd4 8y ago

>works really well Yes it works, but the setup can get messy. It used to break Ubuntu for me (like beyond repair and needed a full reinstall). I agree, I wish there was more consensus about how to lock down DNS traffic. It's surprising to me that it's taken this long to start getting mainstream recognition. DNSCrypt is probably best positioned to become a standard if anything. I'm going to give the latest version a try (the one that broke for me was a couple of years ago) hopefully it's better than before.

driverdan 8y ago
That's interesting. How did it break your system? I've been using it on OS X / macOS for years. Occasionally I'd run into an ISP that blocked it or a resolver that was slow or down but the software was always solid.
- hd4 8y ago
  It messed up the network-manager/DNS iirc, though this was a while ago as I mentioned. The problem had something to do with the configuration of the Ubuntu package which was kinda fucked up so that didn't help matters, this is pre-16.04 so I'm hoping it got sorted out later on.