Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Big DNS Privacy Debate at FOSDEM

blog.powerdns.com

Post reply on HN
Print view View original

41–50 of 63 posts

Re: The Big DNS Privacy Debate at FOSDEM

#41

Post by dsl »

tptacek wrote: post #6
Tepix wrote: post #2

I attended the DoH talk by Daniel Stenberg at FOSDEM. When talking about alternatives he didn't mention Dan Bernstein's DNScurve ( https://dnscurve.org/ ). It has low adoption and is not on a standards track (as far as I know) but I think it's the best proposal for DNS privacy and security so far.

DNSCurve is over; DoTLS and DoH provide essentially the same value in essentially the same deployment mode, but with mainstream support.

DoH failed to keep the important part of DNS, which was statelessness.

Running a stock or DNSCrypt resolver for 10k QPS requires a small to medium sized box that is within the technical realm of most people to operate. Adding stateful connection tracking now creates an operational burden that most IT folks would say "screw it, send it to the cloud."

This centralizes the DNS in to the hands of a half dozen organizations that can operate at that scale, and they also happen to be the ones driving the policy forward.

Re: The Big DNS Privacy Debate at FOSDEM

#42

Post by dsl »

kardos wrote: post #9

Potential workarounds: 1. Round Robin your DoH requests across several providers. Eg, if CloudFlare sees one quarter of your DNS requests it's less revealing then if they see all of them. 2. DNS proxies. Sort of like a VPN for the DNS requests such that they're aggregated to one source IP before being passed to the DoH provider. Done at the ISP level? Or some other arrangement. The VPN here would not be privy to the…

Round robin won't work because a 25% sample is just as useful as a full feed. All they need is enough users to provide a statistically significant representation of traffic.

For you personally, if you send a query for www.example.com to one provider, and a query for images.example.net to another, you've outed yourself as browsing example.com to both.

Re: The Big DNS Privacy Debate at FOSDEM

#43

Post by driverdan »

hd4 wrote: post #36
rnhmjoj wrote: post #12

DNSCrypt has been around for a decade and works really well. Did everyone forget about it? It's objectively better than running DNS queries over HTTPS: still UDP based, no need to trust a CA but only the DNS server public key, can be cached locally or network-wise, perfect forward secrecy. There are clients[1] for Windows, Android, BSD, Linux, macOS and lots of providers[2]. It's really a shame it hasn't been made in…

>works really well Yes it works, but the setup can get messy. It used to break Ubuntu for me (like beyond repair and needed a full reinstall). I agree, I wish there was more consensus about how to lock down DNS traffic. It's surprising to me that it's taken this long to start getting mainstream recognition. DNSCrypt is probably best positioned to become a standard if anything. I'm going to give the latest version a t…

That's interesting. How did it break your system?

I've been using it on OS X / macOS for years. Occasionally I'd run into an ISP that blocked it or a resolver that was slow or down but the software was always solid.

Re: The Big DNS Privacy Debate at FOSDEM

#44

Post by driverdan »

criddell wrote: post #17
scame wrote: post #4

As they say, if it's free, then you're the product. I (as a European) have much more confidence in my ISP to guarantee my privacy than in a company which mostly makes money out of advertisement.

Your ISP doesn't sell user data? I'm in the US and feel the exact opposite. I trust Google and CloudFlare far more than AT&T or Verizon.

Read the article.

Re: The Big DNS Privacy Debate at FOSDEM

#45

Post by tptacek »

dsl wrote: post #41
tptacek wrote: post #6

Earlier quoted context omitted.

DNSCurve is over; DoTLS and DoH provide essentially the same value in essentially the same deployment mode, but with mainstream support.

DoH failed to keep the important part of DNS, which was statelessness. Running a stock or DNSCrypt resolver for 10k QPS requires a small to medium sized box that is within the technical realm of most people to operate. Adding stateful connection tracking now creates an operational burden that most IT folks would say "screw it, send it to the cloud." This centralizes the DNS in to the hands of a half dozen organizatio…

I don't honestly know whether, if I had the choice, I'd take DoHT or DNSCurve. But that's not really my point. No matter how much I might like DNSCurve, it's not going to happen at this point: DoH will be the mainstream secure resolver going forward, because it's firewall-friendly and will have mainstream browser support. With DoH widely deployed, the argument for DNSCurve is cut back drastically.

It's a very positive thing, to my mind; it's equally fatal, I think, to the arguments (such as they were) for DNSSEC --- which not only centralized DNS but also TLS security, and handed them to world governments.

I also think:

1. No matter what the protocol, centralization of "off-net" DNS services inevitable, for reasons having little to do with performance.

2. People with concerns about Google and Cloud Flare (it me!) can easily run their own off-net resolvers, and people will inevitably start privacy-preserving DoH resolvers that are open to the public.

