Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Big DNS Privacy Debate at FOSDEM

blog.powerdns.com

Post reply on HN
Print view View original

51–60 of 63 posts

Re: The Big DNS Privacy Debate at FOSDEM

#51

Post by silotis »

petronio wrote: post #38
wtmt wrote: post #7

In India, several websites get blocked by different ISPs based on some highly unsubstantiated petitions to some court that doesn’t understand what the right move is and just sends the list of domains to be blocked to some ISPs, who gladly comply without any checks or questions. Users see a message saying that the site has been blocked because of some order from the Department of Telecommunications. There is no grieva…

One of the options I've thought of (and I'm sure many others have as well) is to have all zones distributed in a P2P manner via ICANN. To not put too much burden on ICANN and keep things decentralized, have ICANN at the root of the DNS PKI and have all zones signed by the responsible party. This would solve a few of the big problems we have: * All sorts of MITM and evil resolver attacks would be prevented. * Since DN…

I've also thought of this. With the plentiful availability of storage and bandwidth we have today, there is little technical reason why public resolvers and privacy minded individuals couldn't download and cache zone files in bulk.

As you say though, I suspect the inertia behind the status quo is so strong that there is little chance of such a radical change being accepted.

Re: The Big DNS Privacy Debate at FOSDEM

#52

Post by tptacek »

teddyh wrote: post #21

Encryption usually solves three problems: 1. Authenticity of data; i.e. fixing DNS spoofing. 2. Privacy 3. Censorship Problem 1 is fixed today by DNSSEC. The best solution for problem 1, 2 and 3 would be if IPsec had a working and deployed PKI, so IPsec could be used for all IP-based traffic, and nobody had to worry about encryption on any layer above that. Lacking that, the next best thing for problem 2 would be for…

DNSSEC doesn't really fix any of authentication today, for a number of reasons:

1. Almost no major domains are signed or have plans to sign (despite DNSSEC being one of the oldest "security" standard efforts at the IETF): https://twitter.com/tqbf/status/1086061495811743747

2. Browsers have removed support for DNSSEC, and are not adding it back.

3. DNSSEC solves only the server-to-server authentication problem, but not the (much more common) client-server authentication problem that DoH solves.

4. And, of course, the authentication solution DNSSEC offers is effectively key-escrowed to world governments.

There are other reasons as well, but that's a condensed version of the argument for why DoH is a live effort with gathering mainstream support, and DNSSEC is not.

Re: The Big DNS Privacy Debate at FOSDEM

#53

Post by Arnavion »

michaelt wrote: post #30
detaro wrote: post #16

Earlier quoted context omitted.

Some would argue "still UDP based" is objectively worse, since it can be blocked. I don't think DNSCrypt is better for caching, doesn't it just protect one "leg" from a client (which can be a local cache) to a resolver (which also can be a cache) just like DoH? Similarly for pinning keys (although I think DNSCrypt made exchanging keys easier).

In the internet of the future, DNS will move from UDP to TCP because it's better, and HTTP/3 will move from TCP to UDP because it's better. Web 4.0 will consolidate these improvements, producing DNS over HTTP over QUIC over UDP.

We already have DNS over HTTP(S) now.

Re: The Big DNS Privacy Debate at FOSDEM

#54

Post by hd4 »

driverdan wrote: post #43
hd4 wrote: post #36

Earlier quoted context omitted.

>works really well Yes it works, but the setup can get messy. It used to break Ubuntu for me (like beyond repair and needed a full reinstall). I agree, I wish there was more consensus about how to lock down DNS traffic. It's surprising to me that it's taken this long to start getting mainstream recognition. DNSCrypt is probably best positioned to become a standard if anything. I'm going to give the latest version a t…

That's interesting. How did it break your system? I've been using it on OS X / macOS for years. Occasionally I'd run into an ISP that blocked it or a resolver that was slow or down but the software was always solid.

It messed up the network-manager/DNS iirc, though this was a while ago as I mentioned. The problem had something to do with the configuration of the Ubuntu package which was kinda fucked up so that didn't help matters, this is pre-16.04 so I'm hoping it got sorted out later on.

Re: The Big DNS Privacy Debate at FOSDEM

#55

Post by belorn »

_null_ wrote: post #33
belorn wrote: post #15

Through the two major DNS privacy talks on FOSDEM I felt a bit at odd that so much effort is being put into the idea that giving all information to google will give best privacy. In basic security theory we talk about assets that need to be defended, and attackers we need to defend against. Why give everything to a company which revenue is based on breaking privacy? It sound completely incompatible with the idea of p…

>Running your own resolver will give the authoritative servers the ip address of the request, but does this leak any assets to any potential attacker? The owner behind the authoritative servers already get the web logs so what additional information is being leaked. This is addressed in the panel. The argument is that there is some "privacy mixing" because owner of the authoritative server only sees a highly-traffick…

Yes, the authoritative server get less data from the DNS server but the owner of the domain already get the information from web server logs and similar sources. I do not see how dns mixing provide any privacy in any common threat model.

In the first case a client that request a webpage contact company X authoritative server with private information [IP ADDRESS], creating a record on the DNS server, and then visit company X web server creating a second record at the same company with the same [IP ADDRESS].

