(www.bastionzero.com)

656 points EthanHeilman | 1 comments | 27 Jan 22 15:06 UTC | HN request time: 0.24s | source

Show context

scarmig ◴[27 Jan 22 20:37 UTC] No.30106234[source]▶

This sounds really beautiful, and I am saving the link for future reference.

I'm curious about the DNS encryption recommendation. My impression was that DNSSEC was kind of frowned upon as doing nothing that provides real security, at least according to the folks I try to pay attention to. Are these due to differing perspectives in conflict, or am I missing something?

replies(3): >>30106250 #>>30108627 #>>30110377 #

dsr_ ◴[27 Jan 22 20:38 UTC] No.30106250[source]▶

>>30106234 #

DNS over TLS and DNS over HTTP/TLS.

replies(1): >>30108450 #

1. nybble41 ◴[27 Jan 22 23:17 UTC] No.30108450[source]▶

>>30106250 #

DoT and DoH only encrypt the connection to the recursive resolver, more for privacy than security. You still need DNSSEC to authenticate the results.

↑

I read the federal government’s Zero-Trust Memo so you don’t have to