4 ms·

let's be honest here: they've released this in an attempt to stop/muddle DNSSEC adoption, as DNSSEC represents an existential threat to their business: messing

by blibble 13y ago

let's be honest here: they've released this in an attempt to stop/muddle DNSSEC adoption, as DNSSEC represents an existential threat to their business: messing with the answers to DNS requests

dsl 13y ago
Thats just overly cynical. https://yourlogicalfallacyis.com/genetic https://yourlogicalfallacyis.com/genetic DNSSEC is only signatures for DNS. It provides no secrecy of queries or responses. In light of the current PRISM disaster, DNSSEC does nothing to protect you. I'll copy a snippet from OpenDNS' original announcement [1] here: Our support for DNSCurve doesn’t prevent our adoption of DNSSEC — they are not mutually exclusive. While we have reservations about DNSSEC, we can and will implement it when we see more demand and traction, but in the meantime, when we see a viable technology that can be quickly implemented to improve security for DNS users, that’s a no-brainer in our book. 1. http://blog.opendns.com/2010/02/23/opendns-dnscurve/ http://blog.opendns.com/2010/02/23/opendns-dnscurve/
- dfc 13y ago
  In light of the current PRISM disaster, DNSSEC does nothing to protect you. Let's say Nation State A has all the data that prism has collected and Nation State B has the same exact dataset minus DNS traffic. Do you really think there is a lot that A can do that B can not? EDIT: Changed hypothetical actors from me/you to state a/ state b. It made it seem personal and its not i was just being lazy.
  - tptacek 13y ago
    There's nothing you can do with the DNS at all, regardless of whether we use DNSSEC, DNSCurve, DNSCrypt, or 1995 BIND where the query IDs increase monotonically, that will deter any nation state actor. DNS security is marginally relevant to online crime, and to nothing else.
    - dfc 13y ago
      This was my point but I was leaving open the possibility that I was completely oblivious to something. The only situation where I can think of DNS privacy having any impact is with an overlay (VPN/Tor) that leaks DNS requests at the client endpoint.
tptacek 13y ago
Is DNSCurve an existential threat to Daniel Bernstein somehow? Because this is just a consumer-friendly implementation of DNSCurve.
jedisct1 13y ago
I wrote dnscrypt-proxy as a weekend project, and I still work on it on my spare time. And I'm a strong supporter of DNSSEC. Unbound didn't support SSL back then, so that was a quick hack to achieve something similar. Let Unbound do caching, DNSSEC validation and filtering, and still authenticate DNS queries&responses between my remote Unbound server and my laptop.

by blibble 13y ago

let's be honest here: they've released this in an attempt to stop/muddle DNSSEC adoption, as DNSSEC represents an existential threat to their business: messing with the answers to DNS requests

dsl 13y ago

Thats just overly cynical. https://yourlogicalfallacyis.com/genetic https://yourlogicalfallacyis.com/genetic DNSSEC is only signatures for DNS. It provides no secrecy of queries or responses. In light of the current PRISM disaster, DNSSEC does nothing to protect you. I'll copy a snippet from OpenDNS' original announcement [1] here: Our support for DNSCurve doesn’t prevent our adoption of DNSSEC — they are not mutually exclusive. While we have reservations about DNSSEC, we can and will implement it when we see more demand and traction, but in the meantime, when we see a viable technology that can be quickly implemented to improve security for DNS users, that’s a no-brainer in our book. 1. http://blog.opendns.com/2010/02/23/opendns-dnscurve/ http://blog.opendns.com/2010/02/23/opendns-dnscurve/

dfc 13y ago
In light of the current PRISM disaster, DNSSEC does nothing to protect you. Let's say Nation State A has all the data that prism has collected and Nation State B has the same exact dataset minus DNS traffic. Do you really think there is a lot that A can do that B can not? EDIT: Changed hypothetical actors from me/you to state a/ state b. It made it seem personal and its not i was just being lazy.
- tptacek 13y ago
  There's nothing you can do with the DNS at all, regardless of whether we use DNSSEC, DNSCurve, DNSCrypt, or 1995 BIND where the query IDs increase monotonically, that will deter any nation state actor. DNS security is marginally relevant to online crime, and to nothing else.
  - dfc 13y ago
    This was my point but I was leaving open the possibility that I was completely oblivious to something. The only situation where I can think of DNS privacy having any impact is with an overlay (VPN/Tor) that leaks DNS requests at the client endpoint.

tptacek 13y ago

Is DNSCurve an existential threat to Daniel Bernstein somehow? Because this is just a consumer-friendly implementation of DNSCurve.

jedisct1 13y ago

I wrote dnscrypt-proxy as a weekend project, and I still work on it on my spare time. And I'm a strong supporter of DNSSEC. Unbound didn't support SSL back then, so that was a quick hack to achieve something similar. Let Unbound do caching, DNSSEC validation and filtering, and still authenticate DNS queries&responses between my remote Unbound server and my laptop.