DNS-over-HTTPS Policy Requirements for Resolvers • Hacker News Board

Re: DNS-over-HTTPS Policy Requirements for Resolvers

#221

Post by JohnFen » Wed, Apr 10, 2019, 10:09 PM UTC

LinuxBender wrote: post #193

Spivak wrote: post #186

Earlier quoted context omitted.

Blocking RF is illegal if it's done with the intent you describe. It's fine if your building gets terrible or no reception but if you purposely design it that way you're not protected.

There are a number of organizations and businesses that block RF. Their legal team review the local statutes and the employees sign acceptance in the AUP onboarding documentation. To your point, there are certainly countries and jurisdictions that do not permit blocking RF or have strict exceptions.

> Their legal team review the local statutes

In the US, local statutes and AUPs don't enter into it. This is federal law. You're right, there have been a number of organizations that have done this -- and enough of them have been fined for it that the number is much smaller than it used to be.

Re: DNS-over-HTTPS Policy Requirements for Resolvers

#222

Post by bzbarsky » Wed, Apr 10, 2019, 10:13 PM UTC

slim wrote: post #13

tl;dr Firefox will ignore your DNS settings and use his own (DoH)

Nothing in the article says anything about that.

The article talks about Firefox behavior when DoH is enabled. It's not enabled by default. The article doesn't say it's getting enabled by default, or under what conditions it might get enabled by default.

Re: DNS-over-HTTPS Policy Requirements for Resolvers

#223

Post by stock_toaster » Wed, Apr 10, 2019, 10:16 PM UTC

bzbarsky wrote: post #219

protomyth wrote: post #173

Earlier quoted context omitted.

> This is something you have to opt in to. Does it come turned off by default?

DNS-over-HTTPS in Firefox? Yes, it does, at the moment. See https://searchfox.org/mozilla-central/rev/dd7e27f4a805e4115d... -- 0 means it's off.

5 is "off by choice"

Re: DNS-over-HTTPS Policy Requirements for Resolvers

#224

Post by JohnFen » Wed, Apr 10, 2019, 10:20 PM UTC

bluejekyll wrote: post #92

I’ve begun to think that differences of opinion on the benefits and/or negatives of DoH come from two different perspectives on what DNS is for. What I perceive from the debate is generally that people who dislike DoH tend to perceive it as a network plane protocol, one that is designed for network operations and nothing more (layer 3/4 if you will). Whereas people who tend to want privacy and the other features of D…

> I believe that the network level concerns over DoH are a little disingenuous

I disagree. The problem with DoH is that it masquerades DNS lookups as web traffic. Other means of doing DNS lookups, encrypted or not, can be easily determined to be DNS lookups and handled according to the network policies.

By disguising the lookups as web traffic, it means that I can no longer leave web traffic alone. I have to MITM HTTPS now. If they were happening on their own ports, I would have less invasive methods available, such as running my own resolver.

Re: DNS-over-HTTPS Policy Requirements for Resolvers

#225

Post by buran77 » Wed, Apr 10, 2019, 10:23 PM UTC

simondedalus wrote: post #91

close04 wrote: post #79

Earlier quoted context omitted.

Saving time by applying a non-solution 9like removing one browser instead of treating the root cause) is not actually saving anything. You just kick the problem further down the road. Firefox prefs are documented even if not in the most user friendly way [0][1][2][3]. For the most part performing some basic hardening and other useful config on the browser takes less than a day. A person with some IT background should…

no, using the nuclear option of removing the browser outright when others work is the smart, efficient option that someone who actually works in IT with limited resources would (and should) use. this stuff about finding all the right config files during "basic hardening" and having it just work is the stuff of armchair commenters and people who do IT/security on a well funded, sufficiently redundant team. assuming th…

How efficient is the "nuclear option" when all browsers have DNS-over-HTTPS? By then you have a few options:

- Implement a proxy to break SSL.

- Configure the browsers to disable DOH (GPO or local configuration) for as long as it's an option.

- remove all browsers because that's the solution you already have in place.

I wholeheartedly disagree with any resolution that just hides or ignores the issue especially when it's scheduled to become more or less standard.

Re: DNS-over-HTTPS Policy Requirements for Resolvers

#226

Post by stock_toaster » Wed, Apr 10, 2019, 10:26 PM UTC

AnaniasAnanas wrote: post #8

Still no explanation on why dns-over-https rather than the already widespread dnscrypt or the lesser known dnscurve, dns-over-quic, and dns-over-tor.

