5 ms·

This isn't any better than using Google's DNS, your ISP's or OpenDNS directly. All your requests eventually go through a central location where they can be logg

by bcl 13y ago

This isn't any better than using Google's DNS, your ISP's or OpenDNS directly. All your requests eventually go through a central location where they can be logged. Better to install your own caching dns server so they at least can't do traffic analysis on your repeat requests.

apendleton 13y ago
Depends on what you're trying to do. If you're trying to avoid logging, then sure, this doesn't get you much. If you're trying to secure yourself against local-network DNS attacks, this could be useful. There's also nothing to stop you from using a caching DNS server with DNScrypt (in fact, they give you instructions to do so).
- jedisct1 13y ago
  Run dnscrypt-wrapper or unbound on your router. Then run dnscrypt-proxy or dnssec-trigger on your clients. You get secured against local-network DNS attacks, and this let you use any upstream resolvers (or none).
dsl 13y ago
OpenDNS has open sourced technology that allows you to secure DNS against eavesdropping, something no other technology will let you do at the DNS level (DNSSEC only does security, not privacy). They are also a major backer of DNSCrypt which provides transport security between recursive and authoritative servers. Without OpenDNS'es work, your cute little caching DNS server at home is still subject to the same interception as queries flowing to your ISPs DNS cache. So what if they optionally replace some NXDOMAIN queries so they can make a little bit of money? If they didn't have a business model that was up front, you'd claim they were obviously funded by the government. We as a community need to not be so hard on commercial companies that are actually trying to protect us. Some of them are ran by genuine geeks like us and trying to help out.
- blibble 13y ago
  let's be honest here: they've released this in an attempt to stop/muddle DNSSEC adoption, as DNSSEC represents an existential threat to their business: messing with the answers to DNS requests
  - dsl 13y ago
    Thats just overly cynical. https://yourlogicalfallacyis.com/genetic https://yourlogicalfallacyis.com/genetic DNSSEC is only signatures for DNS. It provides no secrecy of queries or responses. In light of the current PRISM disaster, DNSSEC does nothing to protect you. I'll copy a snippet from OpenDNS' original announcement [1] here: Our support for DNSCurve doesn’t prevent our adoption of DNSSEC — they are not mutually exclusive. While we have reservations about DNSSEC, we can and will implement it when we see more demand and traction, but in the meantime, when we see a viable technology that can be quickly implemented to improve security for DNS users, that’s a no-brainer in our book. 1. http://blog.opendns.com/2010/02/23/opendns-dnscurve/ http://blog.opendns.com/2010/02/23/opendns-dnscurve/
    - dfc 13y ago
      In light of the current PRISM disaster, DNSSEC does nothing to protect you. Let's say Nation State A has all the data that prism has collected and Nation State B has the same exact dataset minus DNS traffic. Do you really think there is a lot that A can do that B can not? EDIT: Changed hypothetical actors from me/you to state a/ state b. It made it seem personal and its not i was just being lazy.
      - tptacek 13y ago
        There's nothing you can do with the DNS at all, regardless of whether we use DNSSEC, DNSCurve, DNSCrypt, or 1995 BIND where the query IDs increase monotonically, that will deter any nation state actor. DNS security is marginally relevant to online crime, and to nothing else.
        13y ago
tptacek 13y ago
If you install your own cache server, not only can all of your DNS request be logged off the wire, but you're vulnerable to DNS spoofing attacks. Those attacks are probably impractical today, but might not remain so. I think securing the DNS is a poor approach in general, and we should instead concentrate on making an insecure DNS a chronic inconvenience rather than a fatal flaw. But if you're going to try to secure the DNS, the DNSCurve hop-by-hop approach is superior to DNSSEC's approach.
- dfc 13y ago
  I am curious about "but not remain so." You don't think that increased adoption of DNSSEC will make dns spoofing less practical for zones that are signed (assuming properly configured local resolvers eg unbound on 127.0.0.1:53)? Side note:† In the past I recall you supporting developers "pinning" certificates by rolling their own CAs and bundling the keys with their applications. I have always thought that DANE/TLSA records are an application layer agnostic method for certificate pinning. Do you think I have placed too much trust in DANE? Given widespread adoption of DNSSEC, DANE records seem like an easier way to manage "certificate pinning" than having to push application updates. Plus I can use the same DANE records that my mobile app uses to protect the third party API for my service. Whereas embedding keys into apps leaves the API unprotected. I realize "Assuming widespread adoption of DNSSEC" is the big "if" when speaking about the public in general. However for controlled environments (I'm thinking of anything ending in .gov/.mil) DANE records seem like an easy win. † In this section I am shoveling words into your mouth so I apologize if I have misconstrued/misremembered previous posts.
  - tptacek 13y ago
    I meant that DNS spoofing vulnerabilities that are currently impractical against unencrypted DNS might not always be impractical against unencrypted DNS. In the recent discussions about NSA surveillance, a technological anchor we could repeatedly point to was the fact that Google baked the identities of their keys directly into the binaries for Google Chrome. Firefox has adopted the same approach. I don't think it's hyperventilation to suggest that NSA has at least one trusted CA key in its possession, but despite that, NSA probably can't invisibly MITM Google Mail sessions because Chrome's trust anchor for Google Mail isn't a CA certificate. In a DNSSEC world where DANE was used for key pinning, we'd be back to trusting a PKI root. Moreover, the PKI root we'd most often be trusting is one controlled by the US Government. How, exactly, is that a step forward?

