Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Analyzing DNS-over-HTTPS and DNS-over-TLS Privacy and Security Claims

blog.technitium.com

Post reply on HN
Print view View original

11–20 of 67 posts

Re: Analyzing DNS-over-HTTPS and DNS-over-TLS Privacy and Security Claims

#11

Post by xref »

zzzcpan wrote: post #7
Santosh83 wrote: post #3

The claim that DoH will interfere with internal DNS of enterprises can be solved with a local deployment of a recursive DoH server right? That also addresses the concern of centralisation. Imagine every ISP offering a DoH sever... so now Cloudflare will not be in a position to scoop up the entire DNS data of the Internet. I'm still waiting to see a genuinely technical disadvantage of DoH. All that I've read so far ar…

> to see a genuinely technical disadvantage of DoH Lack of privacy issue aside, there are a bunch of technical disadvantages compared to alternatives. Like using encryption to a local resolver or to a resolver over trusted or encrypted network is unnecessary overhead and complexity, including operational complexity that you really want to avoid. And if there is a case to use encrypted communications with a recursive…

I’d prefer not to “trust” any network, even my local home network, and encrypt all the traffic traveling over it I can. especially in an age where a security camera or even your fridge can be compromised by non-targeted automated scripts and then all plaintext traffic on your network is exposed.

As for not using TLS/http to wrap the dns queries for secure transport across the net, what “existing crypto protocol” do you suggest they should have implemented instead?

Re: Analyzing DNS-over-HTTPS and DNS-over-TLS Privacy and Security Claims

#12

Post by asveikau »

I do sometimes use firefox and I found the canary hostname, linked in the article, to be a good tip:

https://support.mozilla.org/en-US/kb/canary-domain-use-appli...

My home network has a DNS server that already talks to the outside DNS servers with TLS, so having browsers reach out to cloudflare would prevent cross-device caching and only protect against snooping on my LAN or wifi, which I don't find to be very necessary. So I just made this domain return NXDOMAIN.

Re: Analyzing DNS-over-HTTPS and DNS-over-TLS Privacy and Security Claims

#13

Post by icebraining »

the8472 wrote: post #10
Ayesh wrote: post #2

I like Chrome's approach to DoH. If the local DNS server is capable of DoH, then, and only then, Chrome switches to DoH. It is the safest choice to make, since if you are querying that name server, they have your data anyway, so you might as well encrypt it in transit.

How would chrome know whether getaddrinfo() uses DoH to resolve a host?

Anyone can link to their own getaddrinfo(), including an internal function, they don't have to use one from whichever libc happens to be laying around on the system.

In theirs, they read the DNS servers from the OS (like the original), and then if it's part of a list of known DoH providers, they try to connect over DoH before falling back to regular DNS queries.

Re: Analyzing DNS-over-HTTPS and DNS-over-TLS Privacy and Security Claims

#14

Post by techslave »

Ayesh wrote: post #2

I like Chrome's approach to DoH. If the local DNS server is capable of DoH, then, and only then, Chrome switches to DoH. It is the safest choice to make, since if you are querying that name server, they have your data anyway, so you might as well encrypt it in transit.

i am very avidly opposes to DoH because it doesn’t solve the problem people think it does. and it further entrenches cloudflare, who imho are vile but that aside the concentration isn’t a good thing.

however, your statement is wrong.

i won’t go further into detail because my comments on this subject universally attract all the downvotes so there’s no point. but in general the problem is you need to qualify “safest”. safest for what and for whom, and in what scenarios? you’ve left too much unsaid, so what you say is not generally true.

Re: Analyzing DNS-over-HTTPS and DNS-over-TLS Privacy and Security Claims

#15

Post by tptacek »

fragmede wrote: post #8
chupasaurus wrote: post #6

Earlier quoted context omitted.

Currently, the only way to configure DoH for everything is one-time setting local dnscrypt-proxy as the only resolver. Easy on Android 9+ and Linux with systemd, on Windows you have to override DNS settings for all NICs because it has a weird process of resolving. Don't know about macOS, iOS is definitely out. edit P.S: I'd never trust ISP's DNS servers, because it's the easiest way to track what customers does.

I may trust Comcast as far as I can throw them. I still prefer that they get my data, rather than even more of my browsing data go straight to Google.

The point of DoH is that you don't have to send your DNS queries to either of those entities.

Re: Analyzing DNS-over-HTTPS and DNS-over-TLS Privacy and Security Claims

#17

Post by icebraining »

techslave wrote: post #14
Ayesh wrote: post #2

I like Chrome's approach to DoH. If the local DNS server is capable of DoH, then, and only then, Chrome switches to DoH. It is the safest choice to make, since if you are querying that name server, they have your data anyway, so you might as well encrypt it in transit.

i am very avidly opposes to DoH because it doesn’t solve the problem people think it does. and it further entrenches cloudflare, who imho are vile but that aside the concentration isn’t a good thing. however, your statement is wrong. i won’t go further into detail because my comments on this subject universally attract all the downvotes so there’s no point. but in general the problem is you need to qualify “safest”.…

This comment says very little; you don't explain what problem people think DoH solves, won't go into detail on why the statement is wrong, nor why not qualifying "safest" makes it not generally true.

At least a comment that attracts downvotes may be useful to someone.

Re: Analyzing DNS-over-HTTPS and DNS-over-TLS Privacy and Security Claims

#18

Post by cstejerean »

bjoli wrote: post #16

Can anyone explain why DoH was invented? To me it seems like another one of the "let's solve this using web technologies!" Whereas DoT has a great ietf process behind it.

My guess is that networks can block the DoT ports to force fallback to plaintext DNS. Whereas DoH looks indistinguishable to HTTPS traffic so it’s harder to block.

Re: Analyzing DNS-over-HTTPS and DNS-over-TLS Privacy and Security Claims

#19

Post by tptacek »

bjoli wrote: post #16

Can anyone explain why DoH was invented? To me it seems like another one of the "let's solve this using web technologies!" Whereas DoT has a great ietf process behind it.

Two primary use cases were considered during this protocol's development. These use cases are preventing on-path devices from interfering with DNS operations, and also allowing web applications to access DNS information via existing browser APIs in a safe way consistent with Cross Origin Resource Sharing (CORS).

Virtually all the opposition to DoH is rooted in two complaints:

1. It centralizes DNS at Cloudflare (obviously, you can point DoH elsewhere).

2. It's hard for network operators to block it (which is the point).

Post reply on HN