<story><title>OpenDNS launches DNSCrypt: secure DNS</title><url>http://www.opendns.com/technology/dnscrypt/</url></story><parent_chain></parent_chain><comment><author>trotsky</author><text>Why bother securing your DNS from eavesdropping when an eavesdropper can easily tell what sites you&apos;re visiting based on your other IP traffic?&lt;p&gt;It seems OpenDNS is interested in this technology only as far as it deflects from people being interested in DNSSEC, an ietf standard. Why don&apos;t they care for DNSSEC? Because it either discourages or prevents DNS poisoning or hijacking (depending on how you set up your client) and Open&apos;s business model relies on hijacking NXDOMAIN DNS responses to  serve ad filled pages.</text></comment>
<story><title>OpenDNS launches DNSCrypt: secure DNS</title><url>http://www.opendns.com/technology/dnscrypt/</url></story><parent_chain></parent_chain><comment><author>peterwwillis</author><text>So a vendor/service provider makes a custom proxy for DNS record encryption and breaks the first rule of cryptography. Granted, they&apos;re basing it on DNSCurve so at least a few other people have looked at the design, but the implementation is custom... I wouldn&apos;t touch this with a 50 foot pole until a dozen PhDs vet it.&lt;p&gt;&lt;i&gt;edit&lt;/i&gt; I didn&apos;t notice libnacl is provided, so I assume a good chunk of the crypto work is done by this. My comments were probably too harsh. But I would still like to see a professional look over the rest of their code to make sure there&apos;s no glaring problems.</text></comment>