Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Big DNS Privacy Debate at FOSDEM

blog.powerdns.com

Post reply on HN
Print view View original

31–40 of 63 posts

Re: The Big DNS Privacy Debate at FOSDEM

#31

Post by detaro »

michaelt wrote: post #30
detaro wrote: post #16

Earlier quoted context omitted.

Some would argue "still UDP based" is objectively worse, since it can be blocked. I don't think DNSCrypt is better for caching, doesn't it just protect one "leg" from a client (which can be a local cache) to a resolver (which also can be a cache) just like DoH? Similarly for pinning keys (although I think DNSCrypt made exchanging keys easier).

In the internet of the future, DNS will move from UDP to TCP because it's better, and HTTP/3 will move from TCP to UDP because it's better. Web 4.0 will consolidate these improvements, producing DNS over HTTP over QUIC over UDP.

Probably, yes. The key from that perspective is to have it in the same format as the content traffic.

Re: The Big DNS Privacy Debate at FOSDEM

#32

Post by kardos »

icebraining wrote: post #23
kardos wrote: post #9

Potential workarounds: 1. Round Robin your DoH requests across several providers. Eg, if CloudFlare sees one quarter of your DNS requests it's less revealing then if they see all of them. 2. DNS proxies. Sort of like a VPN for the DNS requests such that they're aggregated to one source IP before being passed to the DoH provider. Done at the ISP level? Or some other arrangement. The VPN here would not be privy to the…

1) seems unlikely; a 25% sample is probably quite representative. 2) that's essentially what a typical DNS provider like Cloudflare or Google DNS is: they proxy your requests back to the authoritative DNS servers, then return the response to you.

1) Fair enough, 25% of the requests would just take ~4x as long to get a more-or-less complete sampling. So how about a revised version: shard the requests, so CloudFlare only sees A-G, Google only sees H-P, etc.

2) No argument about that. I'm considering the privacy angle. A pre-DoC proxy would know your IP but not the DNS request contents, and the DoC provider would have the request but not the original IP.

Re: The Big DNS Privacy Debate at FOSDEM

#33

Post by _null_ »

belorn wrote: post #15

Through the two major DNS privacy talks on FOSDEM I felt a bit at odd that so much effort is being put into the idea that giving all information to google will give best privacy. In basic security theory we talk about assets that need to be defended, and attackers we need to defend against. Why give everything to a company which revenue is based on breaking privacy? It sound completely incompatible with the idea of p…

>Running your own resolver will give the authoritative servers the ip address of the request, but does this leak any assets to any potential attacker? The owner behind the authoritative servers already get the web logs so what additional information is being leaked.

This is addressed in the panel. The argument is that there is some "privacy mixing" because owner of the authoritative server only sees a highly-trafficked resolver as the source, and not your home network resolver.

Re: The Big DNS Privacy Debate at FOSDEM

#34

Post by phicoh »

rnhmjoj wrote: post #12

DNSCrypt has been around for a decade and works really well. Did everyone forget about it? It's objectively better than running DNS queries over HTTPS: still UDP based, no need to trust a CA but only the DNS server public key, can be cached locally or network-wise, perfect forward secrecy. There are clients[1] for Windows, Android, BSD, Linux, macOS and lots of providers[2]. It's really a shame it hasn't been made in…

The discussion is not so much about which encryption technology to use, but on whether browsers should silently redirect DNS traffic to big US companies.

Re: The Big DNS Privacy Debate at FOSDEM

#35

Post by dagenix »

zzzcpan wrote: post #24
criddell wrote: post #17

Earlier quoted context omitted.

Your ISP doesn't sell user data? I'm in the US and feel the exact opposite. I trust Google and CloudFlare far more than AT&T or Verizon.

With these proposals you still have to trust your ISP in addition to trusting Google and Cloudflare. You can avoid trusting all three, your ISP, Google, Cloudflare by trusting instead a single VPN provider of your choice (or a hosting provider where you can run your own VPN server).

