From a2daf52f1ca8811d4084edeceec0810dbc62561b Mon Sep 17 00:00:00 2001 From: Frank Denis Date: Fri, 16 Nov 2012 22:55:57 -0800 Subject: [PATCH] Clearly explain why "fallback to insecure" is a terrible idea. --- .../DNSCrypt/extra/html/about.haml | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) diff --git a/DNSCrypt-Preference-Pane/DNSCrypt/extra/html/about.haml b/DNSCrypt-Preference-Pane/DNSCrypt/extra/html/about.haml index dee1e7f..4c55eb5 100644 --- a/DNSCrypt-Preference-Pane/DNSCrypt/extra/html/about.haml +++ b/DNSCrypt-Preference-Pane/DNSCrypt/extra/html/about.haml @@ -22,8 +22,17 @@ %ul %li If you have a firewall, open TCP and UDP ports 53 and 443. %li - If you prefer reliability over security, enable fallback to - insecure DNS. + The "Fallback to insecure" feature automatically disables + DNSCrypt when DNS queries are not able to reach OpenDNS. This usually + happens on public WiFi networks that require going through a captive + portal before you can access external networks. + This function is only provided for conveniency. + When enabled, the protocol can be easily downgraded by + third-parties. In other words, when enabled, this software doesn't + provide any security at all against active attackers, but it can + still be useful against passive attackers and in order to bypass + DNS censorship. Don't enable it unless you are frequently + roaming and you don't want to manually disable/enable DNSCrypt. %li The FamilyShield service blocks pornographic content, including OpenDNS "Pornography", "Tasteless" and "Sexuality"