The Big DNS Privacy Debate at FOSDEM • Hacker News Board

Re: The Big DNS Privacy Debate at FOSDEM

#11

Post by mbrumlow » Thu, Feb 07, 2019, 4:14 PM UTC

js2 wrote: post #10

I'm disappointed by this situation where we have to shove encryption in at the application layer one application at a time because we couldn't get our act together with ipsec. I understand how it's come to be, but from an engineering perspective, it's absurd to move dns into https. Oh well, this is the nature of evolution, like the recurrent laryngeal nerve in a giraff.

I am not sure you need to do it at the application layer. All you need is a local caching resolver that your apps query over local host using standard methods. Then the local service can do all the fancy you want.

Today, I have this setup for work. I don't like them spying on me while at work. So I have setup a local resolver that forwards some request to the companies resolver, and others over a secure line to a set of public resolver. I did not need to change any software.

Re: The Big DNS Privacy Debate at FOSDEM

#12

Post by rnhmjoj » Thu, Feb 07, 2019, 4:27 PM UTC

DNSCrypt has been around for a decade and works really well. Did everyone forget about it?

It's objectively better than running DNS queries over HTTPS: still UDP based, no need to trust a CA but only the DNS server public key, can be cached locally or network-wise, perfect forward secrecy.

There are clients[1] for Windows, Android, BSD, Linux, macOS and lots of providers[2]. It's really a shame it hasn't been made into a standard.

[1]: https://github.com/jedisct1/dnscrypt-proxy

[2]: https://dnscrypt.info/public-servers

Re: The Big DNS Privacy Debate at FOSDEM

#13

Post by vetinari » Thu, Feb 07, 2019, 4:36 PM UTC

Tepix wrote: post #5

scame wrote: post #4

As they say, if it's free, then you're the product. I (as a European) have much more confidence in my ISP to guarantee my privacy than in a company which mostly makes money out of advertisement.

One nice aspect of DoH is that you can use it to circumvent local, lame DNS censorship. But ideally you will use a DoH server that is not run by for-profit companies known for data mongering.

Local censorship is still in your jurisdiction; if you have a grievance with it, you can address that (unless it is blocked for a generally accepted reason).

With DNS in cloud, you don't have that option. If the cloud companies do not respond to you, what are you going to do? The Google lack-of-support is well known for how it operates.

Re: The Big DNS Privacy Debate at FOSDEM

#14

Post by js2 » Thu, Feb 07, 2019, 4:41 PM UTC

mbrumlow wrote: post #11

js2 wrote: post #10

I'm disappointed by this situation where we have to shove encryption in at the application layer one application at a time because we couldn't get our act together with ipsec. I understand how it's come to be, but from an engineering perspective, it's absurd to move dns into https. Oh well, this is the nature of evolution, like the recurrent laryngeal nerve in a giraff.

I am not sure you need to do it at the application layer. All you need is a local caching resolver that your apps query over local host using standard methods. Then the local service can do all the fancy you want. Today, I have this setup for work. I don't like them spying on me while at work. So I have setup a local resolver that forwards some request to the companies resolver, and others over a secure line to a set…

My use of "application" is ambiguous. I was referring to the fact that DoH moves DNS from on top of udp/tcp to on top of https, itself on top of tcp, primarily to benefit from the 's' in https.

I actually also run a DoH proxy on my home router and point dnsmasq (also on the router) at it, so all my home network DNS goes out over https.

Re: The Big DNS Privacy Debate at FOSDEM

#15

Post by belorn » Thu, Feb 07, 2019, 4:44 PM UTC

Through the two major DNS privacy talks on FOSDEM I felt a bit at odd that so much effort is being put into the idea that giving all information to google will give best privacy. In basic security theory we talk about assets that need to be defended, and attackers we need to defend against. Why give everything to a company which revenue is based on breaking privacy? It sound completely incompatible with the idea of privacy.

Running your own resolver will give the authoritative servers the ip address of the request, but does this leak any assets to any potential attacker? The owner behind the authoritative servers already get the web logs so what additional information is being leaked. It seems to me that in order to get higher level of privacy you would need to run a VPN or Tor, in which case the DNS traffic can just go through the same path.

