Encrypted SNI Comes to Firefox Nightly • Hacker News Board

Re: Encrypted SNI Comes to Firefox Nightly

#21

Post by drb91 » Thu, Oct 18, 2018, 6:46 PM UTC

cremp wrote: post #17

drb91 wrote: post #14

Earlier quoted context omitted.

I hope they add DNS resolution to the network activity tab.

They can't, because that's handled at the OS level, not the application level. If a browser starts (purposefully) subverting the hosts file or not adhering to resolv addresses, then we've got a bigger problem. Think, a fat client resolving an address differently than a browser; then that's all sort of Pandora's Box.

DNS over HTTPS is still handled at the OS level?

Related, it should be possible to have “correct” dns in userland that behaves as you describe sans falling back to the system resolver. In my understanding the whole point of DNS over https is to avoid the DHCP assigned DNS address (and of course encrypt)

Finally, I’m pretty sure Firefox at least does its own dns caching. I’ve had to force reload to pick up dns changes already visible to the system resolver.

Re: Encrypted SNI Comes to Firefox Nightly

#22

Post by tptacek » Thu, Oct 18, 2018, 6:47 PM UTC

toomuchtodo wrote: post #20

tptacek wrote: post #19

Earlier quoted context omitted.

Funny, I think we've had exactly the opposite problem . See, for instance, Heartbleed, which is pure product of IETF standardization of a feature no mainstream commercial entity asked for.

I don't disagree there are problems with not involving commercial stakeholders in the standardization process, and your Heartbleed example is poignant. I feel that there is a middle ground that would be more beneficial to all stakeholders in the long run. I'm just asking for some balance. The implementations of today evolve into the legacy systems that will need to be supported and maintained for years, if not decade…

Yes, and I think what you're looking at now is balance. The way standards are supposed to work is that companies (among other users) come up with features that they want, and get them working, and then the IETF is supposed to hammer out agreement on how to make those features interoperate. And that's it.

It was never the idea that IETF was meant to be an Internet legislature adjudicating what features can and can't be supported in protocols. But that's exactly what it has become.

Re: Encrypted SNI Comes to Firefox Nightly

#23

Post by the8472 » Thu, Oct 18, 2018, 6:49 PM UTC

e1ven wrote: post #3

I'm curious why this is tied to DNS-over-HTTPS. It looks like Cloudflare is including a public key in the DNS lookup, which is used to encrypt the SNI information. Couldn't this key be stored in a TXT record for normal DNS lookups as well?

Are there even any DoH resolvers you can run yourself? unbound only supports DoT. It's a shame that they had to invent yet another standard.

This makes things a lot more complex to run in a lan. Especially since you also need certificates and put them into the browser trust store. Just to avoid leaking SNI.

Re: Encrypted SNI Comes to Firefox Nightly

#24

Post by zzzcpan » Thu, Oct 18, 2018, 6:53 PM UTC

rickbutton wrote: post #4

e1ven wrote: post #3

I'm curious why this is tied to DNS-over-HTTPS. It looks like Cloudflare is including a public key in the DNS lookup, which is used to encrypt the SNI information. Couldn't this key be stored in a TXT record for normal DNS lookups as well?

If the public key was stored in a TXT record and accessed via regular DNS, then someone snooping the connection could see that you made a DNS lookup for that domain, and could make the reasonable assumption that you were about to make a request to said domain.

Someone could still make a very reasonable assumption based on IP addresses and response sizes, which is where I believe the primary focus would shift if by some chance this encrypted SNI becomes impossible to circumvent. But also someone could just block DNS-over-HTTPS requests altogether and force Firefox into cleartext DNS and therefore circumvent encrypted SNI.

It also centralizes DNS requests at Cloudflare's POPs (a company from a mass surveillance, secret orders happy, police country by the way).

No, none of it addresses privacy and security, probably only makes it worse.

It's time to admit there is no future for privacy and security without overlay networks.

Re: Encrypted SNI Comes to Firefox Nightly

#25

Post by the8472 » Thu, Oct 18, 2018, 6:54 PM UTC

cremp wrote: post #12

Is it me or... > If they’re willing to convert all their customers to ESNI at once Why does it seem like this is over-engineering at it's finest? Not only are CDNs now part of the problem/solution space, but they are now dictating. It is now that much harder to diagnose issues when they do crop up, instead of checking ping or nslookup. Now, you've got to see if the DNS-over-HTTPS/The DNS record itself/Host/client/any…

It's even worse. To use ESNI you need DOH. To use DOH you need a resolver with a server certificates, which is kindly offered by the same cloud providers. So now all your base are belong to cloudflare.

