The Big DNS Privacy Debate at FOSDEM
blog.powerdns.com
The Big DNS Privacy Debate at FOSDEM
1–10 of 63 posts
Re: The Big DNS Privacy Debate at FOSDEM
#2I attended the DoH talk by Daniel Stenberg at FOSDEM. When talking about alternatives he didn't mention Dan Bernstein's DNScurve ( https://dnscurve.org/ ).
It has low adoption and is not on a standards track (as far as I know) but I think it's the best proposal for DNS privacy and security so far.
Re: The Big DNS Privacy Debate at FOSDEM
#3I attended the DoH talk by Daniel Stenberg at FOSDEM. When talking about alternatives he didn't mention Dan Bernstein's DNScurve ( https://dnscurve.org/ ). It has low adoption and is not on a standards track (as far as I know) but I think it's the best proposal for DNS privacy and security so far.
DJB has a long history of producing outstanding software that almost nobody uses because of weird licensing, poor documentation or his prickly personality. He would do really well to get a PR agent or something, because technical excellence is rarely enough to succeed in a market.
Re: The Big DNS Privacy Debate at FOSDEM
#4As they say, if it's free, then you're the product. I (as a European) have much more confidence in my ISP to guarantee my privacy than in a company which mostly makes money out of advertisement.
Re: The Big DNS Privacy Debate at FOSDEM
#5As they say, if it's free, then you're the product. I (as a European) have much more confidence in my ISP to guarantee my privacy than in a company which mostly makes money out of advertisement.
One nice aspect of DoH is that you can use it to circumvent local, lame DNS censorship. But ideally you will use a DoH server that is not run by for-profit companies known for data mongering.
Re: The Big DNS Privacy Debate at FOSDEM
#6I attended the DoH talk by Daniel Stenberg at FOSDEM. When talking about alternatives he didn't mention Dan Bernstein's DNScurve ( https://dnscurve.org/ ). It has low adoption and is not on a standards track (as far as I know) but I think it's the best proposal for DNS privacy and security so far.
DNSCurve is over; DoTLS and DoH provide essentially the same value in essentially the same deployment mode, but with mainstream support.
Re: The Big DNS Privacy Debate at FOSDEM
#7In India, several websites get blocked by different ISPs based on some highly unsubstantiated petitions to some court that doesn’t understand what the right move is and just sends the list of domains to be blocked to some ISPs, who gladly comply without any checks or questions. Users see a message saying that the site has been blocked because of some order from the Department of Telecommunications.
There is no grievance management process, no way for legitimate sites to get a quick reprieve when they get blocked either due to operator error or issues with the petitions not being vetted and investigated for malicious intent (a competitor could easily knock you off in some states or regions and you wouldn’t even know).
While there are activists working on policies and campaigning for better laws, we really need stronger technological solutions against these (usually ridiculous) blocks that insult “due process” and harm people.
India is also very quick to rap on large multinational companies whenever they seem to provide something that those in power (or their supporters) frown upon. So centralized providers like Google DNS or Cloudflare DNS would have some tough times with the governments, since both have physical presence in the country with their servers/data centers.
A decentralized and yet secure/private DNS may be more resilient than these DoC (DNS over Cloud) providers if we have to deal with government censorship effectively.
Re: The Big DNS Privacy Debate at FOSDEM
#8On a related note, I recently found out that Chrome uses its own DNS resolver, ostensibly to improve performance. On some Android devices, this ignores the nameserver precedence set against network connections on the device. The result is that it will often send DNS queries to the nameserver attached to the physical network adapter and not the one attached to the VPN interface. It breaks queries for intranet servers and it breaks loopback-VPN-based ad blockers (a common workaround to manage your own hosts file on Android without rooting your device and breaking many root-hostile apps). There's a flag (async dns) in Android Chrome to disable the internal resolver and use the system resolver instead, but this flag is no longer present on desktop (where a startup parameter must be used).
My point is that, as alluded to in the article, changing how DNS works can have serious side effects. The fact that, as unintentional as it may have been, one of the world's biggest ad networks broke ad-blocking on a number of devices by changing how they handle DNS queries is worrying. I'm concerned that as DoH (or DoC as the article refers to it) proliferates, it'll be used less to circumvent censorship and more to take away control from end users and enterprise network administrators. Every app, the browser included, could creep towards using their own internal DNS query handler, using nameservers they trust to delivery their analytics and advertising queries.
Additionally, giving DoH/DoC choice through the browser suggests that the browser might return different results from other software on the device. This sounds disastrous.
And I suspect that the oppressive regimes that always come up in discussions about DoH would simply block the IPs of those cloud resolvers, which seem to rely on having a well-known IP or domain name.
Re: The Big DNS Privacy Debate at FOSDEM
#9Potential workarounds:
1. Round Robin your DoH requests across several providers. Eg, if CloudFlare sees one quarter of your DNS requests it's less revealing then if they see all of them.
2. DNS proxies. Sort of like a VPN for the DNS requests such that they're aggregated to one source IP before being passed to the DoH provider. Done at the ISP level? Or some other arrangement. The VPN here would not be privy to the requests due to TLS.
These ideas may require more work to be practical.
Re: The Big DNS Privacy Debate at FOSDEM
#10I'm disappointed by this situation where we have to shove encryption in at the application layer one application at a time because we couldn't get our act together with ipsec. I understand how it's come to be, but from an engineering perspective, it's absurd to move dns into https.
Oh well, this is the nature of evolution, like the recurrent laryngeal nerve in a giraff.