3 ms·

Sadly DNSSEC kinda sucks. Here's some earlier discussion on HN, with a lot of links. (Namedrop: tptacek is against DNSSEC and talks about it in the link.) ht

by IvyMike 13y ago

Sadly DNSSEC kinda sucks. Here's some earlier discussion on HN, with a lot of links. (Namedrop: tptacek is against DNSSEC and talks about it in the link.) https://news.ycombinator.com/item?id=5937004 https://news.ycombinator.com/item?id=5937004 TLDR: DNSSEC is kinda complex and hacko, doesn't protect you as much as you might think, and introduces a whole new PKI that you should probably trust even less than the current ones. But read the links above for the real story. I'm using DNSCrypt right now, which (correct me if I'm wrong) protects against DNS interception by my ISP, and seems like a whole lot less trouble than DNSSEC.

graylights 13y ago
DNScrypt only protects from your host to your nameserver. Your nameserver can still be poisoned as it queries other nameservers. dnssec protects mostly from poisoning between nameservers. It does little to protect between a host and their namserver. But in reality dnssec is not a solution, it's a problem. It will never be adopted in a meaningful way without major overhaul in spec.
mike-cardwell 13y ago
"protects against DNS interception by my ISP" Your ISP can still see the IP address of every web server that you connect to, and can still see the "Host" header that your browser sends in HTTP requests, and also in HTTPS requests (due to SNI) if you're using a reasonably modern OS/Browser combo. All you've done is add an additional third party that can view and log what you're doing.
- ars_technician 13y ago
  >All you've done is add an additional third party that can view and log what you're doing. You forgot the part where it's protecting against trashy ISPs like the one in this article.
  - mike-cardwell 13y ago
    I did not forget that. The privacy lost is worse than the supposed "protection" gained by using DNSCrypt. "Trashy" ISPs can (and do) still intercept and modify the HTTP traffic even if they can't intercept and modify the DNS traffic.

by IvyMike 13y ago

graylights 13y ago

DNScrypt only protects from your host to your nameserver. Your nameserver can still be poisoned as it queries other nameservers. dnssec protects mostly from poisoning between nameservers. It does little to protect between a host and their namserver. But in reality dnssec is not a solution, it's a problem. It will never be adopted in a meaningful way without major overhaul in spec.

mike-cardwell 13y ago

"protects against DNS interception by my ISP" Your ISP can still see the IP address of every web server that you connect to, and can still see the "Host" header that your browser sends in HTTP requests, and also in HTTPS requests (due to SNI) if you're using a reasonably modern OS/Browser combo. All you've done is add an additional third party that can view and log what you're doing.

ars_technician 13y ago
>All you've done is add an additional third party that can view and log what you're doing. You forgot the part where it's protecting against trashy ISPs like the one in this article.
- mike-cardwell 13y ago
  I did not forget that. The privacy lost is worse than the supposed "protection" gained by using DNSCrypt. "Trashy" ISPs can (and do) still intercept and modify the HTTP traffic even if they can't intercept and modify the DNS traffic.