Why is DNS a thing? And why is it integrated the way it is with the web infrastructure.

Question

I understand how it makes everything easy to use and probably has some branding implications but it’s a major source of exploits. We have used phone numbers before and while a b inconvenient wouldn’t using IP addresses directly be much more secure. Or the very least using some decentralized framework rather than DNS servers

In: 2

Answer 1

As far as a decentralised framework goes… DNS is already decentralised in a way, but not the way you mean – and looking at why is important.

Whenever a device makes a DNS query, it doesn’t go directly to a major server. The most common process is that first, it checks if it has that domain cached. Then, if it doesn’t, it asks the router – which checks if *it* has the domain cached. If it doesn’t, it goes to your ISP, and so forth until reaching a root server.

Now, imagine changing what happens at the router step. Rather than trying to make it hierarchical, it goes with the decentralised route and asks *every* device it’s connected to if it knows that domain, and somehow propagates out until it gets an answer. Rather than each request causing four packets for any device in the chain (one coming in with the request, one going out with the request, one coming in with the answer and one going out with the answer), we easily create dozens or hundreds, multiplying the traffic by massive amounts and heavily stressing the network.

The privacy, man in the middle and similar exploits can all be fixed, by encrypting DNS queries and making a new version of the standard with privacy in mind… But that’s hard to actually get moving. HTTPS was invented in 1994, formally specified in 2000, and it didn’t wee massive adoption until a massive push by the EFF and web browsers in 2016 – and HTTP contains even more important data! IPv6 has been usable since 2008 at the latest, with many devices and OSes supporting it from 2011 or earlier… And yet a lot of people still don’t have IPv6 service, and many sites don’t have IPv6. Making people swap is hard – and making them swap DNS protocol would mean upgrading or updating routers, which many don’t know how to do.