Improving DNS Privacy in Firefox • Hacker News Board

Re: Improving DNS Privacy in Firefox

#11

Post by st3fan » Fri, Jun 01, 2018, 12:15 PM UTC

userbinator wrote: post #6

Because there is no encryption, other devices along the way might collect (or even block or change) this data too. ...which is sometimes very desirable[1][2][3]. I get the whole "more security!" movement, but also feel like it's just contributing to turning general-purpose computers into locked-down media consumption devices. [1] https://pi-hole.net/ [2] https://en.wikipedia.org/wiki/Proxomitron [3] https://news.ycom…

I don't think you 'get' the "whole "more security!" movement" at all actually :-)

Re: Improving DNS Privacy in Firefox

#12

Post by arghwhat » Fri, Jun 01, 2018, 12:16 PM UTC

gnode wrote: post #4

There seems to be little point of doing this, in my opinion, when SNI doesn't secure the hostname.

You can't wiretap the DNS and obtain data about all site visits from there. That's really quite nice.

It still means that your ISP or a wiretap on your own internet pipe can check your browsing activity by monitoring SNI's, but then again, they can also figure that out for a lot of sites by just checking the IP.

Then you could argue that all sites should use CDNs to hide this, but then you open the argument of whether the internet should be centralized or decentralized.

Encrypted SNI would be nice, but are tricky (wouldn't work well in multi-tenant setups), and those that can sniff the SNI probably know where you were going anyway.

Re: Improving DNS Privacy in Firefox

#13

Post by st3fan » Fri, Jun 01, 2018, 12:20 PM UTC

gnode wrote: post #4

There seems to be little point of doing this, in my opinion, when SNI doesn't secure the hostname.

You have to start somewhere. Security is the sum of all parts. This is a small part, but it may have a big impact already.

I'm sure SNI is next on the list, it will just take a bit longer. Until then, let's harden other parts of the infrastructure.

Re: Improving DNS Privacy in Firefox

#14

Post by arghwhat » Fri, Jun 01, 2018, 12:20 PM UTC

nbsd4life wrote: post #10

so, there's a concurrent post about how 1.1.1.1 had an outage. Does that mean web browsing won't work if that happens again? If not, does that mean it will fallback to unencrypted DNS if 1.1.1.1 is blocked? Making this a default means that Firefox users all bypass censorship in several countries, what do they expect to happen as a result of it? Firefox blocked? 1.1.1.1 blocked?

This isn't any different from if your normal DNS server is blocked, and 1.1.1.1 is not the only encrypted DNS provider.

If whatever DNS you use doesn't work, then you cannot resolve any new domain names until you change to another DNS server or it gets fixed. Recently used domains will be cached in will thus still work.

Re: Improving DNS Privacy in Firefox

#15

Post by tialaramex » Fri, Jun 01, 2018, 12:21 PM UTC

gnode wrote: post #4

There seems to be little point of doing this, in my opinion, when SNI doesn't secure the hostname.

SNI doesn't encrypt the hostname but in TLS 1.3 it does secure it against middleboxes. If a MitM tries to alter the SNI then the connection fails.

TLS 1.3 also encrypts the server certificate. So if you want to send bonus SNI but get back real certificates that's just a matter between client and server.

The use case for Encrypted SNI remains sketchy. If I am the secret police of some authoritarian nation, who would block diebartdie.example why wouldn't I instead block the IP addresses of servers offering diebartdie.example? Only because it causes collateral damage? But why do I care, teach them not to associate with my enemies.

Re: Improving DNS Privacy in Firefox

#16

Post by jedisct1 » Fri, Jun 01, 2018, 12:25 PM UTC

gnode wrote: post #4

There seems to be little point of doing this, in my opinion, when SNI doesn't secure the hostname.

Encrypted SNI for TLS 1.3 is being worked on: https://github.com/ekr/draft-rescorla-tls-esni/blob/master/d...

Re: Improving DNS Privacy in Firefox

#17

Post by jedisct1 » Fri, Jun 01, 2018, 12:27 PM UTC

rajadigopula wrote: post #8

DNSCrypt is also a viable option. - https://dnscrypt.info/

dnscrypt-proxy also supports DNS-over-HTTPS and is probably the most popular DoH client.

You can use it to connect to Cloudflare or other DoH servers, and this will not be limited to queries sent by Firefox.

On iOS, use DNSCloak.

Re: Improving DNS Privacy in Firefox

#18

Post by OptionX » Fri, Jun 01, 2018, 12:36 PM UTC

Could people in heavly-restricted regions, like China and such, access blocked sites if they use DoH to DNS outside the control of the censoring entity?

Re: Improving DNS Privacy in Firefox

#19

Post by icebraining » Fri, Jun 01, 2018, 12:37 PM UTC

userbinator wrote: post #6

Because there is no encryption, other devices along the way might collect (or even block or change) this data too. ...which is sometimes very desirable[1][2][3]. I get the whole "more security!" movement, but also feel like it's just contributing to turning general-purpose computers into locked-down media consumption devices. [1] https://pi-hole.net/ [2] https://en.wikipedia.org/wiki/Proxomitron [3] https://news.ycom…

None of that is affected as long as the browser lets you explicitly choose to use them, as Firefox does.

Re: Improving DNS Privacy in Firefox

#20

Post by QasimK » Fri, Jun 01, 2018, 12:39 PM UTC

st3fan wrote: post #13

gnode wrote: post #4

There seems to be little point of doing this, in my opinion, when SNI doesn't secure the hostname.

You have to start somewhere. Security is the sum of all parts. This is a small part, but it may have a big impact already. I'm sure SNI is next on the list, it will just take a bit longer. Until then, let's harden other parts of the infrastructure.

I was curious about TLS1.3’s attempt to encrypt SNI, and found that it is genuinely a hard problem. The best solution seemed to be to use a proxy/fronting service, but that isn’t the ideal solution.