← Back to context

Comment by gerdesj

11 hours ago

The thing about DNS is that you can do your own investigations, rather than rely on rumour and innuendo. You can query their DNS and anyone else you can get at and compare results. You can use a VPN to appear to come from somewhere else or ask a friend to perform a query on your behalf.

You can literally [sigh] be your own journalist in this regard. All you need is a DNS query tool. I recommend dig but you might only have nslookup available out of the box.

Now, this UK intelligence thing. Even if James Bond Q's mates were actually running a DNS system you can still query it and compare it to someone else's view of the internet, say 1.1.1.1 or 8.8.8.8 or whatever.

You can also go to the source, ie root: . and work your own way down to decide on what is what.

Let's have a go at an analogy: DNS is (not really) a bit like a topographical map. You could buy your maps from DodgyRussianMaps'R'us and be surprised that Ukraine has somehow been subsumed by a bunch of murderous wankers. On the other hand you might buy your maps from HonestJonOffOfFaceb00c and note that it isn't. You can, of course, ask for a few other opinions and make up your own mind.

My real point is that DNS is actually quite hard to tamper with, without breaking so many things that everyone can know it is being messed with. When an org resorts to fiddling with DNS they've already lost whatever argument is to be had.

4 comments

gerdesj

Reply
echoangle  33 minutes ago

It’s like buying a dodgy map, except the map pulls updates every time you use it. You could very well provide DNS for free and get everyone to use it and then suddenly serve tampered responses at some specific time and use that until everyone affected notices and switches.

And also you can just serve DNS normally and get the intelligence.

fonix232  10 hours ago

I think you fundamentally misunderstood the potential issue.

Sure, on a reply based approach you can audit a DNS service.

But that doesn't tell you about other things like "is my DNS provider also providing intelligence agencies with my entire DNS query history?". The issue isn't "oh no the MI6 can redirect my PornHub link to anothe site", but "oh no the MI6 knows every single webpage I visited". Which is a valid worry given the current British political climate.