231–240 of 525 posts
Earlier quoted context omitted.
If your network allows TLS to an arbitary DOH server it allows VPN over TLS to an arbitrary server
A lot of networks block VPNs via port number + DPI, but can't really block DNS over HTTPS if it looks like a connection to any other HTTPS website.
Now port 53 can and often is intercepted (but sometimes it gets through when 443 doesnt)
Earlier quoted context omitted.
The main problem with keeping sites http is that someone in the middle can modify the content and inject arbitrary code, be it ads, crypto mining or just a redirect to a worse website. Therefore I believe it should be a social duty to make everything https so as to ensure that we don’t create something that can be used to harm others. I didn’t use to think like this until I actually tried it out by going to a mall an…
> The main problem with keeping sites http is that someone in the middle can modify the content and inject arbitrary code I keep hearing this as a plausible excuse, yet I've never seen any proof of such. non-https does make it possible but has anyone got any source where someone has been victim of such attacks?
Earlier quoted context omitted.
It's part of the culture of making everything web terribly complicated, which has resulted in the death of all but three web browsers. It's now practically impossible to write a new web browser from scratch, unless you're a mega corp with endless resources and a grudge against Google, and they're still adding more complexity every day.
The web started out as a very optimistic project with no security and a lot based on trust. As it evolved a lot of security had to be bolted on which now makes it a bit more complicated than in the early days. But what's the alternative? Of course a perfect protocol where nothing needs to be added later would be great, but that's not very realistic.
The amount of APIs that need to be implemented to be considered even a basic web browser is so huge that it's not an approachable project for just about any organization, and as an individual it's just not possible.
I've used this for a few months now. It ugrades non-https connections on secure pages automatically. Very useful. Even big sites like microsoft, google images serve things over http dom.security.https_only_mode = true
For example: Twitter would periodically refuse to load. You'd have to force refresh Twitter for it to load once again.
Earlier quoted context omitted.
There are good reasons to insist on the use of HTTPS for all sites on the public web, with no exceptions or excuses. This topic has cropped up before: • https://news.ycombinator.com/item?id=21912817 • https://news.ycombinator.com/item?id=24640183 • https://news.ycombinator.com/item?id=22147858
These links list literally SOME and not ALL cases that need encryption.
I’m surprised at the negative knee-jerk reaction. I actually love this idea immediately. It encapsulates something I kind of already wanted when using HTTPS Everywhere. This doesn’t guarantee the transport is end-to-end secure; I’m sure plenty will strip the encryption at an LB and then possibly send it back over the internet. But, I think it’s a good addition nevertheless. Here’s to hoping for more DoH and encrypted…
I have mixed feelings about what you wrote. 100% with you that by itself, browser HTTPS-only mode (even by default) is A Good Thing. In isolation, this is a no-brainer and Mozilla's doing the right call. I'm not happy with DoH though, at all. I fall in the crowd who wants to control my own DNS on my own devices (and I do realize that for those less technically knowledgeable, the status quo is putting that in the hand…
None of this - DoH, nor HTTPS-only - is required. It's not even on by default (yet). If you have some specific wishes; it's trivial to pick a different DNS system, or leave https-only off.
Additionally, DoH and https-only aren't really closed or locked in in any way. There's a cloudflare-base DoH option that's used by default, but just as you can pick your own DNS servers, you can also pick your own DoH servers. Sure, it's new (and thus not on by default), so selection is still fairly limited. But even ISPs are starting to offer DoH, and surely others will too. There's no reason to assume that you won't soon be able to pick from several choices for your DoH setup, including local or LAN options.
You mention pihole; and though I've never used it, they do have a page on DoH, and a superficial skim doesn't have any huge issues: https://docs.pi-hole.net/guides/dns-over-https/ - and looks like it's based on code described here https://developers.cloudflare.com/1.1.1.1/dns-over-https/clo... - and that supports upstream and downstream DoH, by the looks of it.
In other words: all change has some friction, but if you want local control: you still have it. The only thing you really lose is the ability for networks to hijack DNS of devices that don't trust it. And that's a feature, right? If you trust the network; sure, use that DNS if you want. But if you don't: better that its easier to avoid control by that network.
What downsides does DoH have?
I wonder how it will work against websites like http://neverssl.com (which helps me to log in to some wifi portals, HTTPS Everywhere shows the prompt for a temporary exception.)
It's not even hard, all that's needed is to add an "authentication URL" field to DHCP and IPv6 router advertisements.
Earlier quoted context omitted.
> I want my OS to do DNS - including DOH, not my browser. The cat is out the bag, so to speak. I foresee a lot of adware, spyware, and malware leveraging DoH now to evade just about every DNS-based monitoring/blocking/provisioning solutions. Anyway, the right layer to monitor for Internet traffic has always been the IP layer (VPNs notwithstanding).
This has always felt like a strange concern to me. It’s a bit like refusing to have gloves in your house, so that a burglar can’t borrow your gloves to avoid leaving fingerprints. Adware, spyware, and malware has always had the ability to avoid system DNS. At its most basic, they could hardcode lists of IPs into their malicious code. At its most complex, the same building blocks that DoH/DoT use were available to the…
> DoH in Firefox simply makes the above issue harder to ignore.
That's exactly what I mean [0]. The cat's always been there so to speak but now it is out there roaming around harder to ignore.
[0] https://news.ycombinator.com/item?id=25123487 and https://en.wikipedia.org/wiki/Script_kiddie
There's a phenomenon I observe quite regularly in tech. A problem exists and creative people develop an innovative solution to said problem. The solution then becomes popular and a singular goal of uncreative people who deploy said solution everywhere and push it to its logical extreme. I remember seeing this in the mid-2000s when HTML tables were shunned in favour of "divs". I saw people reinventing tables using div…
You can be assured that you are actually talking to them. That's a big step up from not being able to do that.
Earlier quoted context omitted.
The main problem with keeping sites http is that someone in the middle can modify the content and inject arbitrary code, be it ads, crypto mining or just a redirect to a worse website. Therefore I believe it should be a social duty to make everything https so as to ensure that we don’t create something that can be used to harm others. I didn’t use to think like this until I actually tried it out by going to a mall an…
> The main problem with keeping sites http is that someone in the middle can modify the content and inject arbitrary code I keep hearing this as a plausible excuse, yet I've never seen any proof of such. non-https does make it possible but has anyone got any source where someone has been victim of such attacks?
[1]https://www.privateinternetaccess.com/blog/kazakhstan-tries-...
[2]https://security.stackexchange.com/questions/157828/my-isp-b...