A cartoon intro to DNS over HTTPS • Hacker News Board

Re: A cartoon intro to DNS over HTTPS

#101

Post by kiriakasis » Fri, Jun 01, 2018, 8:19 AM UTC

Perseids wrote: post #98

walrus01 wrote: post #72

Earlier quoted context omitted.

It does not need to be centralized at all. Any internet service provider with a modicum of Clue can install a DNS over https frontend listening on the IPs of their recursive resolvers, and pull data from their existing bind servers. This does not contain any sort of proprietary or non free software. People are free to ignore the content delivery Network provided recursive resolvers, and set up their own.

That is beside the point. What Firefox is doing is to actively distrust the DNS the ISP is advertising because of the bad practice of some ISPs. Even if the ISP would advertise a DoH endpoint, the same reasons for distrust would still exist (they only mention attacks at the ISP's DNS server or between the ISP's DNS server and the authoritative DNS servers). Also note that DNS is one of those dinosaur protocols like e…

Well, we never knew how to build a secure successful ecosystem. Between the various way to secure DNS this seems reasonalbe.

Re: A cartoon intro to DNS over HTTPS

#102

Post by zaarn » Fri, Jun 01, 2018, 8:19 AM UTC

codedokode wrote: post #100

zaarn wrote: post #97

Earlier quoted context omitted.

Google is the business of displaying ads by means of collecting data to form a profile. Cloudflare is in the business of running websites really fast and subsidize a free offering through paying customers. Which of those has a conflict of interest in running a DNS server while promising to protect privacy?

Running websites and selling users' data brings you more profit than just running websites. With DNS Cloudflare can also learn what non-Cloudflare websites users are visiting and when.

Why would cloudflare do that? It's not in their business model and "it makes more money" is hardly a thing that motivates corporations all the time, otherwise google and facebook would be offering subscription services at 20$/year to get ad- and track-free.

Why would cloudflare even want to know what websites you visit? They don't operate an adnetwork, they operate a CDN. At best they could use it to pre-cache websites in regions before demand rises. But they can already do that without DNS...

Re: A cartoon intro to DNS over HTTPS

#103

Post by bluejekyll » Fri, Jun 01, 2018, 8:22 AM UTC

jedisct1 wrote: post #94

bluejekyll wrote: post #65

Earlier quoted context omitted.

Because it's much more complicated to implement, where-as DNS-over-TLS and DNS-over-HTTPS are far simpler to integrate into existing software and operations.

Quite the opposite, actually. A DNSCrypt client can be implemented in a couple lines of Python: https://github.com/tresni/dnspython-dnscrypt/blob/master/dns... It probably took about 15 minutes to write these. Writing a fully functional client in Go, which is the core of dnscrypt-proxy 2, took about the same time: https://github.com/jedisct1/dnscrypt-proxy/commit/b076e01f7a... Correctly implementing DNS-over-TLS is w…

I disagree. In my TLS implementation, I support multiplexing, timeouts, and generally everything you said is hard, over standard TLS impls.

I found this much more straightforward to implement than DNSCrypt. See my response to the sibling comment for a link to the code.

Re: A cartoon intro to DNS over HTTPS

#104

Post by [deleted] » Fri, Jun 01, 2018, 8:50 AM UTC

zaarn wrote: post #102

codedokode wrote: post #100

Earlier quoted context omitted.

Running websites and selling users' data brings you more profit than just running websites. With DNS Cloudflare can also learn what non-Cloudflare websites users are visiting and when.

Why would cloudflare do that? It's not in their business model and "it makes more money" is hardly a thing that motivates corporations all the time, otherwise google and facebook would be offering subscription services at 20$/year to get ad- and track-free. Why would cloudflare even want to know what websites you visit? They don't operate an adnetwork, they operate a CDN. At best they could use it to pre-cache websit…

[deleted]

Re: A cartoon intro to DNS over HTTPS

#105

Post by codedokode » Fri, Jun 01, 2018, 8:52 AM UTC

zaarn wrote: post #102

codedokode wrote: post #100

Earlier quoted context omitted.

Running websites and selling users' data brings you more profit than just running websites. With DNS Cloudflare can also learn what non-Cloudflare websites users are visiting and when.

