Analyzing DNS-over-HTTPS and DNS-over-TLS Privacy and Security Claims
blog.technitium.com
Analyzing DNS-over-HTTPS and DNS-over-TLS Privacy and Security Claims
1–10 of 67 posts
Re: Analyzing DNS-over-HTTPS and DNS-over-TLS Privacy and Security Claims
#2I like Chrome's approach to DoH. If the local DNS server is capable of DoH, then, and only then, Chrome switches to DoH. It is the safest choice to make, since if you are querying that name server, they have your data anyway, so you might as well encrypt it in transit.
Re: Analyzing DNS-over-HTTPS and DNS-over-TLS Privacy and Security Claims
#3The claim that DoH will interfere with internal DNS of enterprises can be solved with a local deployment of a recursive DoH server right? That also addresses the concern of centralisation. Imagine every ISP offering a DoH sever... so now Cloudflare will not be in a position to scoop up the entire DNS data of the Internet.
I'm still waiting to see a genuinely technical disadvantage of DoH. All that I've read so far are social and implementation related issues that can be ironed out over time.
Re: Analyzing DNS-over-HTTPS and DNS-over-TLS Privacy and Security Claims
#4The claim that DoH will interfere with internal DNS of enterprises can be solved with a local deployment of a recursive DoH server right? That also addresses the concern of centralisation. Imagine every ISP offering a DoH sever... so now Cloudflare will not be in a position to scoop up the entire DNS data of the Internet. I'm still waiting to see a genuinely technical disadvantage of DoH. All that I've read so far ar…
The thing that is still being ignored is the configuration mechanism for the DoH resolver.
Currently, the only way to configure it is manual and application-specific; there's no way to configure it for all apps and automatically, like DHCP for the normal, 53/udp DNS. Nobody is going to manually reconfigure their DNS every time they switch network (e.g. home -> office -> customer).
Re: Analyzing DNS-over-HTTPS and DNS-over-TLS Privacy and Security Claims
#5The claim that DoH will interfere with internal DNS of enterprises can be solved with a local deployment of a recursive DoH server right? That also addresses the concern of centralisation. Imagine every ISP offering a DoH sever... so now Cloudflare will not be in a position to scoop up the entire DNS data of the Internet. I'm still waiting to see a genuinely technical disadvantage of DoH. All that I've read so far ar…
The thing that is still being ignored is the configuration mechanism for the DoH resolver. Currently, the only way to configure it is manual and application-specific; there's no way to configure it for all apps and automatically, like DHCP for the normal, 53/udp DNS. Nobody is going to manually reconfigure their DNS every time they switch network (e.g. home -> office -> customer).
Is DHCP useful to enforce network policy? What about users who manually set their DNS servers?
Wouldn't be a proxy checking the SNI of connections you open better?
Re: Analyzing DNS-over-HTTPS and DNS-over-TLS Privacy and Security Claims
#6The claim that DoH will interfere with internal DNS of enterprises can be solved with a local deployment of a recursive DoH server right? That also addresses the concern of centralisation. Imagine every ISP offering a DoH sever... so now Cloudflare will not be in a position to scoop up the entire DNS data of the Internet. I'm still waiting to see a genuinely technical disadvantage of DoH. All that I've read so far ar…
The thing that is still being ignored is the configuration mechanism for the DoH resolver. Currently, the only way to configure it is manual and application-specific; there's no way to configure it for all apps and automatically, like DHCP for the normal, 53/udp DNS. Nobody is going to manually reconfigure their DNS every time they switch network (e.g. home -> office -> customer).
Currently, the only way to configure DoH for everything is one-time setting local dnscrypt-proxy as the only resolver. Easy on Android 9+ and Linux with systemd, on Windows you have to override DNS settings for all NICs because it has a weird process of resolving. Don't know about macOS, iOS is definitely out.
edit P.S: I'd never trust ISP's DNS servers, because it's the easiest way to track what customers does.
Re: Analyzing DNS-over-HTTPS and DNS-over-TLS Privacy and Security Claims
#7The claim that DoH will interfere with internal DNS of enterprises can be solved with a local deployment of a recursive DoH server right? That also addresses the concern of centralisation. Imagine every ISP offering a DoH sever... so now Cloudflare will not be in a position to scoop up the entire DNS data of the Internet. I'm still waiting to see a genuinely technical disadvantage of DoH. All that I've read so far ar…
> to see a genuinely technical disadvantage of DoH
Lack of privacy issue aside, there are a bunch of technical disadvantages compared to alternatives. Like using encryption to a local resolver or to a resolver over trusted or encrypted network is unnecessary overhead and complexity, including operational complexity that you really want to avoid. And if there is a case to use encrypted communications with a recursive resolver (i.e. non local), it could be done by simply tunneling DNS protocol over any of existing crypto protocols, no need for yet another complex protocol tunneled over https that still has to be converted to a native DNS protocol down the line.
Re: Analyzing DNS-over-HTTPS and DNS-over-TLS Privacy and Security Claims
#8Earlier quoted context omitted.
The thing that is still being ignored is the configuration mechanism for the DoH resolver. Currently, the only way to configure it is manual and application-specific; there's no way to configure it for all apps and automatically, like DHCP for the normal, 53/udp DNS. Nobody is going to manually reconfigure their DNS every time they switch network (e.g. home -> office -> customer).
Currently, the only way to configure DoH for everything is one-time setting local dnscrypt-proxy as the only resolver. Easy on Android 9+ and Linux with systemd, on Windows you have to override DNS settings for all NICs because it has a weird process of resolving. Don't know about macOS, iOS is definitely out. edit P.S: I'd never trust ISP's DNS servers, because it's the easiest way to track what customers does.
I may trust Comcast as far as I can throw them. I still prefer that they get my data, rather than even more of my browsing data go straight to Google.
Re: Analyzing DNS-over-HTTPS and DNS-over-TLS Privacy and Security Claims
#9Earlier quoted context omitted.
The thing that is still being ignored is the configuration mechanism for the DoH resolver. Currently, the only way to configure it is manual and application-specific; there's no way to configure it for all apps and automatically, like DHCP for the normal, 53/udp DNS. Nobody is going to manually reconfigure their DNS every time they switch network (e.g. home -> office -> customer).
Currently, the only way to configure DoH for everything is one-time setting local dnscrypt-proxy as the only resolver. Easy on Android 9+ and Linux with systemd, on Windows you have to override DNS settings for all NICs because it has a weird process of resolving. Don't know about macOS, iOS is definitely out. edit P.S: I'd never trust ISP's DNS servers, because it's the easiest way to track what customers does.
For iOS, you can check out DNSCloak, Adguard, NextDNS, Cloudflare 1.1.1.1, etc. which are all system wide resolver.
Re: Analyzing DNS-over-HTTPS and DNS-over-TLS Privacy and Security Claims
#10I like Chrome's approach to DoH. If the local DNS server is capable of DoH, then, and only then, Chrome switches to DoH. It is the safest choice to make, since if you are querying that name server, they have your data anyway, so you might as well encrypt it in transit.
How would chrome know whether getaddrinfo() uses DoH to resolve a host?