Philip Prindeville wrote:
If you're getting bad resolver addresses from your DHCP server,
aren't you also potentially getting a bad default gateway and hence
setting yourself up for a man-in-the-middle attack?
Man-in-the-middle attacks can be carried out from any computer on any
of the networks that your packets pass through, not just from your
default gateway. For most protocols the way to prevent them is to use
TLS or IPsec. Man-in-the-middle attacks on DNS resolution is prevented
with DNSsec.
Björn Persson