Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

DNS over HTTPS

github.com

Post reply on HN
Print view View original

131–140 of 195 posts

Re: DNS over HTTPS

#131

Post by quacker »

nly wrote: post #121

I've been pushing all my DNS traffic over a VPN, transparently, for the whole house, for years now (by setting the VPN remote IP as the upstream resolver on my router). It seems the only advantage of DNS-over-HTTPS is that it does DNS over TLS on port 443, which is harder for militant netadmins to block. It's definitely a solution to a niche problem, but if we really want to encrypt DNS at scale then we could do it e…

DNS through a VPN is only a partial solution though, right? Even if there's a recursive/caching resolver within the VPN (so _my_ direct DNS requests are private) any DNS requests outbound from the VPN go through global DNS.

But, I guess same problem for DNS-over-HTTPS currently.

Re: DNS over HTTPS

#132

Post by LogicX »

quacker wrote: post #131
nly wrote: post #121

I've been pushing all my DNS traffic over a VPN, transparently, for the whole house, for years now (by setting the VPN remote IP as the upstream resolver on my router). It seems the only advantage of DNS-over-HTTPS is that it does DNS over TLS on port 443, which is harder for militant netadmins to block. It's definitely a solution to a niche problem, but if we really want to encrypt DNS at scale then we could do it e…

DNS through a VPN is only a partial solution though, right? Even if there's a recursive/caching resolver within the VPN (so _my_ direct DNS requests are private) any DNS requests outbound from the VPN go through global DNS. But, I guess same problem for DNS-over-HTTPS currently.

Correct -- there's not currently any standard for recursive resolvers to communicate securely to authoritative providers. We'd like to change that.

Re: DNS over HTTPS

#133

Post by LogicX »

hollander wrote: post #124

OpenDNS used to offer a secure DNS-tool. I can't find it anymore. Maybe Cisco removed it? Why can't we use something like that?

You're thinking of DNSCrypt.

It unfortunately was recently abandoned by the original developer. Some folks have mirrored it here: https://github.com/DNSCrypt

Re: DNS over HTTPS

#134

Post by tialaramex »

kuschku wrote: post #44
jopsen wrote: post #43

Earlier quoted context omitted.

don't you think SNI leaks will get fixed eventually?

No. All actors currently involved with the web are ideologically opposed to backwards incompatible changes, and, as a result, they'd never make a change that prevents a browser from accessing a legacy site. As result, SNI is here to stay.

This isn't how backwards compatibility works.

A hypothetical encrypted SNI would be "optional" in the sense that your Firefox 57 wouldn't use it, but a site could implement it, and Firefox 73 could too and then the actual user of that actual site is protected by upgrading to FF 73.

If you were right everything would still be HTML 4 over HTTP 1.1

Re: DNS over HTTPS

#135

Post by tptacek »

kuschku wrote: post #20

So what use does this have? DNSSEC already gives us validation of the records, and thanks to SNI, this doesn't give us any privacy. It is more complex, more centralized, and ends up slower than using actual DNS, and doesn't seem to provide any benefits. Am I missing something?

There is no good reason DNSSEC shouldn't protect query privacy. It doesn't because the most important Internet users --- developers and operations engineers --- are letting them standardize it that way. If it annoys you that we have to resort to elaborate hacks to keep ISPs from monitoring our queries while at the same time undertaking huge projects to migrate to a new DNS protocol, you're not crazy, and you should make some noise. DNSSEC sees barely any use in the real world, and it is not too late to change it.

Re: DNS over HTTPS

#136

Post by BenjiWiebe »

alien_at_work wrote: post #119
banachtarski wrote: post #71

Earlier quoted context omitted.

I would love this to catch on wildly! DNS through TLS means it's all end-to-end encrypted, DNS reflection attacks are harder, etc. The "why even have protocols" doesn't make sense. Protocol can be layered just fine (HTTP itself is a good example). DNS as it exists now is another random special snowflake that vendors need corresponding snowflake implementations for.

>DNS through TLS means it's all end-to-end encrypted I didn't say I'm against DNS being encrypted, even with TLS. I just hate that instead of doing the right thing (e.g. political battle with the government, opening a port on a firewall) people choose the laziest way: just tunnel it over HTTP. >Protocol can be layered just fine (HTTP itself is a good example) They can, but why do it? Just figure out a way to make you…

I guess someone just needs to do a VPN over HTTP. (Probably done already too)

Re: DNS over HTTPS

#138

Post by tialaramex »

deathanatos wrote: post #49
pjc50 wrote: post #35

Earlier quoted context omitted.

No, in order to multi-host SSL sites the host name has to be sent first in order for the correct certificate to be presented. https://en.wikipedia.org/wiki/Server_Name_Indication

You don't even need SNI; the initial Server Hello, which contains the server's certificate (which contains the DNS name the certificate is issued for) is sent in the clear.

No longer true in TLS 1.3 as I understand it

The ServerHello starts out by finishing key agreement and then (in the same message) it assumes its peer now knows the session key and encrypts the rest of the message, including Certificate.

Re: DNS over HTTPS

#139

Post by gkya »

alien_at_work wrote: post #119
banachtarski wrote: post #71

Earlier quoted context omitted.

I would love this to catch on wildly! DNS through TLS means it's all end-to-end encrypted, DNS reflection attacks are harder, etc. The "why even have protocols" doesn't make sense. Protocol can be layered just fine (HTTP itself is a good example). DNS as it exists now is another random special snowflake that vendors need corresponding snowflake implementations for.

>DNS through TLS means it's all end-to-end encrypted I didn't say I'm against DNS being encrypted, even with TLS. I just hate that instead of doing the right thing (e.g. political battle with the government, opening a port on a firewall) people choose the laziest way: just tunnel it over HTTP. >Protocol can be layered just fine (HTTP itself is a good example) They can, but why do it? Just figure out a way to make you…

Political battles are hard to do, and take time, sometimes very very long times they take.

Re: DNS over HTTPS

#140

Post by Franciscouzo »

politelemon wrote: post #3

> for privacy, performance and security. I understand the privacy and security aspects. But I am wondering - how can DNS over HTTPS be more performant in the case of curl commands? A browser could probably persist the connection to the resolver and issue several requests together, but with a single curl command surely there's the overhead of initiating the first DNS resolve, the HTTPS connection, the second DNS resol…

It is a recognized word, at least by the Cambridge [0], Oxford [1], and Wiktionary [2] dictionaries.

[0] https://dictionary.cambridge.org/dictionary/english/performa...

[1] https://en.oxforddictionaries.com/definition/performant

[2] https://en.wiktionary.org/wiki/performant

Post reply on HN