3. Over time, the performance implications of TLS for DNS lookups will become less and less a factor.

Re: The Big DNS Privacy Debate at FOSDEM

#46

Post by kardos »

dsl wrote: post #42
kardos wrote: post #9

Potential workarounds: 1. Round Robin your DoH requests across several providers. Eg, if CloudFlare sees one quarter of your DNS requests it's less revealing then if they see all of them. 2. DNS proxies. Sort of like a VPN for the DNS requests such that they're aggregated to one source IP before being passed to the DoH provider. Done at the ISP level? Or some other arrangement. The VPN here would not be privy to the…

Round robin won't work because a 25% sample is just as useful as a full feed. All they need is enough users to provide a statistically significant representation of traffic. For you personally, if you send a query for www.example.com to one provider, and a query for images.example.net to another, you've outed yourself as browsing example.com to both.

Agreed, see reply to your sibling comment for a less-broken idea

Re: The Big DNS Privacy Debate at FOSDEM

#47

Post by ignoramous »

wtmt wrote: post #7

In India, several websites get blocked by different ISPs based on some highly unsubstantiated petitions to some court that doesn’t understand what the right move is and just sends the list of domains to be blocked to some ISPs, who gladly comply without any checks or questions. Users see a message saying that the site has been blocked because of some order from the Department of Telecommunications. There is no grieva…

The concerns just don't stop with blocking access but privacy as well: Some ISPs, I'd wager, are intercepting all unencrypted traffic too https://news.ycombinator.com/item?id=12091900. As long as one types in https instead of http, DNS and content based censorship should stop working, at least in theory, if one can use custom DNS providers over TLS, Https, or DNSCrpyt.

On Android, consider installing intra https://getintra.org to use a DNS over Https server of your choice, and switch to using Firefox instead of Chrome (someone pointed out in comments here that Chrome uses its own DNS resolver).

An example of how to set up AdGuard DNS (privacy oriented) on Android 4 and later: https://news.ycombinator.com/item?id=18791895

On Windows, consider using SimpleDNSCrpyt https://simplednscrypt.org/

----

Generally you could try and setup pie-hole, as well: https://news.ycombinator.com/item?id=18075159

Re: The Big DNS Privacy Debate at FOSDEM

#48

Post by wahern »

teddyh wrote: post #29
wahern wrote: post #26

Earlier quoted context omitted.

DoC doesn't actually address 2 or 3. I trust Sonic to not data mine or game my DNS queries much more than I trust Google or Cloudflare. I actually run my own recursive resolver locally, but if Firefox or Chrome default to DoC then the effect will be to lessen the privacy of Sonic Internet users, and users of similarly trustworthy ISPs. Worse, the techniques employed by browsers to select between a DoC resolver and a…

> DoC Surely you mean DoH? > I actually run my own recursive resolver locally As do I. > I trust Sonic to not data mine or game my DNS queries much more than I trust Google or Cloudflare. […] And centralization makes censorship easier. Oh, I agree. When you can't trust the single point of failure to not actually fail or not to be already fundamentally failed, then everything about centralization is bad.

> > DoC

> Surely you mean DoH?

DNS over Cloud (DoC) is the term coined in the article to differentiate the underlying transport (DoT, DoH) from it's deployment (centralization).

Re: The Big DNS Privacy Debate at FOSDEM

#49

Post by bubblethink »

wtmt wrote: post #7

In India, several websites get blocked by different ISPs based on some highly unsubstantiated petitions to some court that doesn’t understand what the right move is and just sends the list of domains to be blocked to some ISPs, who gladly comply without any checks or questions. Users see a message saying that the site has been blocked because of some order from the Department of Telecommunications. There is no grieva…

Anecdotal: DNS based censorship and blocking used to be a thing back in the day in India, but things have moved on to other methods (sni based I think).

Re: The Big DNS Privacy Debate at FOSDEM

#50

Post by icebraining »

kardos wrote: post #32
icebraining wrote: post #23

Earlier quoted context omitted.

1) seems unlikely; a 25% sample is probably quite representative. 2) that's essentially what a typical DNS provider like Cloudflare or Google DNS is: they proxy your requests back to the authoritative DNS servers, then return the response to you.

1) Fair enough, 25% of the requests would just take ~4x as long to get a more-or-less complete sampling. So how about a revised version: shard the requests, so CloudFlare only sees A-G, Google only sees H-P, etc. 2) No argument about that. I'm considering the privacy angle. A pre-DoC proxy would know your IP but not the DNS request contents, and the DoC provider would have the request but not the original IP.

Oh, I didn't understand (2), you mean a simple TCP proxy. Well, I guess one could already use Tor for that.
Post reply on HN