Wait, aren't DNS lookups done by the operating system?
Improving DNS Privacy in Firefox
121–126 of 126 posts
Re: Improving DNS Privacy in Firefox
#122Earlier quoted context omitted.
That doesn't mean it's suddenly in scope for a browser. The solution would be for the OS to support it, not for the browser to do an end-run around the OS's DNS settings.
It is exactly in scope for a browser. The whole point is to stop your ISP getting your browsing history. Sure, would be nice for the OS to support it, but until that future point why wait.
>Sure, would be nice for the OS to support it, but until that future point why wait.
Because with the current system I can configure my DNS to my liking at my router and it propagates to all devices. Replacing that with a system where after every Firefox update I have to double check whether Firefox is still doing what I want on all devices is a total pain in the ass by comparison.
Re: Improving DNS Privacy in Firefox
#123Earlier quoted context omitted.
> They could get everyone to open up a god damn firewall port if they wanted. No. They couldn’t. That’s the paradox. Together they control the client software running on just about everyone’s computers and phones… but they have very little control or influence over your random IT administrator running a corporate firewall or middleware box, who’s decided to block everything but 80 and 443 for “security” reasons. They…
I don't buy this line for one minute. The fact that these organizations are either too weak or incompetent to roll out difficult changes in no way means it can't be done. This is just the path of least resistance. Rather than design something good, we just slap a layer of crap on top of another layer of crap and call it an improvement. But dressing up a turd doesn't make it smell like roses. The fact is that half (if…
Chrome implemented DNS over HTTPS only three months ago[1], and I don't believe it currently uses it by default (overriding the OS default DNS server choice) like Mozilla is planning to do. The initial IETF draft[2] lists authors from ICANN and Mozilla, not Google.
[1] https://bugs.chromium.org/p/chromium/issues/detail?id=799753
[2] https://tools.ietf.org/html/draft-ietf-doh-dns-over-https-01
Re: Improving DNS Privacy in Firefox
#124Earlier quoted context omitted.
You say "difficulty", the evidence seems to suggest impossibility. I am 100% certain that if you have an actual plan for how to do this without an extra round trip the TLS WG wants to hear about it (but please read the draft with the problem statement first so that you don't embarrass yourself and propose something that doesn't actually solve the problem) In order to be sure we're talking to Bob, so that it's OK if B…
Forgive me if there's some flaw I've overlooked in this approach, but couldn't you use DNS to aid in this? I.e. add Bob's public key to the DNS for fight.club which you get for free in round trips, as you're resolving the A & AAAA records anyway. You then encrypt the SNI asking for fight.club (along with a random nonce) with Bob's pubkey. Of course, this approach would require the DNS record is authenticated, so DNSS…
After some thought I agree with you that this can work, if you have encrypted DNS and DNSSEC in play. I am of course not a world-renowned expert so maybe we both overlooked something.
Two small problems I will mention, one of which I'm sure you already know: First, encrypted DNS and DNSSEC are not yet widely deployed, so this isn't the silver bullet many people expected of Encrypted SNI.
Second, for an endpoint which has many unrelated names and certificates - which is the case where encrypted SNI is gaining us a clear security benefit given our packets must have a plaintext IP destination - now they need to try every possible private key to see if they can open our encrypted SNI. This might be a very considerable burden.
Re: Improving DNS Privacy in Firefox
#125Earlier quoted context omitted.
Forgive me if there's some flaw I've overlooked in this approach, but couldn't you use DNS to aid in this? I.e. add Bob's public key to the DNS for fight.club which you get for free in round trips, as you're resolving the A & AAAA records anyway. You then encrypt the SNI asking for fight.club (along with a random nonce) with Bob's pubkey. Of course, this approach would require the DNS record is authenticated, so DNSS…
After some thought I agree with you that this can work, if you have encrypted DNS and DNSSEC in play. I am of course not a world-renowned expert so maybe we both overlooked something. Two small problems I will mention, one of which I'm sure you already know: First, encrypted DNS and DNSSEC are not yet widely deployed, so this isn't the silver bullet many people expected of Encrypted SNI. Second, for an endpoint which…
> now they need to try every possible private key to see if they can open our encrypted SNI.
The idea was to have a single common introductory keypair which all tenants publish to their DNS, in order to encrypt the SNI. That way there is no need to try multiple private keys.
The lack of DNSSEC deployment is an issue, although there's nothing to stop such schemes being employed on an opportunistic basis. However, when DNSSEC is available for a domain, the scheme should be enforced to prevent a MITM attack.
Re: Improving DNS Privacy in Firefox
#126Earlier quoted context omitted.
You yell "Hey, Zanizabo, call Fylnatis" at the top of your lungs. Zanizabo being a phrase encrypted such that only Bob knows you are talking to him, and Fylnatis is your similarly encrypted contact information. Sure, scaling is harder, but it's not impossible.
For this to work you unsolve the key-sharing problem. Everybody who will ever want to communicate with anybody must agree in advance shared secrets with every such party and then retain them indefinitely. You assert the resulting scaling "is harder, but it's not impossible" and I'm sure that by some technical definition of "impossible" this statement is even true, but in practical terms it's never going get done whic…
Public Private key sharing manages the key sharing problem pretty thoroughly. All I have to do is look up the published public key before yelling.