Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Sadly DNSSEC kinda sucks. Here's some earlier discussion on HN, with a lot of links. (Namedrop: tptacek is against DNSSEC and talks about it in the link.)

https://news.ycombinator.com/item?id=5937004

TLDR: DNSSEC is kinda complex and hacko, doesn't protect you as much as you might think, and introduces a whole new PKI that you should probably trust even less than the current ones. But read the links above for the real story.

I'm using DNSCrypt right now, which (correct me if I'm wrong) protects against DNS interception by my ISP, and seems like a whole lot less trouble than DNSSEC.



DNScrypt only protects from your host to your nameserver. Your nameserver can still be poisoned as it queries other nameservers.

dnssec protects mostly from poisoning between nameservers. It does little to protect between a host and their namserver.

But in reality dnssec is not a solution, it's a problem. It will never be adopted in a meaningful way without major overhaul in spec.


"protects against DNS interception by my ISP"

Your ISP can still see the IP address of every web server that you connect to, and can still see the "Host" header that your browser sends in HTTP requests, and also in HTTPS requests (due to SNI) if you're using a reasonably modern OS/Browser combo.

All you've done is add an additional third party that can view and log what you're doing.


>All you've done is add an additional third party that can view and log what you're doing.

You forgot the part where it's protecting against trashy ISPs like the one in this article.


I did not forget that. The privacy lost is worse than the supposed "protection" gained by using DNSCrypt. "Trashy" ISPs can (and do) still intercept and modify the HTTP traffic even if they can't intercept and modify the DNS traffic.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: