Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Improving DNS Privacy with Oblivious DoH

blog.cloudflare.com

Post reply on HN
Print view View original

11–20 of 367 posts

Re: Improving DNS Privacy with Oblivious DoH

#11

Post by saberience »

techelite wrote: post #8
seek3r wrote: post #4

I’m good with the Apple’s privacy-oriented stance. But I can’t stop to think what will happen when advertisers knock on Apple’s door trying to get their hands on the users’ data that one else can access. Is Apple going to sell it out for more profits?

It's just marketing. Apple has already shown they will sell you out with PRISM. Who knows what other backroom deals are happening outside our knowledge. The only reason we found out about PRISM is because the gigantic scale and Snowden sacrificed Everything to let it be known.

I think there's a big difference between selling data for profit and the government literally forcing you to give up data based on national security laws or else forcing you to close your business. There's almost nothing Apple can do about the latter case (or any other company for that matter).

Re: Improving DNS Privacy with Oblivious DoH

#12

Post by TimWolla »

landerwust wrote: post #7
TimWolla wrote: post #6

So, having read the blog post from Cloudflare I don't understand why the proxy (needs to terminate|terminates) TLS. I thought HTTPS proxying (or rather: Any TCP protocol) was a solved problem by the HTTP CONNECT verb or SOCKS proxies. What am I missing?

The user's IP address is masqueraded by the proxy, and neither the DNS mothership (Cloudflare) nor the ISP get to see both who the user is and what they requested. It's an extremely desirable property DoH currently lacks

Yes, I understand that. But I don't understand what ODoH does better than a run of the mill SOCKS proxy, such as Tor.

Re: Improving DNS Privacy with Oblivious DoH

#13

Post by landerwust »

ignoramous wrote: post #9

Key bits from the Cloudflare blog https://blog.cloudflare.com/oblivious-dns/ > The target [resolver] sees only the [DNS] query and the proxy’s IP address. The proxy has no visibility into the DNS messages, with no ability to identify, read, or modify either the query being sent by the client or the answer being returned by the target. Only the intended target [resolver] can read the content of the [DNS] query and pro…

DNSCrypt needs meaningful industry support otherwise it's sadly irrelevant. I think by now we can all agree "industry support" basically means the 3 browser vendors. DoH has at least Mozilla and Google on board, and presumably Microsoft are tailing along.

Re: Improving DNS Privacy with Oblivious DoH

#14

Post by landerwust »

TimWolla wrote: post #12
landerwust wrote: post #7

Earlier quoted context omitted.

The user's IP address is masqueraded by the proxy, and neither the DNS mothership (Cloudflare) nor the ISP get to see both who the user is and what they requested. It's an extremely desirable property DoH currently lacks

Yes, I understand that. But I don't understand what ODoH does better than a run of the mill SOCKS proxy, such as Tor.

Tor is not a run of the mill SOCKS proxy, not least in that it inserts arbitrarily high latency into the user data path. On the other hand, an actual run of the mill SOCKS proxy would have visibility of the user's queries and their identity, defeating the purpose of the design.

Re: Improving DNS Privacy with Oblivious DoH

#16

Post by techelite »

saberience wrote: post #11
techelite wrote: post #8

Earlier quoted context omitted.

It's just marketing. Apple has already shown they will sell you out with PRISM. Who knows what other backroom deals are happening outside our knowledge. The only reason we found out about PRISM is because the gigantic scale and Snowden sacrificed Everything to let it be known.

I think there's a big difference between selling data for profit and the government literally forcing you to give up data based on national security laws or else forcing you to close your business. There's almost nothing Apple can do about the latter case (or any other company for that matter).

Didn't twitter survive?

Also how would we know if Apple is working with other companies? It's not like they are known to be transparent or Truthful.

Re: Improving DNS Privacy with Oblivious DoH

#17

Post by gsnedders »

landerwust wrote: post #13
ignoramous wrote: post #9

Key bits from the Cloudflare blog https://blog.cloudflare.com/oblivious-dns/ > The target [resolver] sees only the [DNS] query and the proxy’s IP address. The proxy has no visibility into the DNS messages, with no ability to identify, read, or modify either the query being sent by the client or the answer being returned by the target. Only the intended target [resolver] can read the content of the [DNS] query and pro…

DNSCrypt needs meaningful industry support otherwise it's sadly irrelevant. I think by now we can all agree "industry support" basically means the 3 browser vendors. DoH has at least Mozilla and Google on board, and presumably Microsoft are tailing along.

> DoH has at least Mozilla and Google on board, and presumably Microsoft are tailing along.

Note that DoH (and DoT) shipped in iOS 14 and Big Sur, though aren't particularly easy to enable.

Re: Improving DNS Privacy with Oblivious DoH

#19

Post by jamescun »

Preventing the target resolver from seeing client's IP address breaks GeoDNS. This is already a problem with 1.1.1.1 which doesn't honour the EDNS client subnet extension.

Given generally DNS is just the start of an intereaction, usually followed by the connection directly between the client and intended destination, I don't see what kind of snooping these privacy measures are there to prevent.

Post reply on HN