4 ms·
At the moment, if an attacker has control of your DNS, it's game over before you even start. There are some technologies that help, such as secure DNS (DNSSEC)
by wnissen 7y ago
At the moment, if an attacker has control of your DNS, it's game over before you even start. There are some technologies that help, such as secure DNS (DNSSEC) and "certificate pinning" but they don't do everything.
- tptacek 7y agoIn the case of DNSSEC, it doesn't do anything in this scenario, for two reasons: first, and most importantly, virtually nobody uses it (for instance, like almost every tech company as well, CHASE.COM isn't DNSSEC-signed and isn't likely to do so), and secondly because DNSSEC protects only server-to-server lookups and not client-server lookups, so if your Pi-Hole picks up a bad record somehow, DNSSEC isn't going to keep your browser from detecting that.