3 ms·
>> We invented DNSCrypt. There’s also DNS over TLS. Lots of ways to encrypt DNS without centralization. Ummm so what’s the downside then? Are those services ar
by drenginian 7y ago
>> We invented DNSCrypt. There’s also DNS over TLS. Lots of ways to encrypt DNS without centralization.
Ummm so what’s the downside then? Are those services arcane and hard to use and utterly forbidding blackest black magic, like almost all crypto stuff?
If you’re thinking browser users will just do this then that then this and x and y and z to “get dns crypto going”, then I’ll take Mozilla’s “it just works” approach.
It’s a much much better approach for the browsers to implement it rather than wait for everyone’s operating system to implement secure dns because that’ll happen .... well I can’t imagine any time in the future you could say everyone’s OS is using crypto DNS, whereas if browsers implement it for themselves, instant massive adoption.
- davidu 7y agoNot sure what any of your reply means. Adding OS support isn’t required. People just run a local resolver that supports these things. No different than any other application. Nothing arcane. Certainly no more than HTTP and SSL. I think you have some reading to do.
- drenginian 7y ago>> People just run a local resolver that’s support’s these things. Nowhere do “people just run a local resolver”. Grandma and aunty Beryl certainly don’t, nor does any other ordinary person. If you want secure DNS you have to build it in to the browser. Only systems people think that this is the sort of thing that ordinary people do.
- zaarn 7y agoI think the better solution is "build it into the browser and wait for systems to support it natively".
- SAI_Peregrinus 7y agoSo exactly what Mozilla is doing.
- whoopdedo 7y agoDoes Grandma have a small WiFi router that her cable modem is plugged into? Well that device provides local DNS for her.
- dreamcompiler 7y agoNot true. In the default case, Grandma's wifi router is just passing along -- via DHCP -- the IP address of the cable company's DNS resolver to Grandma's computer. Which the wifi router itself probably obtained via DHCP or a similar mechanism from the modem. This is in no sense a "local DNS resolver." If Grandma has a grandchild that knows how to set up a PiHole, it's a different story. But that's certainly not the majority of Grandmas or the majority of wifi routers.
- nemothekid 7y ago>* People just run a local resolver that supports these things.* How many people do you know that running local resolvers? How would this even work on Windows? The world doesn’t need another encrypted dns solution that only works on Linux
- WanderPanda 7y agoHow would this even work on iOS?
- saurik 7y agoYou write a network extension, which is what Cloudflare did for their 1.1.1.1 app.
- afiori 7y agoYou can literally do the same with DoH.