<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">On Oct 7, 2019, at 10:45 AM, Jim <<a href="mailto:mysidia@gmail.com" class="">mysidia@gmail.com</a>> wrote:<div><blockquote type="cite" class=""><div class=""><span style="caret-color: rgb(0, 0, 0); font-family: Menlo-Regular;" class="">My suggestion would be ultimately that DNS Clients implement DNSSEC</span></div></blockquote></div><div><blockquote type="cite" class=""><div class=""><span style="caret-color: rgb(0, 0, 0); font-family: Menlo-Regular; font-size: 10px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; float: none; display: inline !important;" class="">validation themself to avoid tampering by a malicious client </span><span style="caret-color: rgb(0, 0, 0); font-family: Menlo-Regular;" class="">on their network</span></div></blockquote><blockquote type="cite" class=""><div class=""><span style="caret-color: rgb(0, 0, 0); font-family: Menlo-Regular; font-size: 10px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; float: none; display: inline !important;" class="">for phishing purposes or a malicious recursive DNS Resolver server</span></div></blockquote><div><br class=""></div><div>Yep. That is (IMHO) the right (only) answer to actually fix the ‘lying’ problem instead of making it “someone else’s problem", although that turns lies into DoS when all you get back from your resolver is unvalidatable answers. </div><div><br class=""></div><div>To solve this problem, browser vendors really should implement validation in their stub resolvers. This would have the benefit that if validation fails, a useful error message could be presented to the user (e.g., “the website name you looked up has been tampered with!”). Instead, they have chosen to rely on their “trusted recursive resolvers” to not lie to them and use agreements rather than code.</div><div><br class=""></div><div>This, of course, doesn’t stop the snooping/metadata collection problem.</div></div><br class=""><style class="">ul[class*='mb-extra__public-links'], ul[class*='mb-note__public-links'], ul[class*='mb-task__public-links'] { display: none !important; }</style><div class="">Regards,</div><div class="">-drc</div><div class=""><br class=""></div></body></html>