Use DNSCrypt by default in Kicksecure? (not Whonix!)

[Patrick]

DNSSEC seems more useful in theory. Under the assumption that DNSSEC cannot be stripped similar to sslstrip… [1] [2]

DNSSEC can transmit information signed/authenticated information. (DNSSEC root trust key… [3]) Some such information can be potentially very worthwhile.

• CAA policy:
  • CAA policy is written in DNS which can restrict which CA can issue certificates.
    (DNS Certification Authority Authorization (CAA) Policy / DNSSEC for whonix.org / ssllabs.com test results / OCSP ERROR: Exception: connect timed out [http://r3.o.lencr.org] / Must-Staple)
  • CAA policy is similar to CA pinning. Unfortunately, CAA policy is only consumed by CA authorities to check if they are allowed to issue a certificate for a website. A malicious/hacked CA might ignore it. But then there is nowadays certificate transparency logs so such CA would be spotted and expelled. I recognize that doesn’t help the victims of successful MITM in case of a compromised CA.
  • Unfortunately browsers do not check CAA policy from DNS. [4]
• DANE TLSA [5] [6]
  • In short: use DNS (authenticated by DNSSEC) to authenticate the TLS certificate.
  • Not an option for browsers yet, or ever(?) but perhaps good for mail servers? Didn’t investigate that.
• Other seemingly less important DNS entries such as SPF, DKIM, DMARC.

Can browsers such as Firefox, Chrome, Tor Browser verify DNSSSEC and can these be DNSSEC striped in their current default configuration? If yes, are fixes planned? I mean, if a domain was DNSSEC signed and the signature was stripped, would these browsers reject the connection?

---

[1] Let’s call that DNSSEC strip?
[2]

DNSSEC - How does it protect from an MITM attack?

Non-validating DNSSEC aware client security implications

Opt into strict DNSSEC checking - does DNSSEC provide a way for a zone to request strict signature validation?

Possibility of a DNSSEC attack

What problem does DNSSEC solve?

[3] Ignoring the issue of who is holding the highest hierarchy DNSSEC root signing key. At least it is a different key holder than the many trusted key holders in the TLS CA system.
[4] public key infrastructure - Why don't browsers check CAA records to help ensure a certificate is valid? - Information Security Stack Exchange
[5] Dev/About Infrastructure - Kicksecure
[6]

DANE TLSA (DNS-based Authentication of Named Entities) for whonix.org

Lots of references / notes in the wiki: DANE TLSA For now decided not to implement it due to: low adaption no support in major browsers complex, maintenance demanding setup

@nurmagoz

DNSCrypt/dnscrypt-proxy

dnscrypt-proxy 2 - A flexible DNS proxy, with support for encrypted DNS protocols. - DNSCrypt/dnscrypt-proxy

This tool looks cool for system DNS.

It’s in Debian.
https://packages.debian.org/search?keywords=dnscrypt
Kicksecure was previously enabling it by default. Considering an opt-in package to easily enable it.