3 ms·
With my colleagues I've been advocating for a decoupled approach to achieve security/privacy for network services like DNS, which we built a demo of earlier thi
by barathr 4y ago
With my colleagues I've been advocating for a decoupled approach to achieve security/privacy for network services like DNS, which we built a demo of earlier this week and wrote about a bit here -- the gist is that there's no reason to hand over your personal stream of DNS queries to a DNS resolver because you can divide the information across multiple parties:
https://invisv.com/articles/dns.html https://invisv.com/articles/dns.html
(The timing is coincidental -- we didn't realize Wyden was looking into this very issue and was going to issue a request for a probe into it.)
- silisili 4y agoReading this link...wouldnt this break EDNS client subnet then by design, or am I misunderstanding?
- barathr 4y agoYes and no; while the second hop (recursive resolver) won't know the client's IP/geo, we've chosen to locate the first and second hops very near each other in terms of network latency and, eventually, to roll out enough first hops so that there won't be much (region-scale) geographic distance between the client, the first hop, and the second hop. This would require a slight modification to the existing mechanism. (A client could include ECS as is, but it'd be bad for their privacy.)
- deleted 4y ago[deleted]