-1

Contents of government gazette, Linux distributions, Open Data, etc. are public, there are no constraints for "increase user privacy". On the contrary, we want to guarantee transparency... But all tutorials and explanations about DNSSEC are also about internet banking and user privacy: is possible to separate concerns? Is possible to simplify the DNSSEC installation/infrastructure when we need only to enhance public data transference?
(on HTTP, HTTPS, FTP or SFTP downloads and hash integrity confirmations)

The aim of DNSSEC here is only to avoid Man-in-the-middle attacks.

Improve this question
5
  • Why? What exactly do you gain from not offering confidentiality?
    – user163495
    Commented Nov 10, 2020 at 12:21
  • @MechMK1 We gain simplicity, we reduce development and maintenance costs, etc. And with simplicity we also reduce the transaction costs for (infrastructure and bureaucracy) fiscalization.
    – Peter Krauss
    Commented Nov 10, 2020 at 12:28
  • I disagree. Having to create a custom implementation that only gives you one thing instead of using something ready-made adds complexity and increases development costs. DNSSEC offers both Confidentiality and Integrity out-of-the-box - just use it.
    – user163495
    Commented Nov 10, 2020 at 12:34
  • @MechMK1, I agree in part, because this is the question: where the "ready-made DNSSEC light"? it exists?
    – Peter Krauss
    Commented Nov 10, 2020 at 13:28
  • What makes you so adamant about using a "light" version? Why not use the thing that already exists and that works for everybody?
    – user163495
    Commented Nov 10, 2020 at 13:29

1 Answer 1

Reset to default
3

DNSSec does not encrypt traffic, i.e. it is not about privacy at all. DNSSec is only to provide authenticity of the DNS responses. This is done by the authority (domain owner) signing the records. This signature prevent tampering by a man in the middle or replacement by a DNS hijacking ISP or similar. Thus, there is no need for an additional DNSSec-light since DNSSec is already what you propose as DNSSec-light.

I'm not sure where the claims about privacy come from, but I suspect that this got confused with DNS over HTTPS (DoH), DNS over TLS (DoT) or DNSCurve. All of these encrypt the DNS traffic, but DNSSec does not.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .