2 ms·
Thats just overly cynical. https://yourlogicalfallacyis.com/genetic https://yourlogicalfallacyis.com/genetic DNSSEC is only signatures for DNS. It provides no
by dsl 13y ago
Thats just overly cynical. https://yourlogicalfallacyis.com/genetic https://yourlogicalfallacyis.com/genetic
DNSSEC is only signatures for DNS. It provides no secrecy of queries or responses. In light of the current PRISM disaster, DNSSEC does nothing to protect you.
I'll copy a snippet from OpenDNS' original announcement [1] here:
Our support for DNSCurve doesn’t prevent our adoption of DNSSEC — they are not mutually exclusive. While we have reservations about DNSSEC, we can and will implement it when we see more demand and traction, but in the meantime, when we see a viable technology that can be quickly implemented to improve security for DNS users, that’s a no-brainer in our book.
1. http://blog.opendns.com/2010/02/23/opendns-dnscurve/ http://blog.opendns.com/2010/02/23/opendns-dnscurve/
- dfc 13y agoIn light of the current PRISM disaster, DNSSEC does nothing to protect you. Let's say Nation State A has all the data that prism has collected and Nation State B has the same exact dataset minus DNS traffic. Do you really think there is a lot that A can do that B can not? EDIT: Changed hypothetical actors from me/you to state a/ state b. It made it seem personal and its not i was just being lazy.
- tptacek 13y agoThere's nothing you can do with the DNS at all, regardless of whether we use DNSSEC, DNSCurve, DNSCrypt, or 1995 BIND where the query IDs increase monotonically, that will deter any nation state actor. DNS security is marginally relevant to online crime, and to nothing else.
- dfc 13y agoThis was my point but I was leaving open the possibility that I was completely oblivious to something. The only situation where I can think of DNS privacy having any impact is with an overlay (VPN/Tor) that leaks DNS requests at the client endpoint.