[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]

Re: [tor-relays] HOW-TO: Simple DNS resolver for tor exit operators

To: "tor-relays@xxxxxxxxxxxxxxxxxxxx" <tor-relays@xxxxxxxxxxxxxxxxxxxx>
Subject: Re: [tor-relays] HOW-TO: Simple DNS resolver for tor exit operators
From: tor <tor@xxxxxxxxxxxxx>
Date: Tue, 12 Sep 2017 16:53:53 -0400
Delivered-to: archiver@xxxxxxxx
Delivery-date: Tue, 12 Sep 2017 16:54:17 -0400
Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=anondroid.com; s=protonmail; t=1505249640; bh=HlYBSZK4u3/9+Vy00LEpsRoAX9FiF+EYpC4jYI0bzyE=; h=To:From:Reply-To:Subject:In-Reply-To:References:Feedback-ID:From; b=ZbUzHJ8rRAkEb6yWExqOQS6P42AThg1oaifp+h6fe2b71LLddOIT5xDHc3Q98JZ/N 7xAx5l8M6No/pWmKYMrg5Qq/caYDNa8/tawIOLiKGj2Ftb4tDTREPBMZNV9h7K5UL1 GqtBAWE4GnADf9NV6mj/VmO37Ud2fSu28f+D2AtI=
Feedback-id: VQdg1G6qp6W3q4fwEzBmXgKoBW84CXOSKS975fQJZbjA-mfLf0M16WneIByukYM6Nd1W0yUYpKCBstegtQsR_w==:Ext:ProtonMail
In-reply-to: <2076505303.1710424.1505247083310.JavaMail.zimbra@laposte.net>
List-archive: <http://lists.torproject.org/pipermail/tor-relays/>
List-help: <mailto:tor-relays-request@lists.torproject.org?subject=help>
List-id: "support and questions about running Tor relays \(exit, non-exit, bridge\)" <tor-relays.lists.torproject.org>
List-post: <mailto:tor-relays@lists.torproject.org>
List-subscribe: <https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays>, <mailto:tor-relays-request@lists.torproject.org?subject=subscribe>
List-unsubscribe: <https://lists.torproject.org/cgi-bin/mailman/options/tor-relays>, <mailto:tor-relays-request@lists.torproject.org?subject=unsubscribe>
References: <2076505303.1710424.1505247083310.JavaMail.zimbra@laposte.net>
Reply-to: tor-relays@xxxxxxxxxxxxxxxxxxxx
Sender: "tor-relays" <tor-relays-bounces@xxxxxxxxxxxxxxxxxxxx>

> My idea is designed to protect the exit node against a DNS attack from the

> owner of the DNS server. Not from the ISP or an attacker monitoring the

> traffic going in and out of the ISP data center.

So in this threat model you trust your ISP but not your DNS provider? Why not just use the ISP's DNS then? Combine it with a local caching resolver and call it a day.

I don't really see a compelling use-case for just inserting DNS noise and not following up with IP noise.

I'm interested in things like Google's DNS-over-HTTPS implementation: https://developers.google.com/speed/public-dns/docs/dns-over-https. It encrypts DNS traffic on the wire. There are already some fairly good client-side implementations. However, we need other providers to put up DNS-over-HTTPS endpoints, since no one wants to trust Google.

_______________________________________________
tor-relays mailing list
tor-relays@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays

References:
- Re: [tor-relays] HOW-TO: Simple DNS resolver for tor exit operators
  - From: jpmvtd261

Prev by Author: Re: [tor-relays] Fwd: Your TOR [sic] node
Next by Author: Re: [tor-relays] Individual Operator Exit Probability Threshold
Previous by thread: Re: [tor-relays] HOW-TO: Simple DNS resolver for tor exit operators
Next by thread: Re: [tor-relays] HOW-TO: Simple DNS resolver for tor exit operators
Index(es):
- Author
- Thread