In the second case a client request a webpage of company X by contacting google, creating a record on google DNS server with [IP ADDRESS], and then visits company X and create a record there with [IP ADDRESS].

In one case one company has the data, and in the second case two companies has the data. It does not make any sense.

Re: The Big DNS Privacy Debate at FOSDEM

#56

Post by effie »

rini17 wrote: post #22

Is the research of homomorphic encryption far enough that it's practical to implement for DNS? The server would accept DNS queries using such cryptographic algorithms on encrypted database, that he nor anybody else can't say which record was queried. Only the client.

I think the science is there and the technology exists as a proof of concept [1]. The hard part, as is often the case, is getting the providers to adopt it and users to use it.

[1] Cristofaro, Lu, Tsudik: Efficient Techniques for Privacy-Preserving Sharing of Sensitive Information https://eprint.iacr.org/2011/113.pdf

Re: The Big DNS Privacy Debate at FOSDEM

#57

Post by wtmt »

bubblethink wrote: post #49
wtmt wrote: post #7

In India, several websites get blocked by different ISPs based on some highly unsubstantiated petitions to some court that doesn’t understand what the right move is and just sends the list of domains to be blocked to some ISPs, who gladly comply without any checks or questions. Users see a message saying that the site has been blocked because of some order from the Department of Telecommunications. There is no grieva…

Anecdotal: DNS based censorship and blocking used to be a thing back in the day in India, but things have moved on to other methods (sni based I think).

This probably may be true for some ISPs, but is not true everywhere. I still see sites blocked when visiting the http version, while they go through fine when visiting the https version. That means they’re not doing SNI inspection, right?

Re: The Big DNS Privacy Debate at FOSDEM

#58

Post by wtmt »

petronio wrote: post #38
wtmt wrote: post #7

In India, several websites get blocked by different ISPs based on some highly unsubstantiated petitions to some court that doesn’t understand what the right move is and just sends the list of domains to be blocked to some ISPs, who gladly comply without any checks or questions. Users see a message saying that the site has been blocked because of some order from the Department of Telecommunications. There is no grieva…

One of the options I've thought of (and I'm sure many others have as well) is to have all zones distributed in a P2P manner via ICANN. To not put too much burden on ICANN and keep things decentralized, have ICANN at the root of the DNS PKI and have all zones signed by the responsible party. This would solve a few of the big problems we have: * All sorts of MITM and evil resolver attacks would be prevented. * Since DN…

> The one big political issue that would put a stop to this is that this would cause all zones to be world readable. Many people treat zones as something private and to them exposing the zone file is the same as exposing their network. My view is that if it has a publically routable IP then it is already exposed, but not everyone shares my view.

I really don’t get this view either. There may be more cases supporting zone files being world readable than not (I can’t think of any cases for the latter except for censorship and control).

Re: The Big DNS Privacy Debate at FOSDEM

#59

Post by dagenix »

zzzcpan wrote: post #40
dagenix wrote: post #35

Earlier quoted context omitted.

A VPN provider has a much better source of data to mine than just about anyone else. On top of that, figuring out which ones deserve to be trusted is near impossible.

It doesn't have more data to mine than your ISP. It's not harder to figure out who to trust than with any other company. But unlike with any other company there is so much competition across the globe, that you can strategically pick specific jurisdictions and providers known to fight for your interests.

> It doesn't have more data to mine than your ISP.

Let's say you are behind a NAT and then you sign on to your VPN. You've helpfully disambiguated yourself from everyone else behind the NAT. Let's say you head out to a coffee shop and sign in to you VPN. Your ISP can't monitor you, but your VPN provider could.

> It's not harder to figure out who to trust than with any other company.

Have you ever looked for VPN reviews? There are many sites that seem to do nothing except review VPNs. One example: https://www.trusted-vpn.com/. And its "reviews" are basically all advertising copy. So, maybe you check out a bigger name site: https://www.pcmag.com/article2/0,2817,2403388,00.asp. And ... it's more advertising copy. The third sentence in the article: "Everyone ought to be using a virtual private network, or VPN, as often as possible" - which again, sounds more like an article trying to push VPN sales (with helpful affiliate links!) than to provide actual reviews.

And the thing is, let's say you do find some site that is both trustworthy and doesn't seem to be trying to push you to click an affiliate link. What can a reviewer actually tell you about how you should trust the VPN company? Basically all they can do is read the privacy policy and rate that - which is absolutely no better than believing Google or Cloudflare when they say they won't track you with their DNS servers.

So, by all means use a VPN - but don't trust it.

Re: The Big DNS Privacy Debate at FOSDEM

#60

Post by throw2016 »

There is a lot of misinformation and false choices. The ISP scaremongering seen here is not real and only serves to further entrench SV based global surveillance data collection unimpeded.

An ISP is local, accountable to its customers and more important subject to local laws that can be enforced. An added benefit is ISPs cannot collect, collate and correlate vast amounts of global user data. This is a huge win for wider society.

Compare that to unaccountable global organizations built on stalking and hoovering up every single piece of user data with zero regulation and subject to and support of their own home governments.

With this already in play 'concern' with localized ISPs cannot be justified without first offering more immediacy and potent solutions to the larger global surveillance problem.

Post reply on HN