Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

DNS over HTTPS

github.com

Post reply on HN
Print view View original

41–50 of 195 posts

Re: DNS over HTTPS

#41

Post by vectorEQ »

people invented other security things inside of dns protocol to avoid having the added bandwidth. i dont think it's reasonable to say that everyone can handle the increased load nowadays.

However, i've been thinking of this, for enterprise, you could build a dns server which servers over TLS connections, and then put a local dns proxy on clients which receives on 127.0.0.1 and sends out tls to the custom dns server. That way any local network connections would be encrypted to passive listeners on the network.

recursive queries would go onto the internet plaintext to 'normal' dns servers.

Re: DNS over HTTPS

#42

Post by barrkel »

vectorEQ wrote: post #36
kodablah wrote: post #29

Earlier quoted context omitted.

"My mining algorithm, which uses a lot more CPU and memory, is more performant." The key being that performant is often associated w/ speed (i.e. higher performing) whereas efficient ambiguously can refer to many things you have improved on.

'performs more [efficiently|accuratley]' would be proper english (not that i speak it well.... :D). webster says: "performant" The word you've entered isn't in the dictionary. Click on a spelling suggestion below or try again using the search bar above. preformant performance performing performances performable preformants perforate conformant perform formant performed informant performer perforata performers perform…

The algorithm doesn't perform more efficiently or accurately, though - it's less efficient (it uses more resources) and it should be the same accuracy (or we're comparing apples with oranges).

Re: DNS over HTTPS

#43

Post by jopsen »

kuschku wrote: post #20

So what use does this have? DNSSEC already gives us validation of the records, and thanks to SNI, this doesn't give us any privacy. It is more complex, more centralized, and ends up slower than using actual DNS, and doesn't seem to provide any benefits. Am I missing something?

don't you think SNI leaks will get fixed eventually?

Re: DNS over HTTPS

#44

Post by kuschku »

jopsen wrote: post #43
kuschku wrote: post #20

So what use does this have? DNSSEC already gives us validation of the records, and thanks to SNI, this doesn't give us any privacy. It is more complex, more centralized, and ends up slower than using actual DNS, and doesn't seem to provide any benefits. Am I missing something?

don't you think SNI leaks will get fixed eventually?

No. All actors currently involved with the web are ideologically opposed to backwards incompatible changes, and, as a result, they'd never make a change that prevents a browser from accessing a legacy site.

As result, SNI is here to stay.

Re: DNS over HTTPS

#45

Post by alien_at_work »

I really hope this doesn't catch on widely. It should be a tool for use where censorship issues can't be solved politically.

Otherwise, why even have protocols at all? Just say the only protocol is HTTP. IP, etc. are just an HTTP implementation detail.

Re: DNS over HTTPS

#46

Post by [deleted] »

vectorEQ wrote: post #36
kodablah wrote: post #29

Earlier quoted context omitted.

"My mining algorithm, which uses a lot more CPU and memory, is more performant." The key being that performant is often associated w/ speed (i.e. higher performing) whereas efficient ambiguously can refer to many things you have improved on.

'performs more [efficiently|accuratley]' would be proper english (not that i speak it well.... :D). webster says: "performant" The word you've entered isn't in the dictionary. Click on a spelling suggestion below or try again using the search bar above. preformant performance performing performances performable preformants perforate conformant perform formant performed informant performer perforata performers perform…

[deleted]

Re: DNS over HTTPS

#47

Post by vectorEQ »

barrkel wrote: post #42
vectorEQ wrote: post #36

Earlier quoted context omitted.

'performs more [efficiently|accuratley]' would be proper english (not that i speak it well.... :D). webster says: "performant" The word you've entered isn't in the dictionary. Click on a spelling suggestion below or try again using the search bar above. preformant performance performing performances performable preformants perforate conformant perform formant performed informant performer perforata performers perform…

The algorithm doesn't perform more efficiently or accurately, though - it's less efficient (it uses more resources) and it should be the same accuracy (or we're comparing apples with oranges).

haha yah i know, it would perform terrible. imagine running a big dns server at ISP level, and having to perform 9 million tls handshakes a second. have fun with that lol. this was just an example of how to avoid the 'performant' word.

Re: DNS over HTTPS

#48

Post by deathanatos »

tylerhou wrote: post #34
_0w8t wrote: post #27

I can see how DNS over HTTPS addresses security, but I do not see how it helps with privacy. After resolving the IP address over secure connection HTTPS still sends the host name unencrypted, so one can just eavesdrop on that. And if encrypted DNS becomes widespread, I suspect that various state-imposed firewalls like one Russia will just look for HTTPS connection header to block a particular site.

> After resolving the IP address over secure connection HTTPS still sends the host name unencrypted Correct me if I'm wrong, but I'm pretty sure the host name is generally only sent in an HTTP header, which should be encrypted over HTTPS. https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Ho...

In TLS, the server will send its certificate — and thus the domain name — in the clear.

Re: DNS over HTTPS

#49

Post by deathanatos »

pjc50 wrote: post #35
tylerhou wrote: post #34

Earlier quoted context omitted.

> After resolving the IP address over secure connection HTTPS still sends the host name unencrypted Correct me if I'm wrong, but I'm pretty sure the host name is generally only sent in an HTTP header, which should be encrypted over HTTPS. https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Ho...

No, in order to multi-host SSL sites the host name has to be sent first in order for the correct certificate to be presented. https://en.wikipedia.org/wiki/Server_Name_Indication

You don't even need SNI; the initial Server Hello, which contains the server's certificate (which contains the DNS name the certificate is issued for) is sent in the clear.
Post reply on HN