3 ms·
Has DNS yet removed the possibility of an ISP front-running replies for outside DNS? For example, you want to see HN, but Comcast would rather you see HN throug
by jagged-chisel 7y ago
Has DNS yet removed the possibility of an ISP front-running replies for outside DNS? For example, you want to see HN, but Comcast would rather you see HN through their ad-injecting proxy - their systems can see your DNS query and reply with the proxy.
Seems like encryption and signing would help here as well.
- growse 7y agoDo you mean Dan kaminsky's issue from 2008? (https://en.wikipedia.org/wiki/Dan_Kaminsky#Flaw_in_DNS https://en.wikipedia.org/wiki/Dan_Kaminsky#Flaw_in_DNS) If so, this was fixed... in 2008.
- slededit 7y agoFixed is much too strong a word. Mitigated is more descriptive. From your link: > This fix is widely seen as a stopgap measure, as it only makes the attack up to 65,536 times harder. An attacker willing to send billions of packets can still corrupt names.
- growse 7y agoFair.
- monocasa 7y agoNah, they'd be able to use a much more surgical approach because they wouldn't need to guess the txid. They can just spool off packets that match what they're looking for and respond to them themselves instead of sending them along to 8.8.8.8 or whoever.
- monocasa 7y agoThey don't need to front run. They can simply impersonate and not pass along the queries.