by bcl 13y ago

apendleton 13y ago

Depends on what you're trying to do. If you're trying to avoid logging, then sure, this doesn't get you much. If you're trying to secure yourself against local-network DNS attacks, this could be useful. There's also nothing to stop you from using a caching DNS server with DNScrypt (in fact, they give you instructions to do so).

jedisct1 13y ago
Run dnscrypt-wrapper or unbound on your router. Then run dnscrypt-proxy or dnssec-trigger on your clients. You get secured against local-network DNS attacks, and this let you use any upstream resolvers (or none).

dsl 13y ago

OpenDNS has open sourced technology that allows you to secure DNS against eavesdropping, something no other technology will let you do at the DNS level (DNSSEC only does security, not privacy). They are also a major backer of DNSCrypt which provides transport security between recursive and authoritative servers. Without OpenDNS'es work, your cute little caching DNS server at home is still subject to the same interception as queries flowing to your ISPs DNS cache. So what if they optionally replace some NXDOMAIN queries so they can make a little bit of money? If they didn't have a business model that was up front, you'd claim they were obviously funded by the government. We as a community need to not be so hard on commercial companies that are actually trying to protect us. Some of them are ran by genuine geeks like us and trying to help out.

blibble 13y ago
let's be honest here: they've released this in an attempt to stop/muddle DNSSEC adoption, as DNSSEC represents an existential threat to their business: messing with the answers to DNS requests
- dsl 13y ago
  Thats just overly cynical. https://yourlogicalfallacyis.com/genetic https://yourlogicalfallacyis.com/genetic DNSSEC is only signatures for DNS. It provides no secrecy of queries or responses. In light of the current PRISM disaster, DNSSEC does nothing to protect you. I'll copy a snippet from OpenDNS' original announcement [1] here: Our support for DNSCurve doesn’t prevent our adoption of DNSSEC — they are not mutually exclusive. While we have reservations about DNSSEC, we can and will implement it when we see more demand and traction, but in the meantime, when we see a viable technology that can be quickly implemented to improve security for DNS users, that’s a no-brainer in our book. 1. http://blog.opendns.com/2010/02/23/opendns-dnscurve/ http://blog.opendns.com/2010/02/23/opendns-dnscurve/
  - dfc 13y ago
    In light of the current PRISM disaster, DNSSEC does nothing to protect you. Let's say Nation State A has all the data that prism has collected and Nation State B has the same exact dataset minus DNS traffic. Do you really think there is a lot that A can do that B can not? EDIT: Changed hypothetical actors from me/you to state a/ state b. It made it seem personal and its not i was just being lazy.
    - tptacek 13y ago
      There's nothing you can do with the DNS at all, regardless of whether we use DNSSEC, DNSCurve, DNSCrypt, or 1995 BIND where the query IDs increase monotonically, that will deter any nation state actor. DNS security is marginally relevant to online crime, and to nothing else.
      - 13y ago

tptacek 13y ago

If you install your own cache server, not only can all of your DNS request be logged off the wire, but you're vulnerable to DNS spoofing attacks. Those attacks are probably impractical today, but might not remain so. I think securing the DNS is a poor approach in general, and we should instead concentrate on making an insecure DNS a chronic inconvenience rather than a fatal flaw. But if you're going to try to secure the DNS, the DNSCurve hop-by-hop approach is superior to DNSSEC's approach.

dfc 13y ago
I am curious about "but not remain so." You don't think that increased adoption of DNSSEC will make dns spoofing less practical for zones that are signed (assuming properly configured local resolvers eg unbound on 127.0.0.1:53)? Side note:† In the past I recall you supporting developers "pinning" certificates by rolling their own CAs and bundling the keys with their applications. I have always thought that DANE/TLSA records are an application layer agnostic method for certificate pinning. Do you think I have placed too much trust in DANE? Given widespread adoption of DNSSEC, DANE records seem like an easier way to manage "certificate pinning" than having to push application updates. Plus I can use the same DANE records that my mobile app uses to protect the third party API for my service. Whereas embedding keys into apps leaves the API unprotected. I realize "Assuming widespread adoption of DNSSEC" is the big "if" when speaking about the public in general. However for controlled environments (I'm thinking of anything ending in .gov/.mil) DANE records seem like an easy win. † In this section I am shoveling words into your mouth so I apologize if I have misconstrued/misremembered previous posts.
- tptacek 13y ago
  I meant that DNS spoofing vulnerabilities that are currently impractical against unencrypted DNS might not always be impractical against unencrypted DNS. In the recent discussions about NSA surveillance, a technological anchor we could repeatedly point to was the fact that Google baked the identities of their keys directly into the binaries for Google Chrome. Firefox has adopted the same approach. I don't think it's hyperventilation to suggest that NSA has at least one trusted CA key in its possession, but despite that, NSA probably can't invisibly MITM Google Mail sessions because Chrome's trust anchor for Google Mail isn't a CA certificate. In a DNSSEC world where DANE was used for key pinning, we'd be back to trusting a PKI root. Moreover, the PKI root we'd most often be trusting is one controlled by the US Government. How, exactly, is that a step forward?