Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

DNS-over-HTTPS Policy Requirements for Resolvers

blog.mozilla.org

Post reply on HN
Print view View original

201–210 of 301 posts

Re: DNS-over-HTTPS Policy Requirements for Resolvers

#201

Post by Spivak »

dogecoinbase wrote: post #95
raxxorrax wrote: post #42

Earlier quoted context omitted.

I am no sysadmin but working closely with some. I have never seen any case where HTTPS-MITM helps. Yes, theoretically it does allow us to scan for malicious content in a secured connection. Brilliant, but that are not the attack vectors they are concerned about. So what is left is that breaking up TLS just infringes on privacy and allows for tighter control. The security aspect is laughable. Users are angry that thei…

I am no sysadmin but working closely with some. Some of your best friends, eh? The point of MITMing HTTPS in an enterprise setting is not inbound content scanning (though that's pretty useful to), it's to prevent outbound transfer of secrets/HIPAA or PII data/financial data, and it's a regulatory requirement for some industries. Besides, the point of DoH is to move DNS into the browser, which Google also controls, to…

> it's a regulatory requirement for some industries.

It won't be when it's functionally impossible, which seems to be the point.

You do see the light at the end of the tunnel, right? Browsers shipping their own unmodifiable CA stores and disrespecting 3rd-party CAs signatures for public DNS names.

Re: DNS-over-HTTPS Policy Requirements for Resolvers

#202

Post by JohnFen »

shawnz wrote: post #163
EvanAnderson wrote: post #156

Earlier quoted context omitted.

Macro-level view: The Mozilla Foundation may think that DNS-over-HTTPS is about "safety", but they're unwittingly furthering the agenda of those who would profit from the Internet not being decentralized. A decentralized Internet filled with devices that end users can control, should they choose, is a good thing for society, I'd argue. DNS-over-HTTPS is another piece of technology that can be used to eliminate that.…

Regarding your second point, this change will improve privacy for your clients and make it harder for bad actors to take advantage of your network. So what's not to like? Just because your old tooling won't work anymore doesn't mean that this change is a bad thing for clients.

> make it harder for bad actors to take advantage of your network.

How so? It looks to me like it makes it easier for bad actors to take advantage of my network, by making it harder to detect and block DNS lookups.

Re: DNS-over-HTTPS Policy Requirements for Resolvers

#203

Post by swiley »

shawnz wrote: post #151
EvanAnderson wrote: post #133

Earlier quoted context omitted.

It's not a nefarious plan to stop me from doing what I want in a FOSS browser on a PC where I can compile and run what I want. It will be used that way, however, on locked-down devices users pay for but don't actually own.

Then don't buy such a device which clearly doesn't meet your needs. Why should every personal computing device on the planet be tailored to your requirements, at the cost of safety for the majority of other users? Most people don't use PiHole, they use Adblock or uBlock which are not affected by this. It's not as though they are taking away your ability to use adblocking technology.

> Then don't buy such a device which clearly doesn't meet your needs.

That would be nice in an ideal world, unfortunately most of us live in reality.

Re: DNS-over-HTTPS Policy Requirements for Resolvers

#204

Post by nixgeek »

JohnFen wrote: post #188
nykolasz wrote: post #27

I replied sub-thread, but adding here to give some more visibility to some of the issues DoH is causing and will cause: I work at a k12 school and I am involved on many k12 IT communities. Some schools already removed Firefox from the students computers because it was being used as a "VPN" by some elementary students to access porn - at school. Guess what this VPN was? Just DNS over HTTPS. There is a fine line betwee…

I consider DoH too dangerous to allow on my own network, so here's what I did: if you want to use HTTPS from my network, you need to install my root cert. I then proxy all HTTPS traffic to detect and drop DoH exchanges. I expect that we'll see this sort of thing more and more.

I’d consider you installing a root onto my device far more dangerous than DoH, because how do I know you’re only dropping DoH, and not actively logging everything? I have to assume you are evil.

As a consequence I would not use your network. This may also be considered success from your point-of-view.

Re: DNS-over-HTTPS Policy Requirements for Resolvers

#205

Post by Murrawhip »

stirfrykitty wrote: post #199
vetinari wrote: post #177

Earlier quoted context omitted.

If it improves privacy for the clients, it also improves privacy for the malware, and you won't be able to monitor or be alerted of it.

