topranks

38 ms·

421.
by topranks 8y ago
No, DoH only deals with client to resolver encryption. Recursive lookups from the resolver to authoritative DNS servers from the root down are not encrypted. Really what you are doing is switching between telling your ISP all the domains yo
422.
by topranks 8y ago
I’d be fairly certain this would be against Mozilla’s requirements.
423.
by topranks 8y ago
The real difficulty as time goes on is to update the list.
424.
by topranks 8y ago
The main argument should be that the OS controls what DNS is used. The user of the OS can then set their own DNS. If applications just ignore this and use their own it takes away power from the user. Sure Firefox lets you turn it off, but
425.
by topranks 8y ago
Been doing this a few years, after seeing lots of apps and devices using 8.8.8.8 despite being given my resolver back via DHCP (so obviously hard-coded into them and they’re ignoring os dns.) No practical drawbacks so far, although I have f
426.
by topranks 8y ago
Yep... my apologies.. The blog led me to their "1.1.1.1 app", which I installed and found created a VPN on my iOS device that only tunneled DNS traffic. This "warp" thing, which is not released you can only go on a waiti
427.
by topranks 8y ago
You're absolutely correct, it's new, not in mainline Linux kernel yet etc. I just mentioned it as it's a cool project and in time will help address some of the limitations you mention.
428.
by topranks 8y ago
This is factually inaccurate. Cloudflare do not use the EDNS Client Subnet extension: https://tools.ietf.org/html/rfc7871 You are right to say that can potentially affect geo-located services. But that is not to say t
429.
by topranks 8y ago
How can they do this? Are Cloudflare going to be able to decrypt the TLS sessions running over their VPN between me and end-sites, so they can insert this additional HTTP header? Doesn’t sound feasible.
430.
by topranks 8y ago
Why do you refer to this as a VPN? On my phone my web traffic is being sent direct using this, looks like only DNS queries are sent over the VPN tunnel? Is WARP+ the full VPN ?
431.
by topranks 8y ago
CPU on your phone is probably gonna be the main reason VPN is slower than not using one. But this only sends DNS over the VPN so it won’t use much power at all. 99% of your traffic does not route via the VPN with this app.
432.
by topranks 8y ago
Or put another way - decentralization may be able to offer greater resilience and reachability - but it will never result in better performance or stability.
433.
by topranks 8y ago
CDNs are literally the other thing (aside from Public Cloud providers) that are centralizing the internet. You statement is the exact opposite of reality.
434.
by topranks 8y ago
The vast majority of which are hosted in the public cloud (AWS, GCP, Azure) or behind content delivery networks like Cloudflare or Akamai. The centralization of the internet and death of the “end to end” ethos is very real unfortunately.
435.
by topranks 8y ago
Well right now this only tunnels DNS traffic so it’s not quite the same. You can go on the wait-list for WARP+ which sounds like it’ll route everything over the VPN.
436.
by topranks 8y ago
Multipath-TCP is designed for precisely that.
437.
by topranks 8y ago
Email is decentralized. The only centralized part is the DNS.
438.
by topranks 8y ago
Yeah it’s not part of the TLS 1.3 spec (RFC8446). It’s being added, but early stages. Internet draft is here: https://www.ietf.org/id/draft-ietf-tls-esni-02.txt
439.
by topranks 8y ago
Because the DNS as it is allows for the potential to do something similar (by getting a CA to accept fraudulent DNS response, leading them to issue a cert,) without someone seizing control of a domain otherwise. It makes no sense not to try
440.
by topranks 8y ago
Sure for google.com it’ll fail. But you could do it for many, many others. The reality is that control of a zone is all it really takes for someone to get a cert issued for it. In that context you are most certainly dependent on the accu
441.
by topranks 8y ago
The attack is based on compromising control of the victim’s domain. What’s to stop someone in control of a domain putting records up for 10 days? It’d still happen, just be a delay between compromising the domain and getting the cert is al
442.
by topranks 8y ago
You’d have to somehow redirect / spoof DNS responses to Let’s Encrypt to fool them and make it look like you passed the challenge. Not trivial, but far from impossible for as long as the world maintains that securing the DNS is pointle
443.
by topranks 8y ago
Yeah but if .com is untrustworthy then the game is up. The operator of .com can use their control over it to get a valid TLS cert issued by any number of CAs. So the situation is no different currently, trust in the DNS is essential.
444.
by topranks 8y ago
The CAs, for the most part, only require you prove you control a domain to issue a cert for it. So you’re already trusting the DNS, whether protected with DNSSEC or not, in the existing system.
445.
by topranks 8y ago
Yeah but because they own the TLD they can get X.509 certs issued for any domain under it, because controlling the domain is the only check CAs really perform before issuing a cert for a domain. The DNS is already acting as the root of trus
446.
by topranks 8y ago
If you can’t trust them then the whole thing crumbles anyway. All you need to obtain valid TLS certs for any domain is to make a CA think you control the domain. So the CA’s trust in the DNS root is already functioning as the basis of X.50
447.
by topranks 8y ago
That’s not pure DANE being discussed by a hybrid in which CAs are still playing a role. In pure DANE you need only trust the DNS root.
448.
by topranks 8y ago
There are about 1500 entities in the X.509 game, not 10s.
449.
by topranks 8y ago
That article is peddling bullshit. Yes, DNSSEC is not adopted. But what the intention with it is to stop people hijacking DNS requests (re-routing then to rogue servers for instance,) and then returning spurious answers. That’s a relativel
450.
by topranks 8y ago
Various things happened. Improvements made doing longest-prefix matching in hardware possible for IP routing. MPLS came along which allowed service separation and traffic engineering across a packet switched core. Customers only wanted Et

More ›