Hacker News Reader

You also could run your own DNS resolver on your local device and do the DNSSEC validation there.

One example of this bundled up in a way that is easy to install is DNSSEC-Trigger: https://nlnetlabs.nl/projects/dnssec-trigger/

More info in this blog post from Red Hat: http://developerblog.redhat.com/2015/04/14/writing-an-applic...

View on HN

Only if your ISP doesn't molest DNS packets. More importantly: this only works for a small set of nerds; it doesn't scale to every user on the Internet --- this is the worst kind of "insecurity for thee not me". For refusing to make compromises like this, and instead insisting that sound cryptography be made available to all users, Moxie and Trevor just won the Levchin Prize at RWC.

Notice also that Signal provides a massive amount of cryptographic security to billions of people without needing a PKI controlled at its roots by world governments.

Reply on news.ycombinator.com