Most modern firewalls can decrypt/re-encrypt all traffic on the fly. The end user doesn't even notice. I've done this at my last two jobs. More here: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?...

What? The end user does notice if you haven't added the CA to the end user's PC.

Re: DNS-over-HTTPS Policy Requirements for Resolvers

#206

Post by JohnFen »

majke wrote: post #14
EvanAnderson wrote: post #2

I hadn't been paying much attention to DNS-over-HTTPS, but I recently listened to a talk that Dr. Paul Vixie (of BIND fame) gave that where DNS-over-HTTPS was discussed: https://youtu.be/OxFFTxJv1L4?t=2799 After hearing Dr. Vixie discuss DNS-over-HTTPS from a network operator perspective I'm a lot more wary of the protocol.

(full disclosure: I'm affiliated to Cloudflare, but opinions here are my own of course) Thanks for posting this. I knew Paul is against DoH, but never understood his specific arguments. He has great comment about DoT (dns over TLS) couple of minutes before the linked youtube (I agree with him on that). Personally I'm not an "owner" of the networks I'm connecting to. My home router is managed by my ISP, I don't run pi…

> Personally I'm not an "owner" of the networks I'm connecting to.

But I am the owner of my own network, and DoH reduces my ability to protect it. That is the main (but not only) reason why I strongly object to DoH.

> I think this train has passed.

I suspect the battle has just begun. For example, my response to DoH has been to implement a MITM packet inspection system on my network to regain control over this. This means that DoH will not work from my network. I expect that we're going to see this sort of thing more and more.

Re: DNS-over-HTTPS Policy Requirements for Resolvers

#207

Post by [deleted] »

jedisct1 wrote: post #80
danyork wrote: post #55

Earlier quoted context omitted.

DNSCrypt and other solutions typically involve changes to the DNS resolver in the underlying operating system. That's a lot harder to get changed and deployment can take a long time. DOH can be implemented directly inside of the web browser application, since those browsers are obviously already doing everything over HTTPS. So the browser developers just have to build in a DNS client. From their perspective, I would…

Yandex has been shipping support for DNSCrypt in their web browser since 2016.

[deleted]

Re: DNS-over-HTTPS Policy Requirements for Resolvers

#208

Post by AnaniasAnanas »

JohnFen wrote: post #189
josteink wrote: post #138

Earlier quoted context omitted.

> DNS should be a system-level setting, not an App-level setting. I would go even further: Any app trying to bypass the system-level network settings (like with DoH) should be considered malicious and possibly malware. This is what spam-bots used to do back in the days. Now let’s add Firefox to the list.

> Any app trying to bypass the system-level network settings (like with DoH) should be considered malicious and possibly malware. This is my point of view precisely.

Or trying to help the user "jailbreak" out of a restricted environment.

Re: DNS-over-HTTPS Policy Requirements for Resolvers

#209

Post by JohnFen »

nixgeek wrote: post #204
JohnFen wrote: post #188

Earlier quoted context omitted.

I consider DoH too dangerous to allow on my own network, so here's what I did: if you want to use HTTPS from my network, you need to install my root cert. I then proxy all HTTPS traffic to detect and drop DoH exchanges. I expect that we'll see this sort of thing more and more.

I’d consider you installing a root onto my device far more dangerous than DoH, because how do I know you’re only dropping DoH, and not actively logging everything? I have to assume you are evil. As a consequence I would not use your network. This may also be considered success from your point-of-view.

That's totally fair. My network, my rules. You are not required to use my network.

However, I'm not completely heartless. I also run an open WiFi AP that, although limited, is available for guests who aren't comfortable with my security measures. You can't reach the rest of my network through it, but it's there and will get you internet access.

Re: DNS-over-HTTPS Policy Requirements for Resolvers

#210

Post by syshum »

stirfrykitty wrote: post #199
vetinari wrote: post #177

Earlier quoted context omitted.

If it improves privacy for the clients, it also improves privacy for the malware, and you won't be able to monitor or be alerted of it.

Most modern firewalls can decrypt/re-encrypt all traffic on the fly. The end user doesn't even notice. I've done this at my last two jobs. More here: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?...

That works by Man in the middle attacks of SSL

and Only works on Enterprise Networks for devices owned by the enterprise because the Enterprise Installs their own Root Certs on all devices that "tricks" the browsers into believing they are "google.com" not the real google.com

Post reply on HN