Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Running the second public ODoH relay

numa.rs

Post reply on HN
Print view View original

11–20 of 50 posts

Re: Show HN: Running the second public ODoH relay

#11

Post by petcat »

elp wrote: post #10
cedws wrote: post #3

What’s the selling point of ODoH given the low uptake of ECH which means the name of the server you’re talking to is given away anyway?

My, admittedly cynical, view of it is that the main selling point is that you share your data with the person running the ODoH server. The truth is that very very few people run their own recursive nameserver. The entirely reasonable assumption for any authoritative nameserver, like .com, is that the query is being asked on behalf of someone else and knowing that a user of your nameserver asked for the ip of sexyshee…

> your own recursive nameserver

But then the internet can know that you are the one using your own resolvers and so they can trivially identify your traffic.

Really you need to use some public resolver with a critical mass of other users in order to have any hope for anonymity. But then of course you have to trust that resolver too.

Re: Show HN: Running the second public ODoH relay

#12

Post by jeroenhd »

cedws wrote: post #3

What’s the selling point of ODoH given the low uptake of ECH which means the name of the server you’re talking to is given away anyway?

It means you can use a decently fast DNS server like Cloudflare without the major privacy problems of using Cloudflare. Or DNS4EU, or any non-ISP DNS server really.

Your ISP snooping on you with SNI logging is something people using normal ISPs don't need to worry about, but feeding all your data into a profit-driven company is.

Re: Show HN: Running the second public ODoH relay

#14

Post by jeroenhd »

gigatexal wrote: post #6

What would it take to get truly anonymous dns? I guess it’s not really possible no?

You wrap the DNS request in a different layer of encryption than the relay server, so the relay server only knows you tried to resolve something, and the DNS server only knows someone tried to resolve a particular domain. That's how ODoH works.

To make it harder for parties to collude, you need additional encrypted hops, the way Tor does. ODoH doesn't do that, unless you're routing ODoH through Tor of course.

You would also need some kind of proof that the DNS records returned by the resolving DNS server haven't been tampered with, or a tracking DNS server could direct you to one of their IP addresses and proxy the request transparently. Unfortunately, the best solution we have for that is DNSSEC which is a very 90s take on DNS validation. It works fine if you don't abuse DNS in weird ways, but it's due for a redesign.

Re: Show HN: Running the second public ODoH relay

#15

Post by rdme »

fc417fc802 wrote: post #8
rdme wrote: post #5

Earlier quoted context omitted.

They solve different things. ODoH hides your question, not who you're talking to.

Sure ODoH hides your query but you then turn around and leak the question you just asked as part of the TLS handshake.

I agree with you, however that's a separate problem that needs to be solved

Re: Show HN: Running the second public ODoH relay

#16

Post by rdme »

elp wrote: post #10
cedws wrote: post #3

What’s the selling point of ODoH given the low uptake of ECH which means the name of the server you’re talking to is given away anyway?

My, admittedly cynical, view of it is that the main selling point is that you share your data with the person running the ODoH server. The truth is that very very few people run their own recursive nameserver. The entirely reasonable assumption for any authoritative nameserver, like .com, is that the query is being asked on behalf of someone else and knowing that a user of your nameserver asked for the ip of sexyshee…

The relay sees IP + ciphertext, the target sees question + relay's IP. No single party gets both

Re: Show HN: Running the second public ODoH relay

#17

Post by [deleted] »

jeroenhd wrote: post #14
gigatexal wrote: post #6

What would it take to get truly anonymous dns? I guess it’s not really possible no?

You wrap the DNS request in a different layer of encryption than the relay server, so the relay server only knows you tried to resolve something , and the DNS server only knows someone tried to resolve a particular domain. That's how ODoH works. To make it harder for parties to collude, you need additional encrypted hops, the way Tor does. ODoH doesn't do that, unless you're routing ODoH through Tor of course. You wo…

[deleted]

Re: Show HN: Running the second public ODoH relay

#18

Post by petcat »

rdme wrote: post #16
elp wrote: post #10

Earlier quoted context omitted.

My, admittedly cynical, view of it is that the main selling point is that you share your data with the person running the ODoH server. The truth is that very very few people run their own recursive nameserver. The entirely reasonable assumption for any authoritative nameserver, like .com, is that the query is being asked on behalf of someone else and knowing that a user of your nameserver asked for the ip of sexyshee…

The relay sees IP + ciphertext, the target sees question + relay's IP. No single party gets both

What if the relay and target are being operated by the same provider? The relay controls where the question is sent right? They can collude?

Re: Show HN: Running the second public ODoH relay

#19

Post by rdme »

petcat wrote: post #18
rdme wrote: post #16

Earlier quoted context omitted.

The relay sees IP + ciphertext, the target sees question + relay's IP. No single party gets both

What if the relay and target are being operated by the same provider? The relay controls where the question is sent right? They can collude?

no, you are actually telling the relay where to redirect your question from the start (because you are encrypting the question with the public key of the destination resolver) - the relay sending the question where it wants would result in the destination to not be able to decrypt it

Re: Show HN: Running the second public ODoH relay

#20

Post by LoganDark »

jeroenhd wrote: post #12
cedws wrote: post #3

What’s the selling point of ODoH given the low uptake of ECH which means the name of the server you’re talking to is given away anyway?

It means you can use a decently fast DNS server like Cloudflare without the major privacy problems of using Cloudflare. Or DNS4EU, or any non-ISP DNS server really. Your ISP snooping on you with SNI logging is something people using normal ISPs don't need to worry about, but feeding all your data into a profit-driven company is.

> something people using normal ISPs don't need to worry about

It doesn't matter which ISP you're using if the cables are tapped, which they pretty much are.

Post reply on HN