Re: Encrypted SNI Comes to Firefox Nightly

#26

Post by sp332 » Thu, Oct 18, 2018, 6:54 PM UTC

cremp wrote: post #12

Is it me or... > If they’re willing to convert all their customers to ESNI at once Why does it seem like this is over-engineering at it's finest? Not only are CDNs now part of the problem/solution space, but they are now dictating. It is now that much harder to diagnose issues when they do crop up, instead of checking ping or nslookup. Now, you've got to see if the DNS-over-HTTPS/The DNS record itself/Host/client/any…

If you're not using a CDN, you can just enable it for your own site. They explained in the article why they didn't think enough sites would do this to make it worthwhile.

Re: Encrypted SNI Comes to Firefox Nightly

#27

Post by mholt » Thu, Oct 18, 2018, 6:57 PM UTC

So what's the plan for when IPv6 gains more adoption and we don't need SNI as much since every site can have its own public IP address (thus making tracking easier, subverting the benefits of encrypted SNI).

Do you think encrypted SNI and NAT will become preferred to using IPv6 for routing because of the privacy benefits of ESNI (either real or imagined, depending on who you trust, since this seems to be relying on centralized CDNs for adoption)?

Edit: I realize ESNI and IPv6 are orthogonal, however, I wanted to ask since I know that lack of IP space and using NAT/SNI are correlated.

Re: Encrypted SNI Comes to Firefox Nightly

#28

Post by zzzcpan » Thu, Oct 18, 2018, 6:58 PM UTC

toomuchtodo wrote: post #16

cremp wrote: post #12

Is it me or... > If they’re willing to convert all their customers to ESNI at once Why does it seem like this is over-engineering at it's finest? Not only are CDNs now part of the problem/solution space, but they are now dictating. It is now that much harder to diagnose issues when they do crop up, instead of checking ping or nslookup. Now, you've got to see if the DNS-over-HTTPS/The DNS record itself/Host/client/any…

It's not you. It's a combination of startups and incumbent tech behemoths attempting to operate outside of the formalized process for internet standards by using their market power to push for the change they deem appropriate. There are benefits (censorship circumvention) to be reaped, but also great peril.

> There are benefits (censorship circumvention) to be reaped, but also great peril.

There is no way this encrypted SNI could enable censorship circumvention.

Re: Encrypted SNI Comes to Firefox Nightly

#29

Post by StudentStuff » Thu, Oct 18, 2018, 7:04 PM UTC

mholt wrote: post #27

So what's the plan for when IPv6 gains more adoption and we don't need SNI as much since every site can have its own public IP address (thus making tracking easier, subverting the benefits of encrypted SNI). Do you think encrypted SNI and NAT will become preferred to using IPv6 for routing because of the privacy benefits of ESNI (either real or imagined, depending on who you trust, since this seems to be relying on c…

I do not think most webservers will be set up with one IPv6 address per website. As is, most IPv6 enabled sites that share an IPv4 with another site and also share their IPv6 address with those same sites. Assigning one IPv6 address per site would add complexity for little benefit.

Re: Encrypted SNI Comes to Firefox Nightly

#30

Post by toomuchtodo » Thu, Oct 18, 2018, 7:04 PM UTC

zzzcpan wrote: post #28

toomuchtodo wrote: post #16

Earlier quoted context omitted.

It's not you. It's a combination of startups and incumbent tech behemoths attempting to operate outside of the formalized process for internet standards by using their market power to push for the change they deem appropriate. There are benefits (censorship circumvention) to be reaped, but also great peril.

> There are benefits (censorship circumvention) to be reaped, but also great peril. There is no way this encrypted SNI could enable censorship circumvention.

My understanding was that encrypted SNI was to avoid the sniffing of the host header that travels unencrypted with SNI, and that in combination with a large host (Cloudflare, Google, AWS), an encrypted SNI prevents censorship (unless you're dropping all traffic to the IP block or AS). Is this understanding inaccurate?