> \On Mar 29, 2018, at 7:27 AM, Brian Kantor <br...@ampr.org> wrote:
> 
> On Thu, Mar 29, 2018 at 09:08:38AM -0500, Chris Adams wrote:
>> I've never really understood this - if you don't trust your ISP's DNS,
>> why would you trust them not to transparently intercept any well-known
>> third-party DNS?
> 
> Of course they could.  But it's testable; experiments show that they
> aren't doing so currently.

Experiments may show that in some tested cases they aren’t, but in the big 
picture, yes, there are ISPs who are internally capturing 8.8.8.8, and who try 
to do the same with 9.9.9.9.  Which is why it’s so important to do 
cryptographic validation of the server and encryption of the transport, as well 
as DNSSEC validation.

                                -Bill

Attachment: signature.asc
Description: Message signed with OpenPGP

Reply via email to