What's the point of confidentiality for DNS? Can't an attacker pretty easily get IP-to-DNS mappings to discover who you're talking to? I guess not in the case of VPNs/TOR?
DNS over TLS – Thoughts and Implementation
11–20 of 88 posts
Re: DNS over TLS – Thoughts and Implementation
#12What's the point of confidentiality for DNS? Can't an attacker pretty easily get IP-to-DNS mappings to discover who you're talking to? I guess not in the case of VPNs/TOR?
Not in the case of Tor, but also not in the case of almost all/most cloud hosted services.
For example, consider that Cloudflare proxies about 10% of the Internet. Well, if you request a site they proxy, and DNS is in the clear, it's obvious who you are connecting to.
But if you request a site and the DNS is encrypted, you could be visiting any one of 10% of the sites out there.
Similarly, if hosting on AWS or Google Cloud platform, there's a LOT of other services hosted in those IP blocks, and IPs change frequently, so there's a significant degree of ambiguity.
This is all in addition to fixing the threat of DNS leakage for VPN/Tor connections.
Re: DNS over TLS – Thoughts and Implementation
#13Pretty much there are 3 competing implementations for DNS resolution encryption (won't call it security):
* DNSCrypt
* DNS over TLS
* DNS over HTTPS
https://github.com/jedisct1/dnscrypt-proxy
It doesn't get a much love as it should, but it is probably the best way to secure encrypt your DNS requests right now. The protocol was initially developed by OpenDNS, but many resolvers support it right now (cisco, cleanbrowsing, etc). The list of supporting services is impressive:
https://download.dnscrypt.info/dnscrypt-resolvers/v2/public-...
On the other hand, DNS over [HTTPS|TLS] are pretty new and don't have as much support, except for a few players. A good list if here as well:
https://www.reddit.com/r/sysadmin/comments/976aj2/updated_li...
Re: DNS over TLS – Thoughts and Implementation
#14Prediction: DNS-over-TLS won't win. I don't think it's going to be able to get around the non-standard port issue. Instead, I think DNS-over-HTTP is gonna be the champ. The overhead of HTTP is a minor issue, but, I think using a standard port more than makes up for it. I think the real inflection point is going to be once QUIC is more widely deployed. Combined with TLS's 0-RTT connection setup, we'll be able to get b…
I hope you are wrong. We don't need one more protocol tunneled through HTTP.
Re: DNS over TLS – Thoughts and Implementation
#15What's the point of confidentiality for DNS? Can't an attacker pretty easily get IP-to-DNS mappings to discover who you're talking to? I guess not in the case of VPNs/TOR?
Not in the case of Tor, but also not in the case of almost all/most cloud hosted services. For example, consider that Cloudflare proxies about 10% of the Internet. Well, if you request a site they proxy, and DNS is in the clear, it's obvious who you are connecting to. But if you request a site and the DNS is encrypted, you could be visiting any one of 10% of the sites out there. Similarly, if hosting on AWS or Google…
... except that SNI isn't encrypted.
Re: DNS over TLS – Thoughts and Implementation
#16Prediction: DNS-over-TLS won't win. I don't think it's going to be able to get around the non-standard port issue. Instead, I think DNS-over-HTTP is gonna be the champ. The overhead of HTTP is a minor issue, but, I think using a standard port more than makes up for it. I think the real inflection point is going to be once QUIC is more widely deployed. Combined with TLS's 0-RTT connection setup, we'll be able to get b…
Yeah, DNS over HTTP/2, (or the inevitable DNS over upcoming connection protocols) will definitely succeed.
I think the big paradigm shift is "let's decouple DNS interactions from a specific transport" - and once you open up to that concept, the option of having multiple transports for different use-cases as things move forward seems practical.
Re: DNS over TLS – Thoughts and Implementation
#17Article starts by stating that DNS doesn't provide a means to guarantee integrity of the returned DNS data. Then mentions DNSSEC as a protocol which exists to provide such guarantee and promptly dismisses it along with DNSCURVE and DNSCRYPT as protocols which have been so infrequently deployed as to be non-existent. Further on states that DNS over TLS and DNS over HTTPS don't solve the integrity problem but that is o…
There's two ways to ensure the authenticity of data delivered over the Internet. You can authenticate the content or you can authenticate the channel.
Overwhelmingly, practical security schemes on the Internet rely on channel security. We rely on TLS to ensure the integrity of the DOM on websites; we don't cryptographically sign the pages themselves.
All things being equal, you'd like to be doing both things. You'd like to have cryptographically signed web page DOMs, for instance (among other things, it would make web crypto a lot more useful).
But all things aren't equal: content authentication is difficult to manage in practice, and every security protocol we adopt has a cost.
Long story short: if you can protect the channels used by DNS lookups, you can get by without protecting the content. That's roughly the idea behind DoH and DoTLS.
The reality though is that all you really need is "DNS over TCP" (which, of course, we've had since basically the beginning). Practical forgery attacks against TCP DNS are difficult enough as to not be worth the trouble.
Re: DNS over TLS – Thoughts and Implementation
#18Prediction: DNS-over-TLS won't win. I don't think it's going to be able to get around the non-standard port issue. Instead, I think DNS-over-HTTP is gonna be the champ. The overhead of HTTP is a minor issue, but, I think using a standard port more than makes up for it. I think the real inflection point is going to be once QUIC is more widely deployed. Combined with TLS's 0-RTT connection setup, we'll be able to get b…
I hope you are wrong. We don't need one more protocol tunneled through HTTP.
Why? What's the specific harm? AIUI, as long as the request still fits into a single frame, its not anymore inneficient.
Re: DNS over TLS – Thoughts and Implementation
#19What's the point of confidentiality for DNS? Can't an attacker pretty easily get IP-to-DNS mappings to discover who you're talking to? I guess not in the case of VPNs/TOR?
DNS hijacking is real and very annoying. The main benefit of these protocols is in the integrity of the DNS resolution data. It allows you to use any DNS server you want, without having your ISP modifying their responses.
Here is my story why I tried dnscrypt: https://medium.com/@nykolas.z/ending-dns-hijacking-with-dnsc...
Re: DNS over TLS – Thoughts and Implementation
#20Prediction: DNS-over-TLS won't win. I don't think it's going to be able to get around the non-standard port issue. Instead, I think DNS-over-HTTP is gonna be the champ. The overhead of HTTP is a minor issue, but, I think using a standard port more than makes up for it. I think the real inflection point is going to be once QUIC is more widely deployed. Combined with TLS's 0-RTT connection setup, we'll be able to get b…
I hope you are wrong. We don't need one more protocol tunneled through HTTP.
I kinda agree on this. It's like pumping everything into an electron app. Not everything needs to be pumped through 80/443.