youpay
Infrastructure
dns tunneling
SHOW HN2023
143points
91comments
#443of 3,109 in 2023
Top 15%of 2023 by points
How HN took it
MixedNo clear lean
3 positive, 9 neutral or asking, 0 mixed, 9 critical, out of 21 comments about the project. Thread score -0.23.
Privacy: 0 for, 8 againstIdea: 2 for, 1 against
The thread, comment by comment
Each row is a top-level comment and its replies, in HN's order. Select a cell to open that comment on HN.
positive neutral or mixed critical about another commenter or something else the maker
What HN said
What people liked
Interesting or fun DNS hack; DNS is used as intended
From 2 comments
It was pretty common for orgs to use TXT and HINFO (“host info”) records up through the 1990s. I still use them at work to provide hints and more information but the current…
runjake on HNIt's always amusing to see DNS "hackery"[1] like this, and always makes me go back to DNS Toys (https://www.dns.toys/), which generated a huge discussion on HN a year ago [2] ---…
madmax108 on HN
Objections
DNS is insecure and unencrypted; TXT records can be spoofed or intercepted
From 3 comments
You could also securely hash a username and password together with something like argon2ID, and then authenticate users by seeing if the base64'ed TXT record exists. No need to…
gunapologist99 on HNThat is... interesting that they do not even use HTTPS or any type of signature for that info. So a man in the middle could prevent updates from happening, and freshclam wouldn't…
hannob on HNclamav.net, like most domains, doesn't enable DNSSEC. Further, as designed, local resolvers don't validate DNSSEC, they just ask the recursive resolver to; a MITM between the…
toast0 on HN
DPI and DNS monitoring make this easy to detect
From 3 comments
DPI will make short work of your unencrypted DNS records..
breakingcups on HNOP, this is trivial to detect. DNS command and control is a thing malware/attackers use which among other things include TXT records,DoH, long A or AAAA records and many other…
badrabbit on HNA word of caution, don't try this in a corporate environment. Many corporate firewalls will generate security alerts on high DNS request rates. PaloAlto PAN's specifically have…
LinuxBender on HN
Captive portals and censors can hijack DNS queries
From 2 comments
"Like when one of the parties is under severe censorship." What if the censor hijacks DNS queries. This is also done outside the realm of censorship, e.g., hotel wifi networks.
1vuio0pswjnm7 on HNRelying on DNS is not recommended when under severe censorship
candiddevmike on HN
Questions
Whether DNSSEC would prevent tampering
From 2 comments
Won't DNSSEC prevent MITM attacks in this case? From https://en.wikipedia.org/wiki/Domain_Name_System_Security_Extensions - "DNSSEC can protect any data published in the DNS,…
mrweasel on HN> DANE and DNSSEC are horrible bodges that don't actually do anything useful or in a secure way. Adoption is extremely poor, usability is horrible, and the approach used is quite…
8organicbits on HN
Alternatives named
iodine for IP over DNS
From 2 comments
The iodine protocol allows bi-directional ipv4 traffic over DNS. https://github.com/yarrick/iodine
Hnrobert42 on HNGet ready for iodine https://github.com/yarrick/iodine Or IP-over-DNS
mobilio on HN
SoftEther VPN over DNS or ICMP
From 1 comment
Not a proxy but SoftEther VPN supports connection over DNS and/or ICMP. This is meant for circumventing firewalls.…
xyx0826 on HN
DNS Toys
From 1 comment
It's always amusing to see DNS "hackery"[1] like this, and always makes me go back to DNS Toys (https://www.dns.toys/), which generated a huge discussion on HN a year ago [2] ---…
madmax108 on HN
Hesiod
From 1 comment
I am just stopping by to say that this is actually a thing. It is called hesiod and works great in small, maybe air-gapped networks. As a side note, anything security related…
puppetmaster on HN