11–20 of 49 posts
Can DNS-over-HTTPS help to avoid this?
Not sure if it's a problem with my setup or if it's not very robust in general.
Earlier quoted context omitted.
Yes, assuming you have a non compromised browser or certificate trust chain
Tangential question: how are IP addresses in certificates validated? Cloudflare was subject to a BGP hijack of the 1.1.1/24 prefix, how does it prevent someone from running a malicious DNS server?
stubby is a localhost DNS proxy that can work for any app | browser | etc. on a network and use DoT or DoH to any of the common providers.
Given the ease with which national ISPs can MiTM these | intercept calls to Cloudflare | Quad9 | AdGuard etc. it might be good to extend either stubby or it's docs to let people know how to use it access | establish a much broader DNS proxy network to allow for indirect non obvious lookups.
Earlier quoted context omitted.
Yes, assuming you have a non compromised browser or certificate trust chain
Tangential question: how are IP addresses in certificates validated? Cloudflare was subject to a BGP hijack of the 1.1.1/24 prefix, how does it prevent someone from running a malicious DNS server?
First example of imperfection which springs to mind first for me are misconfigurations in the network which ultimately allow for leaks to be accepted. IMHO this compounded with the nature of DNS recursion across name authorities on the far side of any ASN boundaries (that may be out of your provider’s control) makes any assurances weak at best when searching for name resolution trust.
(Edit : oh and I think DNSSEC is probably another layer worth considering. But it’s also inconsistently deployed.)
(Second edit : Sorry! I made a mental leap to RPKI when I saw “BGP hijack”, “certificate”, & “IP addresses”. IIRC a webserver’s x509 certificates don’t contain an OID of any inaddr{,6}, nor cidr type. i.e. a browser doesn’t verify a httpd’s ip against anything in the cert vended. Only that the cert is signed by a chain leading to a CA trusted by the client/browser(s).)
While they've backtracked, every dictator in the world probably took notice and its only a matter of time.
Greece is already way ahead! When one tries to visit some sites like LibGen, DNS is redirected to a "no-no you shouldn't go there" page, which in turn redirects to this official finger-wagging page: https://opi.gr/edppi_block/edppi_block.html DNS hijacking was also used during the beginning of the Ukraine affair as part of an EU-wide censorship push, blocking sites like the Kremlin and Pravda, though without further…
1. Blocking or redirecting some pages when using the ISP's DNS server. This is what you're talking about. The workaround is to use a third party DNS resolver.
2. Intercepting all unencrypted DNS traffic to any DNS server and redirecting it to the ISPs' DNS servers. This is what Malaysia was planning to do.
While the DNS Privacy Project has a good many suggestions and links it might be time to upgade their "stubby" project. https://dnsprivacy.org/ stubby is a localhost DNS proxy that can work for any app | browser | etc. on a network and use DoT or DoH to any of the common providers. Given the ease with which national ISPs can MiTM these | intercept calls to Cloudflare | Quad9 | AdGuard etc. it might be good to extend e…
People having their unique implementation of punctuation marks irks me...
Can DNS-over-HTTPS help to avoid this?
-Digi redirected ALL traffics on destination port 53 to their own DNS server. Thus DoH unaffected.
-Maxis redirected traffics from some mainstream public DNS servers (Google, Cloudflare, Quad9) on destination port 53 to their own DNS server. Thus DoH unaffected.
-TM is the most evil, they redirected traffics from some mainstream public DNS servers (Google, Cloudflare, Quad9) on all ports to its own DNS server. DoH and DoT failed due to certificate error.
Earlier quoted context omitted.
Yes, assuming you have a non compromised browser or certificate trust chain
Tangential question: how are IP addresses in certificates validated? Cloudflare was subject to a BGP hijack of the 1.1.1/24 prefix, how does it prevent someone from running a malicious DNS server?