Live data from Hacker News

Improving DNS Privacy with Oblivious DoH

blog.cloudflare.com

121–130 of 367 posts

Re: Improving DNS Privacy with Oblivious DoH

#121
post #104

Interesting that apple is increasing its stake in privacy. On all their billboards and advertisements of course they like to present it as a boon to the customer. More importantly, I think it’s a negative for personal data hungry competitors while being relatively unrelated to Apples business

Yup I just see this as an alignment of interests. In this case, Apple's interest happens to align with that of their consumers. And I for one am happy that they have taken up this cause and put their weight behind it, whatever their intentions may be, the effect is that it makes the web more private for those of us who deem it important to move away from the "monetizing data" cancer that has spread all over the inter…

This seems suspicious to me. Apple does most if not all ML/data-mining on the device where-as competitors do it in the cloud. My assumption is they are positioning themselves this way to grab consumers later should regulations hit cloud services collecting data externally. Apple can say it is all on device and don't have access while other companies will have to say they have your data. Ultimately the motives are the same.

Re: Improving DNS Privacy with Oblivious DoH

#122

The biggest and most consistent downside I see with these DNS enhancements is that it prevents filtering at the network level. Querying nameservers is being pushed into applications themselves to support these new features (such as Chrome and Firefox), which bypasses any system resolvers configured on the host. In most cases there is no way to signal from the network that it is not desirable to do this (Firefox being…

Applications still have fallback though, right?

If so, I foresee blocks on DoH/etc to common resolvers like 8.8.8.8 and 1.1.1.1. I'll be blocking them at home on the assumption that I only want regular DNS lookups so I can point them to my own DNS server etc.

Re: Improving DNS Privacy with Oblivious DoH

#123
post #69

Opened this post expecting to be hating on another power grab dressed up as protocol engineering, but this one seems to actively /reduce/ the centralization of user data collection in DoH. Props to Cloudflare, I'm impressed.

All I see is a proxy service and a way for cloudflare to get access to the data

I am guessing most if not All future Apple devices / OS will default to use Apple Proxy for DNS?

Re: Improving DNS Privacy with Oblivious DoH

#124

So I do wonder how such systems can be designed or implemented such that geoip systems can still work. While I'm sure aws route53 and cloudflare's own routing systems can handle this properly, Cloud isn't quite the answer. Not every workload fits on the cloud (see: Discord, which runs on leased servers), and a system that breaks down if your rented datacenters aren't in alignment with Cloud operating regions doesn't…

> Not every workload fits on the cloud (see: Discord, which runs on leased servers)

As far as I'm aware (don't work there), only bandwidth/CPU-heavy stuff like voice and video live on rented dedis; the core chat services live in GCP.

Re: Improving DNS Privacy with Oblivious DoH

#125
post #89

Earlier quoted context omitted.

Why would Apple care about hiding Gatekeeper traffic from internet providers?

Because it's none of Comcast's business what software I run?

Because it's none of Comcast's business what software I run?

There's no way for your ISP to know what software you're running.

Gatekeeper checks if your app is malware (or not) and if its been signed with a valid Apple developer certificate. The OCSP look up goes over in the clear currently, but that's how OCSP works everywhere. Your DNS provider can see the OCSP lookup but that's about it.

Apple is in the process of addressing this; you can read the details of how the current process works at https://eclecticlight.co/2020/11/16/checks-on-executable-cod...

Re: Improving DNS Privacy with Oblivious DoH

#126

Preventing the target resolver from seeing client's IP address breaks GeoDNS. This is already a problem with 1.1.1.1 which doesn't honour the EDNS client subnet extension. Given generally DNS is just the start of an intereaction, usually followed by the connection directly between the client and intended destination, I don't see what kind of snooping these privacy measures are there to prevent.

> I don't see what kind of snooping these privacy measures are there to prevent.

The point of this is to prevent some cloudflare competitor offering DoH, but logging what dns names each client looks up, and selling that information, or using it internally.

Think about the ways that facebook would abuse that information if facebook ran a popular DoH resolver. For example, they detect that you have used a hookup app (based on dns lookups for their servers), and boom, now your facebook feed is full off condom adverts. Or thousands of other scenarios, some even more creepy than that.

Re: Improving DNS Privacy with Oblivious DoH

#127
post #122

The biggest and most consistent downside I see with these DNS enhancements is that it prevents filtering at the network level. Querying nameservers is being pushed into applications themselves to support these new features (such as Chrome and Firefox), which bypasses any system resolvers configured on the host. In most cases there is no way to signal from the network that it is not desirable to do this (Firefox being…

Applications still have fallback though, right? If so, I foresee blocks on DoH/etc to common resolvers like 8.8.8.8 and 1.1.1.1. I'll be blocking them at home on the assumption that I only want regular DNS lookups so I can point them to my own DNS server etc.

Blocking traffic for known DoH services would be trivial. How about blocking unknown, how would you block that?

Re: Improving DNS Privacy with Oblivious DoH

#128

The biggest and most consistent downside I see with these DNS enhancements is that it prevents filtering at the network level. Querying nameservers is being pushed into applications themselves to support these new features (such as Chrome and Firefox), which bypasses any system resolvers configured on the host. In most cases there is no way to signal from the network that it is not desirable to do this (Firefox being…

Enterprise can disable DoH in Chrome using a group policy.

Re: Improving DNS Privacy with Oblivious DoH

#129

The biggest and most consistent downside I see with these DNS enhancements is that it prevents filtering at the network level. Querying nameservers is being pushed into applications themselves to support these new features (such as Chrome and Firefox), which bypasses any system resolvers configured on the host. In most cases there is no way to signal from the network that it is not desirable to do this (Firefox being…

why should DNS be handled at the system layer and not by applications? There's zero controls in place to stop this so I don't see why it's assumed that every application developer will want to use system defaults and not override it.
Post reply on HN