Why would cloudflare do that? It's not in their business model and "it makes more money" is hardly a thing that motivates corporations all the time, otherwise google and facebook would be offering subscription services at 20$/year to get ad- and track-free. Why would cloudflare even want to know what websites you visit? They don't operate an adnetwork, they operate a CDN. At best they could use it to pre-cache websit…

> "it makes more money" is hardly a thing that motivates corporations all the time

Really? The primary purpose of any corporation is earning as much money as possible.

Re: A cartoon intro to DNS over HTTPS

#106

Post by PappaPatat » Fri, Jun 01, 2018, 8:56 AM UTC

Klathmon wrote: post #24

mcone wrote: post #7

Earlier quoted context omitted.

> Does anyone know of a way to force all DNS queries in windows to use DoH? I think you could use pi-hole to do this. https://docs.pi-hole.net/guides/dns-over-https/

Thanks a ton, this looks fantastic! Do you know if it's possible to setup Pihole to use this (and possibly other features) but not do any adblocking?

Sure, just deselect the blocklists in the GUI of your pi-hole.

Re: A cartoon intro to DNS over HTTPS

#107

Post by PappaPatat » Fri, Jun 01, 2018, 9:13 AM UTC

Now just wait for your browser (or any other random application) to stop using your OS's resolve completely (at least Chrome does at times already by simply accessing DNS services via port 53 when it considers the configured OS DNS 'not good'. I have no idea about the exact criteria) by accessing its desired DNS-over-HTTPS server and bypass your carefully setup DNS filtering / monitoring.

Notes 1: I have NO idea if Chrome (or any other random application) accesses DNS-over-HTTPS already since I have not paid too much attention to it.

2: At least Chrome (on OSX) likes to access 8.8.8.8 & 8.8.4.4 & your configured DNS server on port 53 (happy eyeball protocol). This might only be on flaky networks like mine, where I tend to make all sorts of configuration experiments.

Re: A cartoon intro to DNS over HTTPS

#108

Post by herghost » Fri, Jun 01, 2018, 9:34 AM UTC

> "Threats to users’ privacy and security are growing."

Website won't load without allowing a call out to googleadapis.l.google.com

Yeah, you're right they are growing.

Re: A cartoon intro to DNS over HTTPS

#109

Post by zaarn » Fri, Jun 01, 2018, 9:39 AM UTC

codedokode wrote: post #105

zaarn wrote: post #102

Earlier quoted context omitted.

Why would cloudflare do that? It's not in their business model and "it makes more money" is hardly a thing that motivates corporations all the time, otherwise google and facebook would be offering subscription services at 20$/year to get ad- and track-free. Why would cloudflare even want to know what websites you visit? They don't operate an adnetwork, they operate a CDN. At best they could use it to pre-cache websit…

> "it makes more money" is hardly a thing that motivates corporations all the time Really? The primary purpose of any corporation is earning as much money as possible.

Okay, let's do it by having an analog.

You are given advice on how to safely cross a four-way intersection by two companies.

One is an insurance company specialised in people being run over by semi trucks at four way intersections.

The other is a contractor that designs, builds and maintains four way intersections for the government and private entities.

Of course, yes, the later could collude with the former to make extra money.

But it's also not their business model. They build intersections, people pay them to make those safe and reliable. People do not pay them to collude with shady insurance companies which try to kill people by semi truck.

People would actively not pay them if they did that.

Same with Cloudflare. If CF sold data to ad networks, a lot of websites would simply jump ship and use one of the other CDNs with free offerings. People pay CF a shitload of money for ensuring the connection is private and safe (notably banks, governments, etc.)

Re: A cartoon intro to DNS over HTTPS

#110

Post by floatingatoll » Fri, Jun 01, 2018, 11:34 AM UTC

mike-cardwell wrote: post #28

I kind of hate this. Taking a decentralised service, and replacing it with a service provided by a small handful of tech giants. "But this doesn’t mean you have to use Cloudflare. Users can configure Firefox to use whichever DoH-supporting recursive resolver they want. As more offerings crop up, we plan to make it easy to discover and switch to them." Only defaults matter. Your average web user wont be interested in…

If the vast majority of users today are using DNS severs that are wiretapped for harmful purposes, such as advertising on NXDOMAIN pages or maliciously rewriting DNS, then switching them to one of a few DoH providers is no more concentrated than it is now. Most of my coast uses 75.75.75.75 and will someday use 1.1.1.1. This isn’t as significant a change relative to the horror of today’s plaintext, MitM’d user-hostile reality.