A VPN provider has a much better source of data to mine than just about anyone else. On top of that, figuring out which ones deserve to be trusted is near impossible.

Re: The Big DNS Privacy Debate at FOSDEM

#36

Post by hd4 »

rnhmjoj wrote: post #12

DNSCrypt has been around for a decade and works really well. Did everyone forget about it? It's objectively better than running DNS queries over HTTPS: still UDP based, no need to trust a CA but only the DNS server public key, can be cached locally or network-wise, perfect forward secrecy. There are clients[1] for Windows, Android, BSD, Linux, macOS and lots of providers[2]. It's really a shame it hasn't been made in…

>works really well

Yes it works, but the setup can get messy. It used to break Ubuntu for me (like beyond repair and needed a full reinstall).

I agree, I wish there was more consensus about how to lock down DNS traffic. It's surprising to me that it's taken this long to start getting mainstream recognition. DNSCrypt is probably best positioned to become a standard if anything. I'm going to give the latest version a try (the one that broke for me was a couple of years ago) hopefully it's better than before.

Re: The Big DNS Privacy Debate at FOSDEM

#37

Post by dboreham »

rini17 wrote: post #22

Is the research of homomorphic encryption far enough that it's practical to implement for DNS? The server would accept DNS queries using such cryptographic algorithms on encrypted database, that he nor anybody else can't say which record was queried. Only the client.

Nope.

Re: The Big DNS Privacy Debate at FOSDEM

#38

Post by petronio »

wtmt wrote: post #7

In India, several websites get blocked by different ISPs based on some highly unsubstantiated petitions to some court that doesn’t understand what the right move is and just sends the list of domains to be blocked to some ISPs, who gladly comply without any checks or questions. Users see a message saying that the site has been blocked because of some order from the Department of Telecommunications. There is no grieva…

One of the options I've thought of (and I'm sure many others have as well) is to have all zones distributed in a P2P manner via ICANN. To not put too much burden on ICANN and keep things decentralized, have ICANN at the root of the DNS PKI and have all zones signed by the responsible party.

This would solve a few of the big problems we have:

* All sorts of MITM and evil resolver attacks would be prevented.

* Since DNS queries are local, there would no longer be a privacy concern with resolving a name.

* Even if the P2P network mechanism were to be blocked, since every host connected keeps a full record (though not necessarily with history) it can still be distributed via sneakernet.

* DNS updates are as fast as the network is, no longer depending on turtles caching all the way down.

* DNS amplification? That's gone, as resolvers no longer need to query external sources.

As many will quickly notice, we would likely still need remote resolvers for battery constrained devices as this would keep the network interfaces busy.

The one big political issue that would put a stop to this is that this would cause all zones to be world readable. Many people treat zones as something private and to them exposing the zone file is the same as exposing their network. My view is that if it has a publically routable IP then it is already exposed, but not everyone shares my view.

Re: The Big DNS Privacy Debate at FOSDEM

#39

Post by mook »

I'm disappointed that the fact it will break things only got a mention, and yet the browsers are pushing for using DoH via cloud providers.

My NAS isn't externally resolvable; after all, it's not externally reachable either. And now I have to refer to it by IP address because the Chromecast insists on using Google's DNS servers.

People seem to be unwilling to address known issues before switching defaults :(

Re: The Big DNS Privacy Debate at FOSDEM

#40

Post by zzzcpan »

dagenix wrote: post #35
zzzcpan wrote: post #24

Earlier quoted context omitted.

With these proposals you still have to trust your ISP in addition to trusting Google and Cloudflare. You can avoid trusting all three, your ISP, Google, Cloudflare by trusting instead a single VPN provider of your choice (or a hosting provider where you can run your own VPN server).

A VPN provider has a much better source of data to mine than just about anyone else. On top of that, figuring out which ones deserve to be trusted is near impossible.

It doesn't have more data to mine than your ISP. It's not harder to figure out who to trust than with any other company. But unlike with any other company there is so much competition across the globe, that you can strategically pick specific jurisdictions and providers known to fight for your interests.
Post reply on HN