I would love to see Firefox be an early adopter of this, regain market share and save us all from Chrome!
Improving DNS Privacy with Oblivious DoH
101–110 of 367 posts
Re: Improving DNS Privacy with Oblivious DoH
#102I understand why Cloudflare wants this (marketing, as well as being able to serve their customer’s content through restrictions, thus making them more valuable to those customers), but why does Apple want this? My knee-jerk is that they want to further hide/make unstoppable things like the Gatekeeper network checks, but there has to be more right?
Why would Apple care about hiding Gatekeeper traffic from internet providers?
Because it's none of Comcast's business what software I run?
Re: Improving DNS Privacy with Oblivious DoH
#103Opened this post expecting to be hating on another power grab dressed up as protocol engineering, but this one seems to actively /reduce/ the centralization of user data collection in DoH. Props to Cloudflare, I'm impressed.
All I see is a proxy service and a way for cloudflare to get access to the data
Do you want Google and your ISPs to see everything? Cloudflare and maybe Apple (not sure what infrastructure they’d have in this if any)? Another company like Cloudflare?
I don’t know the answer but I’m curious to hear everyone’s thoughts. Personally I’d like to prevent Google and my ISPs but Cloudflare could easily become Google in many ways.
Re: Improving DNS Privacy with Oblivious DoH
#104Interesting that apple is increasing its stake in privacy. On all their billboards and advertisements of course they like to present it as a boon to the customer. More importantly, I think it’s a negative for personal data hungry competitors while being relatively unrelated to Apples business
Yup I just see this as an alignment of interests. In this case, Apple's interest happens to align with that of their consumers.
And I for one am happy that they have taken up this cause and put their weight behind it, whatever their intentions may be, the effect is that it makes the web more private for those of us who deem it important to move away from the "monetizing data" cancer that has spread all over the internet.
Re: Improving DNS Privacy with Oblivious DoH
#105Opened this post expecting to be hating on another power grab dressed up as protocol engineering, but this one seems to actively /reduce/ the centralization of user data collection in DoH. Props to Cloudflare, I'm impressed.
All I see is a proxy service and a way for cloudflare to get access to the data
The proxy sees the client IP, but can't look at the encrypted DNS request.
The DNS server sees (deciphers) the DNS query, but not the client IP address.
It's a proxy, but with the sensible data encrypted with the server's public keys to hide it from the proxy. Cloudflare never knows who is sending the requests. How can they get access to the data?
Re: Improving DNS Privacy with Oblivious DoH
#106Opened this post expecting to be hating on another power grab dressed up as protocol engineering, but this one seems to actively /reduce/ the centralization of user data collection in DoH. Props to Cloudflare, I'm impressed.
"""A key component of ODoH working properly is ensuring that the proxy and the DNS resolver never “collude,” in that the two are never controlled by the same entity, otherwise the “separation of knowledge is broken"""
Essentially this is no better than using an HTTP proxy or a VPN.
Re: Improving DNS Privacy with Oblivious DoH
#107Earlier quoted context omitted.
I’d just get Starlink. Even if the deal was worse in terms of cost it would be a way to say fuck you to the ISP. Without some way to do that ISPs will not be able to get away with such customer hostile behavior.
> Without some way to do that ISPs will not be able to get away with such customer hostile behavior. I guess it won't take long until the first community or HOA decides to ban Starlink dish installations for faked "optical nuisance" issues.
The fcc will have something to say about that. They've already banned rules against antennas and sat dishes for TV.
Re: Improving DNS Privacy with Oblivious DoH
#108This is a neat design, but, does this not just shift the issue of trust as to whether the proxy and the target are colluding: > However, each of these guarantees relies on one fundamental property — that the proxy and the target servers do not collude. So long as there is no collusion, an attacker succeeds only if both the proxy and target are compromised. I'm not sure how an end user would be expected to assess this…
Add a few more proxy hops and you’ve effectively reinvented Tor
reinvented Tor, but with extra steps and less security
Re: Improving DNS Privacy with Oblivious DoH
#109Earlier quoted context omitted.
It is part of their marketing. The fact that others sell or actively use your data, e.g. google, facebook, microsoft, apple was handed the opportunity to charge a premium for the absence of such tracking and data usage. If you watch the presentations, they branded/poised themselves as the privacy centric approach.
I see your point about how they (will) position it, but I’m still curious about their actual motives.
Exactly that. It strengthens their image amidst the whole ordeal with app signatures. It is equivalent to investing for an ad.
Re: Improving DNS Privacy with Oblivious DoH
#110Until we get rid of SNI[1] in HTTPS for good there will still be providers (like my ISP) that do deep packet inspection on SNI and kill the connection right away if you happen to visit a forbidden site (and this was western Europe, yesterday, on a site behind CloudFlare) [1] https://en.m.wikipedia.org/wiki/Server_Name_Indication
You can bypass SNI inspection [0] with tools like GreenTunnel [1] and Intra [2]. [0] https://twitter.com/vinifortuna/status/1304189371688660992 [1] https://news.ycombinator.com/item?id=22654737 [2] https://getintra.org/
Thanks for the link, just tried Green Tunnel on the use case where my ISP is blocking me and just managed to change the error from PT_CONNECT_RESET_ERROR to PR_END_OF_FILE_ERROR.
Side note, looks like that if installed by snap on Ubuntu 20.10 it cannot automagically change the proxy configuration in Gnome
green-tunnel:system-proxy [SYSTEM PROXY] error on SetProxy (Error: Command failed: gsettings set org.gnome.system.proxy mode manual
green-tunnel:system-proxy /bin/sh: 1: gsettings: not found