Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Mozilla’s DNS over HTTPs

blog.mozilla.org

Post reply on HN
Print view View original

181–190 of 777 posts

Re: Mozilla’s DNS over HTTPs

#181

Post by JoshTriplett »

Legogris wrote: post #25
bepvte wrote: post #22

Earlier quoted context omitted.

DNS over TLS is just DoH but with an easily blocked separate port

Which is great from a local sysadmin perspective. With DoH I have no control of what various apps on devices on my devices are querying.

Or in other words, DoH works better on hostile networks because it looks like just one more HTTPS connection.

That's an intentional design feature. You're attempting to intercept traffic, and any mechanism you could use to do so "transparently" could be used by any hostile network to do so.

You can still intercept traffic from cooperating devices if you want, just not transparently. That's a feature, not a bug, and the Internet will be better for it.

Re: Mozilla’s DNS over HTTPs

#182

Post by SAI_Peregrinus »

zaarn wrote: post #75
drenginian wrote: post #15

Earlier quoted context omitted.

>> People just run a local resolver that’s support’s these things. Nowhere do “people just run a local resolver”. Grandma and aunty Beryl certainly don’t, nor does any other ordinary person. If you want secure DNS you have to build it in to the browser. Only systems people think that this is the sort of thing that ordinary people do.

I think the better solution is "build it into the browser and wait for systems to support it natively".

So exactly what Mozilla is doing.

Re: Mozilla’s DNS over HTTPs

#183

Post by Avamander »

tbyehl wrote: post #152
nicolaslem wrote: post #17

Earlier quoted context omitted.

My main gripe is that before DoH, setting a custom DNS via DHCP was enough to get all devices on a network and all applications on these devices to use a custom DNS. Now we are headed to a future where each software vendor decides how to make DNS queries. I can predict that all of them will apply their own custom heuristics to detect things like split-horizon.

> before DoH, setting a custom DNS via DHCP was enough That ship had already sailed. You also have to run your own DNS, allow DNS egress only from your own DNS, and DNAT the rest back to yours in order to un-break all the things with hard-coded resolvers.

Same with NTP surprisingly. Literally everything I have talks to a NTP server once in a while, but only Linux machines actually ask the network's NTP servers.

Re: Mozilla’s DNS over HTTPs

#184

Post by 72deluxe »

JoshTriplett wrote: post #171
72deluxe wrote: post #112

Earlier quoted context omitted.

So I should block outgoing TLS requests to be able to stop DoH? Seems a bad idea.... At least with DNS I could run a local DNS server and block outgoing port 53 from anything else. Now I no longer have this option and each app gets to look up what it wants, when it wants. Sure, it's great that my ISP cannot see what's in these requests but nor can I! And it also means that any application (eg. any Google product) can…

Don't put devices on your network if you don't want to give them network access. And don't block technologies and protocols that help people protect themselves just because they also help devices protect themselves from you MITMing their connections. If you want to run a device reverse-engineering lab you have more work to do to break the security of a device. Also remember that if you can break the security of a dev…

"The correct behavior for devices is to treat the intermediate network between them and the servers they talk to as hostile."

Thanks for this - I had not thought of that.

Looks like I'll be keeping my "smart" TV off the network forever then (my old LG used to send a network request whenever I pressed any button on the remote)! And all my Android devices, Windows 10 devices and my Apple TV and MacBook too. (This is only partially sarcasm - I can't really trust anything these days it seems...). The amount of dialling-out they all do is astronomical. The only solution appears to be going full 1980s and not being on the network. The dream is over.

At least my Raspberry Pi can be trusted. Other than the GPU chipset...

Re: Mozilla’s DNS over HTTPs

#185

Post by Avamander »

vetinari wrote: post #168
kibwen wrote: post #132

Earlier quoted context omitted.

We are headed toward that future because the broader network has proven that it cannot be trusted; it should come as no surprise that user agents would develop defense mechanisms. If this is another step toward ensuring that ISPs are nothing but dumb pipes, I welcome it.

This is another step toward ensuring that _you_ won't have any visibility what applications running on your computer do, where they connect and why.

