4 ms·

DNSChain queries blockchains instead of querying DNS servers. The blockchain would have entries inserted by domain owners detailing their information -- functio

by rakoo 12y ago

DNSChain queries blockchains instead of querying DNS servers. The blockchain would have entries inserted by domain owners detailing their information -- functionally, A, AAAA and TLSA records. All the trust is put inside the blockchain. DSNChain allows you to query the blockchain with "traditional" tools, ie using DNS or HTTP queries. > How is it any better than cacert? Because you pin the trust to your own ca? There is no third-party to trust between you and the domain you want to visit (again, assuming the blockchain doesn't lie), so you really have the information the domain owner wants you to have.

lclarkmichalek 12y ago
Why are you reimplementing so many layers? Is it not possible to just provide dns resolution and cert pinning via the blockchain, and avoid having to deal with anything HTTP related? Seems overly specific to HTTP for no good reason.
- itistoday2 12y ago
  > Why are you reimplementing so many layers? What are you referring to? > Is it not possible to just provide dns resolution and cert pinning via the blockchain, and avoid having to deal with anything HTTP related? Seems overly specific to HTTP for no good reason. Might be misunderstanding you, but DNSChain is providing DNS resolution and "cert pinning" via the blockchain (the certs in the blockchain can be trusted pretty much as though they were pinned). The HTTP aspect of it is so that arbitrary applications can provide user-friendly MITM-proofed communication. In terms of securing communications, DNS is irrelevant. You can spoof DNS IPs all you want, but what ultimately secures the connection is the certificate that you receive, and that's queried over TLS/HTTPS.
  - lclarkmichalek 12y ago
    Ah, ok, the HTTP proxy thing is just there for ease of use. That seems reasonable then. Pity it has to use a blockchain approach, but scalable cert pinning might just be worth it.
e12e 12y ago
> (assuming the blockchain doesn't lie) Well, the blockchian lying is one thing -- another thing is if it tells the truth about lies ("it" has been lied to). I suppose my confusion stemmed from the fact that dnschain is two things: a way to secure data, and an infrastructure for registering data. Apparently there's no trust at the point of registration, which means the whole thing is entirely untrustworthy from a certain point of view (I don't necessarily thing this is a bad thing/feature -- it's just that without any form of vetting, there can be only a certain "kind" of trust), on the other hand if you trust the registration, you can trust your queries to return data that has been registered. With the/a CA system, you can trace trust trough keys back to organizations/individuals (that either act in bad faith, or has been compromised) -- but detecting such bad behaviour is out of scope of the CA system.
- itistoday2 12y ago
  > and an infrastructure for registering data Currently DNSChain supports reading from blockchains. Writing is planned for a future release. > Apparently there's no trust at the point of registration, which means the whole thing is entirely untrustworthy from a certain point of view Trust is not involved "at the point of registration", unless you are referring to trusting a central authority for registering .gov's or something like that (which can be done on a blockchain as well).

by rakoo 12y ago

lclarkmichalek 12y ago

Why are you reimplementing so many layers? Is it not possible to just provide dns resolution and cert pinning via the blockchain, and avoid having to deal with anything HTTP related? Seems overly specific to HTTP for no good reason.

itistoday2 12y ago
> Why are you reimplementing so many layers? What are you referring to? > Is it not possible to just provide dns resolution and cert pinning via the blockchain, and avoid having to deal with anything HTTP related? Seems overly specific to HTTP for no good reason. Might be misunderstanding you, but DNSChain is providing DNS resolution and "cert pinning" via the blockchain (the certs in the blockchain can be trusted pretty much as though they were pinned). The HTTP aspect of it is so that arbitrary applications can provide user-friendly MITM-proofed communication. In terms of securing communications, DNS is irrelevant. You can spoof DNS IPs all you want, but what ultimately secures the connection is the certificate that you receive, and that's queried over TLS/HTTPS.
- lclarkmichalek 12y ago
  Ah, ok, the HTTP proxy thing is just there for ease of use. That seems reasonable then. Pity it has to use a blockchain approach, but scalable cert pinning might just be worth it.

e12e 12y ago

> (assuming the blockchain doesn't lie) Well, the blockchian lying is one thing -- another thing is if it tells the truth about lies ("it" has been lied to). I suppose my confusion stemmed from the fact that dnschain is two things: a way to secure data, and an infrastructure for registering data. Apparently there's no trust at the point of registration, which means the whole thing is entirely untrustworthy from a certain point of view (I don't necessarily thing this is a bad thing/feature -- it's just that without any form of vetting, there can be only a certain "kind" of trust), on the other hand if you trust the registration, you can trust your queries to return data that has been registered. With the/a CA system, you can trace trust trough keys back to organizations/individuals (that either act in bad faith, or has been compromised) -- but detecting such bad behaviour is out of scope of the CA system.

itistoday2 12y ago
> and an infrastructure for registering data Currently DNSChain supports reading from blockchains. Writing is planned for a future release. > Apparently there's no trust at the point of registration, which means the whole thing is entirely untrustworthy from a certain point of view Trust is not involved "at the point of registration", unless you are referring to trusting a central authority for registering .gov's or something like that (which can be done on a blockchain as well).