Tag Info

New answers tagged

2

The process of establishing a full trust chain between two system using TLS is the following: 1/ Create or obtain the root CA X509 certificate. 2/ Obtain all intermediate signing authorities. 3/ generate a leaf X509 certificate and have it signed by the authority immediately higher in the trust chain (either an intermediate CA or the root CA if you're using ...


3

Can my competitor bypass this security meassure by sending e-mails from competitor.com using my domain secret.com? Yes, competitor can bypass this, but not easily. Lets say that SPF is "v=spf1 include:spf.mandrillapp.com ~all" This means that I allow server spf.mandrillapp.com to send emails for my domain, while all other will SoftFail (that is the ...


0

An ISP is literally an "internet provider". As such they provide you the wires and equipment to access the global scaled network. Since they are in between you and the rest of the world, you have to assume that anything not encrypted is potentially logged by your ISP. Even if you use Google DNS, the DNS request will be send from your computer, to your ...


0

Since you can see the DNS cache has the poison in it, it sounds like you're doing the poisoning successfully. My best guess: The DNS server the machine running nslookup is configured to use isn't the one that's being poisoned. (In other words, you're poisoning the bind server you set up, but nslookup is causing lookups to, say, your ISP's DNS servers, or ...


2

Short answer: they are only able to log the hosts you visit (e.g. security.stackexchange.com, google.com, etc) and not the full address (e.g. https://stackexchange.com/login). If you access unencrypted webpages (http instead of https), they are able to see everything. ISP are not known to log unencrypted webpages en masse, but I wouldn't not be surprised if ...


0

DNSSEC and DNSCurve essentially do the same thing. They allow a client to verify that the records in a DNS response are identical to what the zone owner initially configured. They're not bulletproof; parent zones, registrars and registries can still do whatever they want with zones they are directly or indirectly authoritative for. But it's still better than ...


1

With DNSSEC and DNSCurve, one can verify that a DNS response contains what the zone owner configured the authoritative servers to serve. The registrar and the parent zone owner can also produce valid DNSSEC signatures. But no one else can. In a perfect world, everything would be signed with DNSSEC or DNSCurve, and everybody would run a validating resolver ...


0

DNSCrypt is based on DNSCurve in part, but they serve different purposes. DNSCrypt encrypts traffic between stub resolvers (your workstation, your browser, etc.) and recursors (like your ISP offers, and like OpenDNS). It gives you confidentiality and integrity between your workstation and the resolving service. DNSCurve sits in another place - between ...


1

Yes, DNSCrypt is in fact a point-to-point tunnel, so it's like encapsulating DNS queries in Elliptic Curve Cryptography provided by curve25519xsalsa20poly1305. See DNSCrypt Proxy TECHNOTES. Regular DNS servers are not equipped to speak DNSCrypt but OpenDNS ones are. So when you change the DNS IP and use DNSCrypt then your dnscrypt-proxy would first try to ...


1

It seems that the idea is to keep the RRs and their signatures close together. RFC 4035, Section 3.1.1, Including RRSIG RRs in a Response 3.1.1. Including RRSIG RRs in a Response When responding to a query that has the DO bit set, a security-aware authoritative name server SHOULD attempt to send RRSIG RRs that a security-aware resolver ...



Top 50 recent answers are included