> The advantage of PQConnect is that, once you have installed PQConnect on your computer, PQConnect automatically detects servers that support PQConnect, and tr

> The advantage of PQConnect is that, once you have installed PQConnect on your computer, PQConnect automatically detects servers that support PQConnect, and transparently encrypts traffic to those servers. I mainly take issue with this claim of "automatically" detecting servers and magically doing post-quantum magic to your connections, magically. It seems to do so by noticing that DNS records for names are CNAMEs that match a format ("pq1" and then a 52-char b32-encoded hash), which it does by creating a netfilter rule for "udp sport 53" [0]. So, I guess if you don't have adversaries racing your DNS response packets, and you're not using dns-over-tls or dns-over-https, then the magic can work. One glaring problem with this kind of automatic, magic setup is that if you do have attackers, or if your system does dns in some newfangled way that wasn't thought up in the 1980s, then it doesn't secure your connection, but it also doesn't tell you that it failed to do so. So many clients (imap, ldap, anything) that use StartTLS don't default to "fail if TLS doesn't work" and don't tell the user anything about it, and it makes me hate StartTLS even though the fault isn't directly with StartTLS. [0] https://github.com/jedisct1/pqconnect/blob/6d093005ed164ff314dd69b9f59175e6727d71a5/src/pqconnect/nft.py#L69 https://github.com/jedisct1/pqconnect/blob/6d093005ed164ff31...