Re: debcheckroot v2.0 released

[Elmar Stellnberger <estellnb@elstel.org>]

Am 04.04.20 um 00:46 schrieb Lee:
> On 4/3/20, Elmar Stellnberger <estellnb@elstel.org> wrote:
> > Encryption can be a source of arbitrary code execution exploits if not
> > implemented properly. Encrypting DNS would have other application
> > purposes and makes sense as long as you use a proxy. If you connect
> > directly hiding the domain name is ineffective because someone who spys
> > at the connection also knows the IPs you connect to and via SNI the
> > cleartext of the domain you surf at.
>
> Yes, but "trusting the answer" and "keeping my communications private"
> are not quite the same thing.  If we're talking about "trusting the
> answer" I'll take DoT or running my own dnssec enabled resolver.  When
> I'm more concerned about "keeping my communications private" I'll take
> TOR & accept the trade-off of slower speed.

  I think we have to separate two issues here: authenticity asserting 
that the answer is correct and confidentiality asserting that no one 
else knows about a message. Signing asserts authenticity while 
encryption can guarantee confidentiality. With GnuPG encrypted messages 
are also signed by default so that both features are provided. That does 
not tell however that both issues are clearly separated. Encryption by 
itself does not contribute anything to the authenticity of a reply, i.e. 
you do not know from whom it came. With signing the correctness of an 
answer can be asserted but the answer itself can be read in cleartext by 
everyone unless it is additionally encrypted.