Because DoH is really all about serving ads, no matter what.

Re: DNS-over-HTTPS Policy Requirements for Resolvers

#227

Post by buran77 » Wed, Apr 10, 2019, 10:31 PM UTC

nykolasz wrote: post #39

danarmak wrote: post #31

Earlier quoted context omitted.

> Unfortunately, on our school network, we also allow BYOD (students with their own laptops and ipads), so we will have to have some strict rules to block DoH, the same way we block proxies and vpns. How can you block DoH without doing MITM on all outgoing HTTPS? For that matter, how can you block HTTPS based VPNs like OpenVPN? ETA: I understand you can block IP addresses of DNS resolvers that support DoH. I assumed…

IP-based and domain-based. We have a long list of domains/IPs used by VPN providers. Won't prevent someone from setting up its own SSH-based proxy on port 443, but covers things that are accessible and easy to use by young students (talking about elementary school on our case). Again, we are talking about a school network with young kids (under 12/13).

"Again, we are talking about a school network with young kids (under 12/13)"

As school network admin in another life I came to the conclusion that there is no limit to the ingenuity of pupils even at that age. And I'm just thinking that even big hitters like Netflix have problems properly filtering out VPN services and the likes. Anything-as-a-service makes it all the more accessible to anybody even for free.

Try to disable DOH if you can for now while you prepare something more permanent and resilient. Kids viewing pornographic material in school is a lawsuit waiting to happen I think.

Hopefully for BYOD parents will take a bit of the load off. At least tech savvy ones tend to make sure the device is properly "insulated". Plenty of lockdown options out there for this.

Re: DNS-over-HTTPS Policy Requirements for Resolvers

#228

Post by JohnFen » Wed, Apr 10, 2019, 10:46 PM UTC

bzbarsky wrote: post #222

slim wrote: post #13

tl;dr Firefox will ignore your DNS settings and use his own (DoH)

Nothing in the article says anything about that. The article talks about Firefox behavior when DoH is enabled. It's not enabled by default. The article doesn't say it's getting enabled by default, or under what conditions it might get enabled by default.

At the very start of the linked article, it says this:

"Over the past few months, we’ve been experimenting with DNS-over-HTTPS (DoH), a protocol which uses encryption to protect DNS requests and responses, with the goal of deploying DoH by default for our users."

Re: DNS-over-HTTPS Policy Requirements for Resolvers

#229

Post by glennpratt » Wed, Apr 10, 2019, 11:02 PM UTC

JohnFen wrote: post #202

shawnz wrote: post #163

Earlier quoted context omitted.

Regarding your second point, this change will improve privacy for your clients and make it harder for bad actors to take advantage of your network. So what's not to like? Just because your old tooling won't work anymore doesn't mean that this change is a bad thing for clients.

> make it harder for bad actors to take advantage of your network. How so? It looks to me like it makes it easier for bad actors to take advantage of my network, by making it harder to detect and block DNS lookups.

You are focused on unsophisticated bad actors if DNS is all it takes to block.

Re: DNS-over-HTTPS Policy Requirements for Resolvers

#230

Post by bluejekyll » Wed, Apr 10, 2019, 11:08 PM UTC

JohnFen wrote: post #224

bluejekyll wrote: post #92

I’ve begun to think that differences of opinion on the benefits and/or negatives of DoH come from two different perspectives on what DNS is for. What I perceive from the debate is generally that people who dislike DoH tend to perceive it as a network plane protocol, one that is designed for network operations and nothing more (layer 3/4 if you will). Whereas people who tend to want privacy and the other features of D…

> I believe that the network level concerns over DoH are a little disingenuous I disagree. The problem with DoH is that it masquerades DNS lookups as web traffic. Other means of doing DNS lookups, encrypted or not, can be easily determined to be DNS lookups and handled according to the network policies. By disguising the lookups as web traffic, it means that I can no longer leave web traffic alone. I have to MITM HTT…

Can you describe the threat model your trying to account for?

The reason I made that statement has to do with the means by which DNS can easily be circumvented and direct encrypted connections used instead. This means using DNS introspection as a means for security doesn't buy you much, DoH just makes that more apparent.