Using DNSSEC and DNSCrypt in Debian

http://feeding.cloud.geek.nz/posts/using-dnssec-and-dnscrypt-in-debian/

by ashitlerferad • 10 years ago

27 15 10 years ago

feeding.cloud.geek.nz

wsfull2• 10 years ago

If you are using your own DNS cache listening on a loopback interface, then the risks of "DNS cache poisoning" are not what they are when you use a third party cache like your ISP's, OpenDNS, Google or the ones in the CSV file at the github page referenced in this blog entry.

Unless you are sharing your loopback with the network somehow, one could argue that with a localhost cache the risk is nonexistent.

According to this blog entry the reason for using DNSSEC is to "prevent DNS posioning".

If that is true, and that is what I would expect, and we've minimized the risk of cache poisoning by using a localhost cache exlcusively (no third party caches), then why use DNSSEC?

If there are other reasons, like making centralized control (censorship?) of DNS easier for ICANN, etc., then this blog post has omitted them. Does that imply they are insignificant?

wtallis• 10 years ago

If that is true, and that is what I would expect, and we've minimized the risk of cache poisoning by using a localhost cache exlcusively (no third party caches), then why use DNSSEC?

How have you authenticated that your ISP isn't intercepting DNS requests and serving them out of their own cache that lies?

regularfry• 10 years ago

Connecting to the remote service and validating the ssl cert.

zimbatm• 10 years ago

Where does your local DNS cache gets the record from ? Unless you can verify the information is legit it actually aggravates the problem. Now any MITM can poison your computer for the duration of the cache TTL whereas before they had to maintain the MITM or poison upstream for the same effect.

tptacek5• 10 years ago

DNSCrypt is marginally useful. But don't bother with DNSSEC. It does more harm than good.

http://sockpuppet.org/blog/2015/01/15/against-dnssec/

AndyMcConachie• 10 years ago

Every time there's an article on DNSSEC here I find you bringing out the same mischaracterized arguments against it.

If you are ever in the Washington DC area I would be happy to take you out to dinner/beers and have a long friendly conversation about DNSSEC and why you dislike it so much. I'm completely serious, and I'm paying.

tptacek5• 10 years ago

DNSSEC is a terrible idea, and articles encouraging people to set it up and describing the security benefits that work will bring deserve an informed rebuttal.

If you feel any of my arguments are "mischaracterized", you are welcome to try to rebut them.

totony3• 10 years ago

DNSSEC is useful for SMTP SSL encryption (at least from you to your server).

https://blog.filippo.io/the-sad-state-of-smtp-encryption/

tptacek5• 10 years ago

Nope! They fixed that: there's now SMTP Strict Transport Security, sponsored by Google, Microsoft, and Yahoo. SMTP STS explicitly does not require DNSSEC --- because nobody thinks at-scale DNSSEC is going to happen anymore.

Using DNSSEC and DNSCrypt in Debian

Related Stories