[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]

Re: [tor-talk] DNSSEC better protecting users?

To: tor-talk@xxxxxxxxxxxxxxxxxxxx
Subject: Re: [tor-talk] DNSSEC better protecting users?
From: Nicolai <nicolai-tortalk@xxxxxxxxxxxxxxx>
Date: Sun, 11 Jan 2015 22:05:39 +0000
Delivered-to: archiver@xxxxxxxx
Delivery-date: Sun, 11 Jan 2015 17:48:14 -0500
Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=iastate.edu; h=date:from:to:subject:message-id:references:mime-version:content-type:in-reply-to; s=20140630key1.its; bh=+8nxuQos/CRnm9D2l/hUFFgJXVPMSG0ONmuHaz6/g8c=; b=CLlYpVaAscZkloPdsWIIwV85WYKS4TU+O1mpB5f4j8/Drf1DrMju/Rc4EDug5BWB0LwilVE4lGpys+g2dKGuJ0SZjE93O/isW7VunaY3u382YF66a5dt4sNKRkkM/XAWt2eNbrdlYZTuzZ/KLb94BkKsV6rwnVtzKGvk73GZNec=
In-reply-to: <CADop2NGrjgJRkfM+C0PxEC10mQk+zJ1sSOEe-vT2ePOmX2KzkQ@xxxxxxxxxxxxxx>
List-archive: <http://lists.torproject.org/pipermail/tor-talk/>
List-help: <mailto:tor-talk-request@lists.torproject.org?subject=help>
List-id: "all discussion about theory, design, and development of Onion Routing" <tor-talk.lists.torproject.org>
List-post: <mailto:tor-talk@lists.torproject.org>
List-subscribe: <https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk>, <mailto:tor-talk-request@lists.torproject.org?subject=subscribe>
List-unsubscribe: <https://lists.torproject.org/cgi-bin/mailman/options/tor-talk>, <mailto:tor-talk-request@lists.torproject.org?subject=unsubscribe>
References: <CADop2NGrjgJRkfM+C0PxEC10mQk+zJ1sSOEe-vT2ePOmX2KzkQ@xxxxxxxxxxxxxx>
Reply-to: tor-talk@xxxxxxxxxxxxxxxxxxxx
Sender: "tor-talk" <tor-talk-bounces@xxxxxxxxxxxxxxxxxxxx>

On Sat, Jan 10, 2015 at 12:54:23AM -0800, Virgil Griffith wrote:

> In particular, I am concerned about what subdomain a user is visiting
> being leaked.

DNSSEC is not encrypted, so it leaks everything -- even data that normal
DNS doesn't.

> Are there any established ways of preventing the subdomain from being
> leaked?

The best way currently is to use DNSCrypt, which encrypts DNS queries
and responses.  It's originally from OpenDNS, although there are other
providers that support DNSCrypt also.  With DNSCrypt, only the provider
sees your queries, instead of the provider + anyone listening in.

Note this is only the DNS angle to your question.  (Katya mentions HTTPS
SNI).

Nicolai
-- 
tor-talk mailing list - tor-talk@xxxxxxxxxxxxxxxxxxxx
To unsubscribe or change other settings go to
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk

Follow-Ups:
- Re: [tor-talk] DNSSEC better protecting users?
  - From: l.m

References:
- [tor-talk] DNSSEC better protecting users?
  - From: Virgil Griffith

Prev by Author: Re: [tor-talk] GSOC 15
Next by Author: [tor-talk] Libevent vulnerability CVE-2014-6272 - Tor affected?
Previous by thread: Re: [tor-talk] DNSSEC better protecting users?
Next by thread: Re: [tor-talk] DNSSEC better protecting users?
Index(es):
- Author
- Thread