2 ms·
Running one's own recursor using DNSSEC via an ISP's resolver (for the privacy benefit relative to authoritatives) would take care of active attacks by ISPs on
by cryptonector 7y ago
Running one's own recursor using DNSSEC via an ISP's resolver (for the privacy benefit relative to authoritatives) would take care of active attacks by ISPs on their users. Windows and Linux could do this you know, but security would be enhanced only relative to sites that use DNSSEC.
But I don't disagree that DoH is better.
I do hope that in the long run ISPs become less toxic.
- tptacek 7y agoRunning one's own resolver with DNSSEC would do absolutely nothing about the ISP threat, since DNSSEC is a cleartext signing-only protocol. Since the overwhelming majority of zones aren't signed, it won't even protect you from the garish NXDOMAIN landing page attack.
- cryptonector 7y agoI was referring to active attacks. I don't consider an ISP or a public resolver operator to be particularly different w.r.t. passive attacks: both get to do it, and both do do it.