Clearly explain why "fallback to insecure" is a terrible idea.

2012-11-16 22:55:57 -08:00
parent 198c622297
commit a2daf52f1c
1 changed files with 11 additions and 2 deletions
@@ -22,8 +22,17 @@
      %ul
        %li If you have a firewall, open TCP and UDP ports 53 and 443.
        %li
-          If you prefer reliability over security, enable fallback to
-          insecure DNS.
+          The "Fallback to insecure" feature automatically disables
+          DNSCrypt when DNS queries are not able to reach OpenDNS. This usually
+          happens on public WiFi networks that require going through a captive
+          portal before you can access external networks.
+          This function is only provided for conveniency.
+          When enabled, the protocol can be easily downgraded by
+          third-parties. In other words, when enabled, this software doesn't
+          provide any security at all against active attackers, but it can
+          still be useful against passive attackers and in order to bypass
+          DNS censorship. Don't enable it unless you are frequently
+          roaming and you don't want to manually disable/enable DNSCrypt.
        %li
          The FamilyShield service blocks pornographic content,
          including OpenDNS "Pornography", "Tasteless" and "Sexuality"