Subject: [dns-privacy] Why authentication and encryption are essential

From: Phillip Hallam-Baker <[email-masked]>
Date: Sun, 7 Sep 2014 08:34:33 -0400

I currently have the home network set up so that the DNS servers are
set to 8.8.8.8 and 8.8.4.4

So I was rather surprised when I looked up a site and received a
Verizon search page.

Seems that they are intercepting ALL external DNS and sending their
own responses when they see an NXDOMAIN.

---

From: Andrew Sullivan <[email-masked]>
Date: Sun, 7 Sep 2014 11:00:58 -0400

> own responses when they see an NXDOMAIN.

Yes, some networks do that.

What makes you think that privacy will help?  Why isn't it more likely
that Verizon will just intercept anything on port 53 and break it
anyway?  Unless we tunnel everything on the Internet in a single port
(443?) and thereby foil all analysis by operators, both legitimate and
otherwise, I don't see that there's any way to defend against
Verizon's activities.  It seems to me that there are possible
downsides to that, too.

Also, of course, Verizon's strategy would be totally broken in the
face of DNSSEC, because everything they returned would show up as
bogus.  I think (I'm speculating, note) that fact was one of the
reasons Comcast decided they had to ditch this sort of nonsense some
years ago.

Best regards,

A

-- 
Andrew Sullivan
[email-masked]

---

From: Phillip Hallam-Baker <[email-masked]>
Date: Sun, 7 Sep 2014 14:38:35 -0400

> Verizon's activities.  It seems to me that there are possible

Lets face it, port 53 is hopelessly compromised.

I don't want to run everything over port 443 either. But I am happy
with a scheme where I use a randomly assigned UDP port with fallback
to port 443 if the network attempts to block.