Re: [DNSOP] DNS privacy and Team Cymru's report on 300, 000 SOHO routers with compromised DNS settings

Andrew Sullivan <ajs@anvilwalrusden.com> Thu, 06 March 2014 23:42 UTC

Date: Thu, 06 Mar 2014 18:42:22 -0500
From: Andrew Sullivan <ajs@anvilwalrusden.com>
To: dnsop@ietf.org
Message-ID: <20140306234221.GA11030@mx1.yitter.info>
References: <CF3EB0AB.69171%york@isoc.org>
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Disposition: inline
In-Reply-To: <CF3EB0AB.69171%york@isoc.org>
User-Agent: Mutt/1.5.21 (2010-09-15)
Archived-At: http://mailarchive.ietf.org/arch/msg/dnsop/pAND5-v4NN-L7NkU7owprNNL7Ts
Subject: Re: [DNSOP] DNS privacy and Team Cymru's report on 300, 000 SOHO routers with compromised DNS settings
Precedence: list

On Thu, Mar 06, 2014 at 11:09:33PM +0000, Dan York wrote:

> this case of the attacker controlling the recursive resolver, I
> don't know that any of the various solutions thrown around today
> would do anything to help with this.  

But this was exactly the question I (among others) was trying to ask
at the mic.  From whom exactly are we trying to protect ourselves?  If
one of the answers is, "our immediate upstream resolver", there's
actually a possible answer to that: either don't have one, or prove
that the one you're talking to is one you can trust.

But to start that discussion, we first have to figure out from whom we
are protecting ourselves.

Best regards,

A

-- 
Andrew Sullivan
ajs@anvilwalrusden.com

[DNSOP] DNS privacy and Team Cymru's report on 30… Dan York
Re: [DNSOP] DNS privacy and Team Cymru's report o… Hosnieh Rafiee
Re: [DNSOP] DNS privacy and Team Cymru's report o… Andrew Sullivan
Re: [DNSOP] DNS privacy and Team Cymru's report o… Paul Wouters
Re: [DNSOP] DNS privacy and Team Cymru's report o… Tony Finch
Re: [DNSOP] DNS privacy and Team Cymru's report o… Niranjan U