Re: The Big DNS Privacy Debate at FOSDEM

#16

Post by detaro » Thu, Feb 07, 2019, 4:46 PM UTC

rnhmjoj wrote: post #12

DNSCrypt has been around for a decade and works really well. Did everyone forget about it? It's objectively better than running DNS queries over HTTPS: still UDP based, no need to trust a CA but only the DNS server public key, can be cached locally or network-wise, perfect forward secrecy. There are clients[1] for Windows, Android, BSD, Linux, macOS and lots of providers[2]. It's really a shame it hasn't been made in…

Some would argue "still UDP based" is objectively worse, since it can be blocked.

I don't think DNSCrypt is better for caching, doesn't it just protect one "leg" from a client (which can be a local cache) to a resolver (which also can be a cache) just like DoH? Similarly for pinning keys (although I think DNSCrypt made exchanging keys easier).

Re: The Big DNS Privacy Debate at FOSDEM

#17

Post by criddell » Thu, Feb 07, 2019, 4:46 PM UTC

scame wrote: post #4

As they say, if it's free, then you're the product. I (as a European) have much more confidence in my ISP to guarantee my privacy than in a company which mostly makes money out of advertisement.

Your ISP doesn't sell user data?

I'm in the US and feel the exact opposite. I trust Google and CloudFlare far more than AT&T or Verizon.

Re: The Big DNS Privacy Debate at FOSDEM

#18

Post by matt4077 » Thu, Feb 07, 2019, 4:54 PM UTC

scame wrote: post #4

As they say, if it's free, then you're the product. I (as a European) have much more confidence in my ISP to guarantee my privacy than in a company which mostly makes money out of advertisement.

I’ll actually use this as an example how that saying is wrong.

ISPs may be better in some regards because they are smaller. Some of them may also just not be competent enough to seriously harm you.

But not for a second do I believe they care about my privacy.

That tired saying is also full of holes: paying doesn’t stop you from being the product as well as the customer if the company can pull it off. That’s why they show you ads in cinemas even if you paid for the ticket. Conversely, not paying really does not change the incentives for Google and others to retain you: if everyone switches to some other search and email, they are done for no matter what.

Re: The Big DNS Privacy Debate at FOSDEM

#19

Post by gsich » Thu, Feb 07, 2019, 4:56 PM UTC

detaro wrote: post #16

rnhmjoj wrote: post #12

DNSCrypt has been around for a decade and works really well. Did everyone forget about it? It's objectively better than running DNS queries over HTTPS: still UDP based, no need to trust a CA but only the DNS server public key, can be cached locally or network-wise, perfect forward secrecy. There are clients[1] for Windows, Android, BSD, Linux, macOS and lots of providers[2]. It's really a shame it hasn't been made in…

Some would argue "still UDP based" is objectively worse, since it can be blocked. I don't think DNSCrypt is better for caching, doesn't it just protect one "leg" from a client (which can be a local cache) to a resolver (which also can be a cache) just like DoH? Similarly for pinning keys (although I think DNSCrypt made exchanging keys easier).

Major advantage is the latency. TCP needs 3 trips, TLS an additional 4. With dnscrypt you have one request and one response.

Then again, Cloudflare and Quad9 terminate the connection almost instantly after finishing your request. Tested this with DoT though. (stubby with high timeout set)

Re: The Big DNS Privacy Debate at FOSDEM

#20

Post by zzzcpan » Thu, Feb 07, 2019, 5:00 PM UTC

belorn wrote: post #15

Through the two major DNS privacy talks on FOSDEM I felt a bit at odd that so much effort is being put into the idea that giving all information to google will give best privacy. In basic security theory we talk about assets that need to be defended, and attackers we need to defend against. Why give everything to a company which revenue is based on breaking privacy? It sound completely incompatible with the idea of p…

It's worse than that: you already have to trust your ISP, but with third party DNS resolver you not only have to trust your ISP, but also another third party. Encrypted SNI is another sneaky proposal that claims it can help with that, but cannot actually. Even in the ideal case when everyone is using ESNI, there is still a lot of information that you have to trust your ISP with, like access patterns, IP addresses, response sizes, etc. and on top of that trust an extra third party with DNS.

Basically it's all awful and ill-advised form security and privacy perspective, you always need at least a VPN if you can't trust your ISP. DoH can only make it worse.