Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

DNS-over-HTTPS Policy Requirements for Resolvers

blog.mozilla.org

Post reply on HN
Print view View original

81–90 of 301 posts

Re: DNS-over-HTTPS Policy Requirements for Resolvers

#81

Post by AndyMcConachie »

gruez wrote: post #54
nykolasz wrote: post #27

I replied sub-thread, but adding here to give some more visibility to some of the issues DoH is causing and will cause: I work at a k12 school and I am involved on many k12 IT communities. Some schools already removed Firefox from the students computers because it was being used as a "VPN" by some elementary students to access porn - at school. Guess what this VPN was? Just DNS over HTTPS. There is a fine line betwee…

Sounds like the bigger problem is that your porn filters can be circumvented with a DNS change. If you're banning DoH, you also need to ban custom hosts files.

DoH is different because it masquerades as HTTPS traffic. You can block DNS traffic sent to servers configured in custom hosts files, but you can't block DoH unless you either have a list of every DoH server in existance, or block all HTTPS traffic.

That's kind of the entire point of DoH. DNS-over-TLS (DoT) provides TLS encryption for DNS traffic, but runs over port 853 so network operators can control where queries go.

Re: DNS-over-HTTPS Policy Requirements for Resolvers

#82

Post by CydeWeys »

Tushon wrote: post #65
CydeWeys wrote: post #58

Earlier quoted context omitted.

It sounds like they have root access on the computers in question. There's plenty of options thus available to them.

The OP talked about BYOB, which rarely includes "root access" (either via a root cert for decrypting traffic or admin level access to the machine)..

I was referring to the machines they were preventing the installation of Firefox on.

For BYOD, I don't know what you're gonna do. Many students have smartphones too (some with tethering), and you can't control what they look at on those either. Plus, even if the school could somehow magically lock everything down 100% within the confines of the school building, the students can still get access to whatever at home, or using coffeeshop WiFi, or whatever.

Re: DNS-over-HTTPS Policy Requirements for Resolvers

#83

Post by kodablah »

nykolasz wrote: post #27

I replied sub-thread, but adding here to give some more visibility to some of the issues DoH is causing and will cause: I work at a k12 school and I am involved on many k12 IT communities. Some schools already removed Firefox from the students computers because it was being used as a "VPN" by some elementary students to access porn - at school. Guess what this VPN was? Just DNS over HTTPS. There is a fine line betwee…

Curious, how does your school solve this with students' phones? Have y'all considered requiring mandatory monitoring apps? Or cell phone data jammers and requiring them use y'all's wifi and require a CA cert install?

Re: DNS-over-HTTPS Policy Requirements for Resolvers

#84

Post by cortesoft »

cremp wrote: post #12
flarex wrote: post #4

Earlier quoted context omitted.

His main argument seems to be that the network operator should have control over DNS requests for safety reasons. Control and monitoring. This is the antithesis of privacy and encryption. I wouldn't be surprised if he was pro http over https either.

Because they should! Think a corporate network. If I as a sysadmin set our DHCP options to give out our own resolvers, I expect that every machine on the domain to use ours. DoH breaks that completely; and hence the network operator should have the final say. As a sysadmin myself, if browsers are overriding the basic model of top down, and it hurts me, because when something is wrong, I cant just look on my machine,…

Do you feel the same way about a user running a local resolver with caching, or modifying their hosts file to bypass dns?

Re: DNS-over-HTTPS Policy Requirements for Resolvers

#85

Post by tlrobinson »

nykolasz wrote: post #70
pwnna wrote: post #52

Earlier quoted context omitted.

To add to this issue from a personal level: for those who use a Pihole or operate other internal services from within their own home network will now have to change the settings for _every application_ using DoH on that network. This could become a major hassle if the number of devices and owners become large. There's not even a work around for this because I do not directly manage family members' devices (nor would…

Yep. What happens when Chrome adds DoH support? And Safari? And whatever Gaming app the kids download? Suddenly it will become impossible to manage and maintain. Not even talking about the troubleshooting nightmare. DNS should be a system-level setting, not an App-level setting.

How far off are we from DoH being supported by common operating systems, DHCP, etc?

It would be nice if these apps could detect whether the system is using DoH and only fall back to their own DoH resolver in the case they're using "legacy" DNS.

Re: DNS-over-HTTPS Policy Requirements for Resolvers

#86

Post by kodablah »

> Our plan is to select a set of Trusted Recursive Resolvers (TRRs) that we will use for DoH resolution in Firefox. Those resolvers will be required to conform to a specific set of policies that put privacy first.

So can I manually set one myself to my local pi-hole instance? I have already been setting the TRR about:config values (ala [0]), will that remain?

I am wary of Mozilla becoming the arbiter of acceptable DNS providers for me, so I should be able to override it if I want.

0 - https://blog.stackpath.com/serverless-dns-over-https-at-the-...

Re: DNS-over-HTTPS Policy Requirements for Resolvers

#87

Post by kodablah »

3xblah wrote: post #71

"To that end, today we are releasing a list of DOH requirements, available on the Mozilla wiki, that we will use to vet potential resolvers for Firefox. The requirements focus on three areas: 1) limiting data collection and retention from the resolver, 2) ensuring transparency for any data retention that does occur, and 3) limiting any potential use of the resolver to block access or modify content. " I sometimes use…

> I wonder if that would violate Mozilla's requirements?

The real question is if you're allowed to use your own resolver that conforms to your requirements if they differ from Mozilla's, even if a bit buried from the default list,

Re: DNS-over-HTTPS Policy Requirements for Resolvers

#88

Post by packet_nerd »

AndyMcConachie wrote: post #81
gruez wrote: post #54

Earlier quoted context omitted.

Sounds like the bigger problem is that your porn filters can be circumvented with a DNS change. If you're banning DoH, you also need to ban custom hosts files.

DoH is different because it masquerades as HTTPS traffic. You can block DNS traffic sent to servers configured in custom hosts files, but you can't block DoH unless you either have a list of every DoH server in existance, or block all HTTPS traffic. That's kind of the entire point of DoH. DNS-over-TLS (DoT) provides TLS encryption for DNS traffic, but runs over port 853 so network operators can control where queries…

> You can block DNS traffic sent to servers configured in custom hosts files

You're thinking of configuring a custom DNS server, which is not related to the hosts file. The hosts file replaces DNS so there would be no network traffic to block.

Theoretically a kid who really wants his porn could manually add the name-to-IP entries for his favorite sites to his local hosts file, completely bypassing any DNS based filtering you might have on the network.

Re: DNS-over-HTTPS Policy Requirements for Resolvers

#89

Post by shittyadmin »

ronsor wrote: post #78
judge2020 wrote: post #41

Earlier quoted context omitted.

I don't think there is a good solution. Yes, you own the network and think you should be technologically able to block access to certain websites (which the school has the right to do), but ISPs also "own" the network and would also be able to block access to certain websites if it were possible with DoH+eSNI. I guess a solution is MDM, but that's still getting students to install something on their device.

I would not install a school managed backdoor on my device.

So your options are then:

- Cry about it and hope they change the policy (they won't)

- Accept using your cell data at school instead of their wifi (works, but is expensive)

- Bypass it using a VM (requires moderate technical knowledge, networking skills and possibly the ability to bypass vm detection)

- Reverse engineer it and crack it to behave the way you want (requires some pretty advanced technical skills)

As such, the vast majority of people will just go ahead and install it. This is the problem with these sorts of applications...

Post reply on HN