4 ms·

“But suppose that DNSSEC does give you security—I’m not sure whether all of my DNS to Google or Cloudflare DNS servers [which perform DNSSEC by default] is what

“But suppose that DNSSEC does give you security—I’m not sure whether all of my DNS to Google or Cloudflare DNS servers [which perform DNSSEC by default] is what I really want if I’m interested in preserving my privacy.“ -Paul Mockapetris

teddyh 6y ago
Which is where DNS-over-TLS (DoT) comes in. It provides privacy.
- bluejekyll 6y ago
  Feels like that quote is muddling two different problems in the security of DNS. DoT and DoH provide session privacy by hiding the queries from unwanted sniffing. DNSSEC provides authenticated records back to the origin. They have separate use cases.
  - _wldu 6y ago
    And neither hide your DNS query from the DNS server itself. If half the world are using Cloudflare DNS via DoT, then Cloudflare could log those DNS queries and IPs. The logged data could be sold or given to law enforcement, governments, advertisers, etc. all from one or two large, convenient DoT providers. That is his point.
    - tialaramex 6y ago
      QNAME Minimisation hides your queries from more people who didn't need to know them. Historically most resolvers just always ask their entire question of everyone they speak to. "Hi, I need to reach Suzy the Whore in Big Street, Glasgow?" Local travel agent: "Glasgow is in Scotland, far side of the world, so you need a plane, go to the airport and ask for Scotland" "Hi, I need to reach Suzy the Whore in Big Street, Glasgow?" Airport information desk: "Glasgow is the other side of the country, you need a train, go the train station and ask for Glasgow" "Hi, I need to reach Suzy the Whore in Big Street, Glasgow?" Glasgow station information: "Big Street is about half an hour's walk across the city. Go catch a number 16 bus and get off at Big Street" "Hi, I need to reach Suzy the Whore in Big Street, Glasgow?" Local resident: "Suzy's two doors down, top floor" This is clearly a bad idea, we didn't need to tell anybody that we were looking for Suzy until we reached Big Street, or that we were headed for Big Street until we reached Glasgow. Is it possible Heathrow Airport has a tunnel to Suzy's house skipping the train to Glasgow that we'd only find by asking them? Not really, no, so we needn't give away what we want so easily. Also, the very big providers like Cloudflare are cheerfully signing agreements not to log all this data for outfits like Mozilla (and Google) if you insist on trusting them rather than having resolution take place locally.
      - roody15 6y ago
        Do you trust these agreements with cloudflare and google? That is a lot of trust in a few providers ... seems more like centralization rather than decentralization and perhaps move away from privacy
- gsich 6y ago
  From whom?
  - teddyh 6y ago
    From anyone other than who you are connecting to.
    - gsich 6y ago
      Not per se.
- _wldu 6y ago
  Only over the wire. Google and Cloudflare (or whatever DoT server you are using) still see and log your DNS queries (if they want). That is his point.
  - teddyh 6y ago
    Nothing in DoT tries to make you use some centralized resolver. That’s more DoH’s style.

teddyh 6y ago

Which is where DNS-over-TLS (DoT) comes in. It provides privacy.

bluejekyll 6y ago
Feels like that quote is muddling two different problems in the security of DNS. DoT and DoH provide session privacy by hiding the queries from unwanted sniffing. DNSSEC provides authenticated records back to the origin. They have separate use cases.
- _wldu 6y ago
  And neither hide your DNS query from the DNS server itself. If half the world are using Cloudflare DNS via DoT, then Cloudflare could log those DNS queries and IPs. The logged data could be sold or given to law enforcement, governments, advertisers, etc. all from one or two large, convenient DoT providers. That is his point.
  - tialaramex 6y ago
    QNAME Minimisation hides your queries from more people who didn't need to know them. Historically most resolvers just always ask their entire question of everyone they speak to. "Hi, I need to reach Suzy the Whore in Big Street, Glasgow?" Local travel agent: "Glasgow is in Scotland, far side of the world, so you need a plane, go to the airport and ask for Scotland" "Hi, I need to reach Suzy the Whore in Big Street, Glasgow?" Airport information desk: "Glasgow is the other side of the country, you need a train, go the train station and ask for Glasgow" "Hi, I need to reach Suzy the Whore in Big Street, Glasgow?" Glasgow station information: "Big Street is about half an hour's walk across the city. Go catch a number 16 bus and get off at Big Street" "Hi, I need to reach Suzy the Whore in Big Street, Glasgow?" Local resident: "Suzy's two doors down, top floor" This is clearly a bad idea, we didn't need to tell anybody that we were looking for Suzy until we reached Big Street, or that we were headed for Big Street until we reached Glasgow. Is it possible Heathrow Airport has a tunnel to Suzy's house skipping the train to Glasgow that we'd only find by asking them? Not really, no, so we needn't give away what we want so easily. Also, the very big providers like Cloudflare are cheerfully signing agreements not to log all this data for outfits like Mozilla (and Google) if you insist on trusting them rather than having resolution take place locally.
    - roody15 6y ago
      Do you trust these agreements with cloudflare and google? That is a lot of trust in a few providers ... seems more like centralization rather than decentralization and perhaps move away from privacy
gsich 6y ago
From whom?
- teddyh 6y ago
  From anyone other than who you are connecting to.
  - gsich 6y ago
    Not per se.
_wldu 6y ago
Only over the wire. Google and Cloudflare (or whatever DoT server you are using) still see and log your DNS queries (if they want). That is his point.
- teddyh 6y ago
  Nothing in DoT tries to make you use some centralized resolver. That’s more DoH’s style.