New answers tagged

0

This means that websites have little incentive to start supporting DNSSEC, as a MITM can spoof a DNS record simply by not including a signature. This is incorrect. If a MITM attacker sends a result without a signature to a client that supports DNSSEC, the resolve will fail. This is because there is a signed DS record for that domain returned by the TLD's ...


3

DNScrypt encrypts the communication between you and the DNS provider. It hides your DNS queries from anyone trying to wiretap your traffic, but it does not hide your queries from DNS provider itself. The primary benefits I see are in situations where you are on an untrusted network (e.g. public hotspot, censored connection, malicious ISP, etc.) and you ...


1

From here: Disadvantages of DNSSEC DNSSEC can add significant load to DNS servers – increasing costs and reducing efficiency of current DNS systems. It requires significant investment of resources on the part of TLD registry operators, domain name registrars, ISPs and hosting providers. “Bootstrap problem” – a minimum level of ...


4

The Chromium security team say: DNSSEC and DANE (types 2/3) do not measurably raise the bar for security compared to alternatives, and can be negative for security. DNSSEC+DANE (types 0/1) can be accomplished via HTTP Public Key Pinning to the same effect, and with a much more reliable and consistent delivery mechanism. (see https://bugs.chromium.org/...


4

First, I will point out that private information should not be posted in the public domain name system. However, for the obscure case this is actually needed DNSSEC now supports NSEC3 for zones, which prevents this kind of attack (Although is more expensive on the DNS query from my understanding of how NSEC3 works compared to plain NSEC). Edit: Didn't see ...



Top 50 recent answers are included