This also shows a weakness in DNS. There is currently no
way to validate the DNS record you’re being served is what
the person hosting the website intended.
That's what DNSSEC is for, but it hasn't become pervasive enough yet to be able to depend on it.
Strangely enough, the largest deployment of DNSSEC-enabled, customer-facing, recursive/caching nameservers in the United States is... Comcast. That's right, the same Comcast that, back in 2009, hijacked NXDOMAIN responses by default and returned A records pointing to servers that served up advertisement-laden search pages over http.
Comcast's IPv6 network for content from Netflix or YouTube is actually better than using IPv4. A while back I set up an IPv6 only machine just to see the difference, and it is night and day.
That being said, their network still leaves something to be desired, the IPv6 routes taken to get to the same IPv6/IPv4 host can sometimes be circuitous and I have noticed that they have a higher latency too. So there are upsides and downsides, but I hope it can only get better with time!
Sadly DNSSEC kinda sucks. Here's some earlier discussion on HN, with a lot of links. (Namedrop: tptacek is against DNSSEC and talks about it in the link.)
TLDR: DNSSEC is kinda complex and hacko, doesn't protect you as much as you might think, and introduces a whole new PKI that you should probably trust even less than the current ones. But read the links above for the real story.
I'm using DNSCrypt right now, which (correct me if I'm wrong) protects against DNS interception by my ISP, and seems like a whole lot less trouble than DNSSEC.
Your ISP can still see the IP address of every web server that you connect to, and can still see the "Host" header that your browser sends in HTTP requests, and also in HTTPS requests (due to SNI) if you're using a reasonably modern OS/Browser combo.
All you've done is add an additional third party that can view and log what you're doing.
I did not forget that. The privacy lost is worse than the supposed "protection" gained by using DNSCrypt. "Trashy" ISPs can (and do) still intercept and modify the HTTP traffic even if they can't intercept and modify the DNS traffic.
Comments
Strangely enough, the largest deployment of DNSSEC-enabled, customer-facing, recursive/caching nameservers in the United States is... Comcast. That's right, the same Comcast that, back in 2009, hijacked NXDOMAIN responses by default and returned A records pointing to servers that served up advertisement-laden search pages over http.
I was also impressed to see that my Comcast connection uses IPv6. Turns out they have (or will have) one of the the largest IPv6 network in the world - http://gigaom.com/2013/11/27/comcast-xfinity-broadband-is-no...
Comcast's IPv6 network for content from Netflix or YouTube is actually better than using IPv4. A while back I set up an IPv6 only machine just to see the difference, and it is night and day.
That being said, their network still leaves something to be desired, the IPv6 routes taken to get to the same IPv6/IPv4 host can sometimes be circuitous and I have noticed that they have a higher latency too. So there are upsides and downsides, but I hope it can only get better with time!
Sadly DNSSEC kinda sucks. Here's some earlier discussion on HN, with a lot of links. (Namedrop: tptacek is against DNSSEC and talks about it in the link.)
https://news.ycombinator.com/item?id=5937004
TLDR: DNSSEC is kinda complex and hacko, doesn't protect you as much as you might think, and introduces a whole new PKI that you should probably trust even less than the current ones. But read the links above for the real story.
I'm using DNSCrypt right now, which (correct me if I'm wrong) protects against DNS interception by my ISP, and seems like a whole lot less trouble than DNSSEC.
DNScrypt only protects from your host to your nameserver. Your nameserver can still be poisoned as it queries other nameservers.
dnssec protects mostly from poisoning between nameservers. It does little to protect between a host and their namserver.
But in reality dnssec is not a solution, it's a problem. It will never be adopted in a meaningful way without major overhaul in spec.
"protects against DNS interception by my ISP"
Your ISP can still see the IP address of every web server that you connect to, and can still see the "Host" header that your browser sends in HTTP requests, and also in HTTPS requests (due to SNI) if you're using a reasonably modern OS/Browser combo.
All you've done is add an additional third party that can view and log what you're doing.
You forgot the part where it's protecting against trashy ISPs like the one in this article.
I did not forget that. The privacy lost is worse than the supposed "protection" gained by using DNSCrypt. "Trashy" ISPs can (and do) still intercept and modify the HTTP traffic even if they can't intercept and modify the DNS traffic.