Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
Privacy experts recommend dnscrypt (for example r/privacy). The only advantage of DNScrypt I can see is that it protects against an attacker sniffing my DNS traffic (I am using a VPN anyway) and man-in-the-middle attack (MITM) not possible.
This is a screenshot of my config (Tomato router):
What are the advantages and risks of DNScrypt? Does a DNS operator such as cryptostorm.is have the ability to see my DNS traffic?
The only advantage of dnscrypt I can see is that nobody can sniff my DNS traffic (I am using a VPN anyway) and man-in-the-middle attack (MITM) not possible.
DNSCrypt aims to protect your DNS traffic from not just 'sniffing' (passive) attacks but more importantly active attacks - where the attacker changes the DNS response and maybe point it to the attackers server.
You say MitM is not possible. But it depends where in the process you think you are at at risk. Yes the VPN tunnel is protected (assuming the client is configured to route DNS through the VPN and not the default gateway). In that case you may be correct in assuming you are safe enough for your needs. Remember though the VPN terminator will (in this example) query the DNS for you, so maybe that could be a point of weakness.
risks of DNScrypt?
Risks, biggest is whether you trust installing software on your clients. Whether you trust the software to actually do what it claims. Is the risk of DNS interception worse than the possibility of the software installed causing some adverse effect on your OS?
Does the DNS operator cryptostorm.is see my DNS traffic?
I do not know anything about this service, but if any service you use terminates at the service provider you have to assume they can (probably will) record the traffic in which terminates. Therefore if the DNS connection to them terminates there and they use a resolver then they will know what it is you looked up via DNS.
