5 ms·

OpenDNS has open sourced technology that allows you to secure DNS against eavesdropping, something no other technology will let you do at the DNS level (DNSSEC

by dsl 13y ago

OpenDNS has open sourced technology that allows you to secure DNS against eavesdropping, something no other technology will let you do at the DNS level (DNSSEC only does security, not privacy). They are also a major backer of DNSCrypt which provides transport security between recursive and authoritative servers. Without OpenDNS'es work, your cute little caching DNS server at home is still subject to the same interception as queries flowing to your ISPs DNS cache. So what if they optionally replace some NXDOMAIN queries so they can make a little bit of money? If they didn't have a business model that was up front, you'd claim they were obviously funded by the government. We as a community need to not be so hard on commercial companies that are actually trying to protect us. Some of them are ran by genuine geeks like us and trying to help out.

blibble 13y ago
let's be honest here: they've released this in an attempt to stop/muddle DNSSEC adoption, as DNSSEC represents an existential threat to their business: messing with the answers to DNS requests
- dsl 13y ago
  Thats just overly cynical. https://yourlogicalfallacyis.com/genetic https://yourlogicalfallacyis.com/genetic DNSSEC is only signatures for DNS. It provides no secrecy of queries or responses. In light of the current PRISM disaster, DNSSEC does nothing to protect you. I'll copy a snippet from OpenDNS' original announcement [1] here: Our support for DNSCurve doesn’t prevent our adoption of DNSSEC — they are not mutually exclusive. While we have reservations about DNSSEC, we can and will implement it when we see more demand and traction, but in the meantime, when we see a viable technology that can be quickly implemented to improve security for DNS users, that’s a no-brainer in our book. 1. http://blog.opendns.com/2010/02/23/opendns-dnscurve/ http://blog.opendns.com/2010/02/23/opendns-dnscurve/
  - dfc 13y ago
    In light of the current PRISM disaster, DNSSEC does nothing to protect you. Let's say Nation State A has all the data that prism has collected and Nation State B has the same exact dataset minus DNS traffic. Do you really think there is a lot that A can do that B can not? EDIT: Changed hypothetical actors from me/you to state a/ state b. It made it seem personal and its not i was just being lazy.
    - tptacek 13y ago
      There's nothing you can do with the DNS at all, regardless of whether we use DNSSEC, DNSCurve, DNSCrypt, or 1995 BIND where the query IDs increase monotonically, that will deter any nation state actor. DNS security is marginally relevant to online crime, and to nothing else.
      - dfc 13y ago
        This was my point but I was leaving open the possibility that I was completely oblivious to something. The only situation where I can think of DNS privacy having any impact is with an overlay (VPN/Tor) that leaks DNS requests at the client endpoint.
- tptacek 13y ago
  Is DNSCurve an existential threat to Daniel Bernstein somehow? Because this is just a consumer-friendly implementation of DNSCurve.
- jedisct1 13y ago
  I wrote dnscrypt-proxy as a weekend project, and I still work on it on my spare time. And I'm a strong supporter of DNSSEC. Unbound didn't support SSL back then, so that was a quick hack to achieve something similar. Let Unbound do caching, DNSSEC validation and filtering, and still authenticate DNS queries&responses between my remote Unbound server and my laptop.
mike-cardwell 13y ago
"Without OpenDNS'es work, your cute little caching DNS server at home is still subject to the same interception as queries flowing to your ISPs DNS cache." Encrypting your DNS queries and responses doesn't help much when they log the IP addresses and ports you connect to. Encryption by default is a good thing. I might get around to playing with DNSCurve at some point, but it's not a priority for me, because practically speaking it doesn't give me that much benefit and I already have DNSSEC support.
anonymous 13y ago
In all fairness, their "work" is based on djb's (dnscurve). In fact, the entire company OpenDNS was built off of dnscache. And djb gives it all away fro free. That's what I call community. If your "cute little DNS server at home" is dnscache, then I'd say you're on equal footing with OpenDNS. And if you configure CurveDNS or some other implementation of dnscurve then I'd say you're achieveing everything you could achieve with DNSCrypt. And it won't cost you anything... like OpenDNS spying on your queries and serving you ads. The truth is, there are hardly any authoritative servers on the internet that support encrypted queries from dnscurve clients; dnscurve, as impressive as it is, remains obscure. If you're worried about someone sniffing or modifying queries off the wire as they travel from OpenDNS's or your home dnscache server to authoritative DNS servers, you'll have to restrain yourself to querying an extraordinarily small number of domains that have configured dnscurve. All other queries will fall back to being sent unencrypted. Why not just do TCP queries over SSL?

