Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A cartoon intro to DNS over HTTPS

hacks.mozilla.org

Post reply on HN
Print view View original

11–20 of 137 posts

Re: A cartoon intro to DNS over HTTPS

#11

Post by jchw »

Klathmon wrote: post #2

There was a good chunk of time where my ISP (Verizon FIOS at the time) was having some kind of DNS hijacking attack happening where many CDN IPs were being replaced with an IP of a server that was adding some ad-injecting javascript into many pages (and god knows what else, I still have the payload laying around somewhere as I saved it for future curiosity). At the time my only real recourse was to pump my whole hous…

I don't think DNS-over-HTTPS precludes the use of DNSSEC - I think the intent is that eventually, you will in fact use both in tandem. DNSSEC alone would only give you the ability to check the integrity of a record, but DNS-over-HTTPS makes the transaction confidential and prevents third parties from censoring the request.

Re: A cartoon intro to DNS over HTTPS

#12

Post by dogecoinbase »

iampims wrote: post #4

I applaud the efforts to increase privacy,reduce data collection and hardened security. Do we really want a SPOF in Cloudflare for this though? A single outage (or AT&T snafu) and many millions of users would be affected.

In fact, it already happened between this Mozilla announcement and now: https://www.cloudflarestatus.com/incidents/2mz3wly2g7dy

I think encrypting DNS transport is as important as the next guy (though DoH is bad), but am super unhappy about Mozilla apparently signing on with Cloudflare's ongoing fairly successful attempts to centralize the internet. Sure, they say they'll delete your data "within 24 hours" (they shouldn't be keeping it at all), but pretty soon they'll get a Nat'l Security Letter like everyone else does.

Re: A cartoon intro to DNS over HTTPS

#13

Post by bluejekyll »

jchw wrote: post #8
bluejekyll wrote: post #6

I am very conflicted about DNS-over-HTTPS vs. DNS-over-TLS. Most of DNS-over-HTTPS' interesting use-cases start coming into play when you're using the same HTTPS session as the one being used to serve the site you're visiting. Otherwise, DNS-over-TLS is sufficient for the same level of privacy. At that point though, DNS-over-HTTPS has a provenance issue that I don't fully grok how we're going to avoid. What I mean by…

I'm not sure I understand. I was under the impression that DNS-over-HTTPS was nothing more than just an alternative DNS protocol just like DNS-over-TLS, where you perform an HTTPS request in order to query for a DNS name, and that DNS-over-TLS was just plain old DNS wrapped in TLS. You seem to be implying that DNS-over-HTTPS would enable sites themselves to deliver DNS records. I don't see how that is possible, becau…

You are correct for the initial request. I've seen many arguing for taking this to another level of actually sending DNS requests over the same HTTPS session being used with a site the browser is currently connected to.

Re: A cartoon intro to DNS over HTTPS

#14

Post by jchw »

mcone wrote: post #7
Klathmon wrote: post #2

There was a good chunk of time where my ISP (Verizon FIOS at the time) was having some kind of DNS hijacking attack happening where many CDN IPs were being replaced with an IP of a server that was adding some ad-injecting javascript into many pages (and god knows what else, I still have the payload laying around somewhere as I saved it for future curiosity). At the time my only real recourse was to pump my whole hous…

> Does anyone know of a way to force all DNS queries in windows to use DoH? I think you could use pi-hole to do this. https://docs.pi-hole.net/guides/dns-over-https/

You could also run your own DNS server as well, like Core DNS, and configure it to resolve through DNS-over-HTTPS. I'm sure this is about the same thing, but it's worth noting that you could possibly use your existing router or NAS to run the software.

Re: A cartoon intro to DNS over HTTPS

#15

Post by floatingatoll »

iampims wrote: post #4

I applaud the efforts to increase privacy,reduce data collection and hardened security. Do we really want a SPOF in Cloudflare for this though? A single outage (or AT&T snafu) and many millions of users would be affected.

The article clearly states a desire to ship more providers as soon as more providers exist. If you know of any other providers who meet the declared privacy choices (e.g. deleted after 24 hours) and protocol choices (e.g. DoH, TRR, QNAME min), please do let us know!

Re: A cartoon intro to DNS over HTTPS

#16

Post by cremp »

barbegal wrote: post #10

As a cynic I would say this is an attempt by Google and Cloudflare to collect DNS data. Why else would they provide this service for free? Both Google's [1] and Cloudflare's [2] DNS privacy policy prohibits them from storing personally identifiable information or from correlating DNS information with other Google data coming from the same IP/account but it does allow them to store information about which domains are…

Cloudflare itself never made sense to me. What possible incentive do they have to stop their primary purpose (DDoS protection) - They have value in promoting the behavior.

Whats worse, is everyone and their dog is using them. What happens when they push a bad config to their core routers, or foobar their anycast?

Re: A cartoon intro to DNS over HTTPS

#17

Post by jchw »

bluejekyll wrote: post #13
jchw wrote: post #8

Earlier quoted context omitted.

I'm not sure I understand. I was under the impression that DNS-over-HTTPS was nothing more than just an alternative DNS protocol just like DNS-over-TLS, where you perform an HTTPS request in order to query for a DNS name, and that DNS-over-TLS was just plain old DNS wrapped in TLS. You seem to be implying that DNS-over-HTTPS would enable sites themselves to deliver DNS records. I don't see how that is possible, becau…

You are correct for the initial request. I've seen many arguing for taking this to another level of actually sending DNS requests over the same HTTPS session being used with a site the browser is currently connected to.

Is this standardized/drafted? I am curious how one might implement this.

Re: A cartoon intro to DNS over HTTPS

#18

Post by iampims »

barbegal wrote: post #10

As a cynic I would say this is an attempt by Google and Cloudflare to collect DNS data. Why else would they provide this service for free? Both Google's [1] and Cloudflare's [2] DNS privacy policy prohibits them from storing personally identifiable information or from correlating DNS information with other Google data coming from the same IP/account but it does allow them to store information about which domains are…

For Google it makes sense. The faster you resolve DNS, the more webpages with ads you visit. Small price to pay to increase impressions.

Re: A cartoon intro to DNS over HTTPS

#19

Post by bluejekyll »

jchw wrote: post #17
bluejekyll wrote: post #13

Earlier quoted context omitted.

You are correct for the initial request. I've seen many arguing for taking this to another level of actually sending DNS requests over the same HTTPS session being used with a site the browser is currently connected to.

Is this standardized/drafted? I am curious how one might implement this.

See this thread with one of the authors of the RFC: https://news.ycombinator.com/item?id=16728600

Re: A cartoon intro to DNS over HTTPS

#20

Post by [deleted] »

barbegal wrote: post #10

As a cynic I would say this is an attempt by Google and Cloudflare to collect DNS data. Why else would they provide this service for free? Both Google's [1] and Cloudflare's [2] DNS privacy policy prohibits them from storing personally identifiable information or from correlating DNS information with other Google data coming from the same IP/account but it does allow them to store information about which domains are…

[deleted]
Post reply on HN