Hacker News Reader

Comment by drenginian | Hacker News Reader

>> We invented DNSCrypt. There’s also DNS over TLS. Lots of ways to encrypt DNS without centralization.

Ummm so what’s the downside then? Are those services arcane and hard to use and utterly forbidding blackest black magic, like almost all crypto stuff?

If you’re thinking browser users will just do this then that then this and x and y and z to “get dns crypto going”, then I’ll take Mozilla’s “it just works” approach.

It’s a much much better approach for the browsers to implement it rather than wait for everyone’s operating system to implement secure dns because that’ll happen .... well I can’t imagine any time in the future you could say everyone’s OS is using crypto DNS, whereas if browsers implement it for themselves, instant massive adoption.

View on HN

Not sure what any of your reply means. Adding OS support isn’t required. People just run a local resolver that supports these things. No different than any other application. Nothing arcane. Certainly no more than HTTP and SSL.

I think you have some reading to do.

>> People just run a local resolver that’s support’s these things.

Nowhere do “people just run a local resolver”. Grandma and aunty Beryl certainly don’t, nor does any other ordinary person. If you want secure DNS you have to build it in to the browser.

Only systems people think that this is the sort of thing that ordinary people do.

Does Grandma have a small WiFi router that her cable modem is plugged into? Well that device provides local DNS for her.

Not true. In the default case, Grandma's wifi router is just passing along -- via DHCP -- the IP address of the cable company's DNS resolver to Grandma's computer. Which the wifi router itself probably obtained via DHCP or a similar mechanism from the modem. This is in no sense a "local DNS resolver."

If Grandma has a grandchild that knows how to set up a PiHole, it's a different story. But that's certainly not the majority of Grandmas or the majority of wifi routers.

I think the better solution is "build it into the browser and wait for systems to support it natively".

So exactly what Mozilla is doing.

>* People just run a local resolver that supports these things.*

How many people do you know that running local resolvers? How would this even work on Windows?

The world doesn’t need another encrypted dns solution that only works on Linux

How would this even work on iOS?

You write a network extension, which is what Cloudflare did for their 1.1.1.1 app.

You can literally do the same with DoH.

Reply on news.ycombinator.com