by dsl 13y ago

blibble 13y ago

let's be honest here: they've released this in an attempt to stop/muddle DNSSEC adoption, as DNSSEC represents an existential threat to their business: messing with the answers to DNS requests

dsl 13y ago
Thats just overly cynical. https://yourlogicalfallacyis.com/genetic https://yourlogicalfallacyis.com/genetic DNSSEC is only signatures for DNS. It provides no secrecy of queries or responses. In light of the current PRISM disaster, DNSSEC does nothing to protect you. I'll copy a snippet from OpenDNS' original announcement [1] here: Our support for DNSCurve doesn’t prevent our adoption of DNSSEC — they are not mutually exclusive. While we have reservations about DNSSEC, we can and will implement it when we see more demand and traction, but in the meantime, when we see a viable technology that can be quickly implemented to improve security for DNS users, that’s a no-brainer in our book. 1. http://blog.opendns.com/2010/02/23/opendns-dnscurve/ http://blog.opendns.com/2010/02/23/opendns-dnscurve/
- dfc 13y ago
  In light of the current PRISM disaster, DNSSEC does nothing to protect you. Let's say Nation State A has all the data that prism has collected and Nation State B has the same exact dataset minus DNS traffic. Do you really think there is a lot that A can do that B can not? EDIT: Changed hypothetical actors from me/you to state a/ state b. It made it seem personal and its not i was just being lazy.
  - tptacek 13y ago
    There's nothing you can do with the DNS at all, regardless of whether we use DNSSEC, DNSCurve, DNSCrypt, or 1995 BIND where the query IDs increase monotonically, that will deter any nation state actor. DNS security is marginally relevant to online crime, and to nothing else.
    - dfc 13y ago
      This was my point but I was leaving open the possibility that I was completely oblivious to something. The only situation where I can think of DNS privacy having any impact is with an overlay (VPN/Tor) that leaks DNS requests at the client endpoint.
tptacek 13y ago
Is DNSCurve an existential threat to Daniel Bernstein somehow? Because this is just a consumer-friendly implementation of DNSCurve.
jedisct1 13y ago
I wrote dnscrypt-proxy as a weekend project, and I still work on it on my spare time. And I'm a strong supporter of DNSSEC. Unbound didn't support SSL back then, so that was a quick hack to achieve something similar. Let Unbound do caching, DNSSEC validation and filtering, and still authenticate DNS queries&responses between my remote Unbound server and my laptop.

mike-cardwell 13y ago

"Without OpenDNS'es work, your cute little caching DNS server at home is still subject to the same interception as queries flowing to your ISPs DNS cache." Encrypting your DNS queries and responses doesn't help much when they log the IP addresses and ports you connect to. Encryption by default is a good thing. I might get around to playing with DNSCurve at some point, but it's not a priority for me, because practically speaking it doesn't give me that much benefit and I already have DNSSEC support.

anonymous 13y ago

In all fairness, their "work" is based on djb's (dnscurve). In fact, the entire company OpenDNS was built off of dnscache. And djb gives it all away fro free. That's what I call community. If your "cute little DNS server at home" is dnscache, then I'd say you're on equal footing with OpenDNS. And if you configure CurveDNS or some other implementation of dnscurve then I'd say you're achieveing everything you could achieve with DNSCrypt. And it won't cost you anything... like OpenDNS spying on your queries and serving you ads. The truth is, there are hardly any authoritative servers on the internet that support encrypted queries from dnscurve clients; dnscurve, as impressive as it is, remains obscure. If you're worried about someone sniffing or modifying queries off the wire as they travel from OpenDNS's or your home dnscache server to authoritative DNS servers, you'll have to restrain yourself to querying an extraordinarily small number of domains that have configured dnscurve. All other queries will fall back to being sent unencrypted. Why not just do TCP queries over SSL?