Another way to put it: what is the root of trust for a full client on a network that has a potentially untrusted (or "owned") router+DNS?
As I was going through the ethereum wiki semi-randomly, I came across this, it says:
"[...] it allows a node given only the last block, together with some assurance that the last block actually is the most recent block, to [...]".
Similarly, this says:
"[...] if a node receives a state root from a trusted source [...]".
I am trying to understand where that assurance comes from or why I should trust that source. I'm trying to figure out how much a knowedgeable attacker can do to me if he "owns" the DNS and/or router I am using.
The traditional protection against this is PKI. Yes, PKI is imperfect, there are too many CAs in the browser, lack of trust agility (I've read/watched many of Moxie Marlinspike's posts/talks), and several other issues, but for what it is worth, it is there, and under specific conditions, with the proper TLC, can do the job.
I just don't know what's the equivalent here, or even if there is one at all.
Edited to add:
I don't have enough rep to comment, but to Ethan: authenticated encryption prevents MITM only if you already know whom you are talking to; in this case we don't know that for sure. (Which is why I mentioned PKI as the thing to compare against, despite its flaws).
To A. Frederick Dudley: thank you! "confirm the state root out of band" is what I was thinking; appreciate the confirmation.