Unless OSs quickly implement DoH, if they did, software makers won't have any excuse to roll their own opaque ones, aside of malicious reasons.

Re: Mozilla’s DNS over HTTPs

#186

Post by pbhjpbhj »

krn wrote: post #77
larrysalibra wrote: post #44

Questions I couldn’t find answers to in the post or linked info about the Trusted Resolver Program: What’s in it for the Cloudflare & NextDNS? Are they getting paid to handle this traffic or paying to have the opportunity to access this data? Can users outside the US opt-in? The comment about having “no plans” to enable this outside the USA seems a bit disingenuous. Hard to believe they built this program / feature a…

> What’s in it for the Cloudflare & NextDNS? It gives them a competitive advantage in DNS industry against other B2B providers, such as NS1.

How?

Surely the only way that's possible is if they derive data about users, which they can then sell .. which is what Mozilla claim to be preventing.

Re: Mozilla’s DNS over HTTPs

#187

Post by user1980 »

vetinari wrote: post #168
kibwen wrote: post #132

Earlier quoted context omitted.

We are headed toward that future because the broader network has proven that it cannot be trusted; it should come as no surprise that user agents would develop defense mechanisms. If this is another step toward ensuring that ISPs are nothing but dumb pipes, I welcome it.

This is another step toward ensuring that _you_ won't have any visibility what applications running on your computer do, where they connect and why.

End-to-end TLS is dead.

It started with PCI compliance. Next up was Corporate IT making sure idiots weren't signing up for Dropbox with their LAN password. Schools: Well, they always used proxies with no expectation of privacy whatsoever so traffic inspection was nothing new.

In 5 years TLS-recryption -- whether through software or a hardware middlebox -- will be as ubiquitous as a NAT firewall is now. The only question is if the keys will be in the hands of the consumer or in escrow with Big Gov.

The idea that anyone in their right mind would allow uninspectable traffic to egress their network is beyond ridiculous. I'm glad that DoH is making people realize that.

Re: Mozilla’s DNS over HTTPs

#188

Post by Avamander »

bsdubernerd wrote: post #91
andridk wrote: post #20

Why isn't this being solved on an operating system level instead?

This question should be upvoted more. Under unix in general (linux, bsd and, I assume, OSX) you can change your system resolver as you please. DoH is supported by several implementations to a various degree already. You can switch right now, for everything running on your system if you wanted to! But browsers nowdays basically live under the following assumptions: - the users are dumb, and "we know what's best for yo…

I expect distros that ship a DoH-enabled resolver to force-disable DoH/DoT in browsers.

Re: Mozilla’s DNS over HTTPs

#189

Post by hnasr »

A great step indeed for websites that use static IP for a single resource. Websites that uses Server Name Indication TLS extension for shared hosting force clients to send the hostname in plain-text during TLS handshake which could be sniffed. (Reliance Jio in India is already doing it https://cis-india.org/internet-governance/blog/reliance-jio-...).

The Same thing OCSP Stapling (Online Certificate Status Protocol) extension which also sends the hostname.

Cloudflare crafted a solution for this by storing the public key of the target website along with the DNS record. So during DoH when the user asks for IP of a given host, it can also get the public key of the host. User then establishes the TCP, encrypt the SNI extension & OCSP with the public key and starts the TLS handshake.

Though ESNI doesn't seem to provide perfect forward secrecy it is a leap forward.

Re: Mozilla’s DNS over HTTPs

#190

Post by pbhjpbhj »

teekert wrote: post #139
larrysalibra wrote: post #44

Questions I couldn’t find answers to in the post or linked info about the Trusted Resolver Program: What’s in it for the Cloudflare & NextDNS? Are they getting paid to handle this traffic or paying to have the opportunity to access this data? Can users outside the US opt-in? The comment about having “no plans” to enable this outside the USA seems a bit disingenuous. Hard to believe they built this program / feature a…

Huh? It works for me in the Netherlands, at least, it is in the settings. How to confirm if I'm using it?

If you use it, presumably you can make a GDPR claim to find out way Cloudflare are doing with the data?
Post reply on HN