Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Improving DNS Privacy with Oblivious DoH

blog.cloudflare.com

Post reply on HN
Print view View original

141–150 of 367 posts

Re: Improving DNS Privacy with Oblivious DoH

#141

Post by lawnchair_larry »

joshspankit wrote: post #91
simonh wrote: post #89

Earlier quoted context omitted.

Why would Apple care about hiding Gatekeeper traffic from internet providers?

I’m guessing they want to hide it more from users. The recent bypassing of local firewalls shows this, for example.

The bypassing has nothing to do with wanting to hide it from users Even if they did care about hiding it, they know how trivial it would be to discover it, as we already saw only hours after the release.

And those lookups have nothing to do with DNS, so this wouldn’t help nor hurt anything related to that.

Re: Improving DNS Privacy with Oblivious DoH

#142

Post by vinay_ys »

yegle wrote: post #128
TrueDuality wrote: post #119

The biggest and most consistent downside I see with these DNS enhancements is that it prevents filtering at the network level. Querying nameservers is being pushed into applications themselves to support these new features (such as Chrome and Firefox), which bypasses any system resolvers configured on the host. In most cases there is no way to signal from the network that it is not desirable to do this (Firefox being…

Enterprise can disable DoH in Chrome using a group policy.

Enterprises can also disable direct outbound connections to anywhere. They can insist only way to access anything is via http proxies. You can do the same at home with a pi-hole. On iOS/MacOS you can install content/network filters. If a browser or app breaks these basic functionalities of Internet, then good luck to them.

Re: Improving DNS Privacy with Oblivious DoH

#143

Post by lawnchair_larry »

mschuster91 wrote: post #99
api wrote: post #81

Earlier quoted context omitted.

I’d just get Starlink. Even if the deal was worse in terms of cost it would be a way to say fuck you to the ISP. Without some way to do that ISPs will not be able to get away with such customer hostile behavior.

> Without some way to do that ISPs will not be able to get away with such customer hostile behavior. I guess it won't take long until the first community or HOA decides to ban Starlink dish installations for faked "optical nuisance" issues.

Faked? What other reason would an HOA have to ban them?

Re: Improving DNS Privacy with Oblivious DoH

#144

Post by kibwen »

gumby wrote: post #136
crispyporkbites wrote: post #129

Earlier quoted context omitted.

why should DNS be handled at the system layer and not by applications? There's zero controls in place to stop this so I don't see why it's assumed that every application developer will want to use system defaults and not override it.

> I don't see why it's assumed that every application developer will want to use system defaults It's the user's machine not the application developer's.

And users get to decide which applications to install. Tunneling has been a thing for decades; likewise for malicious programs. Vigilance when installing programs on a networked device has always been and remains necessary.

Re: Improving DNS Privacy with Oblivious DoH

#145

Post by stevepike »

TrueDuality wrote: post #119

The biggest and most consistent downside I see with these DNS enhancements is that it prevents filtering at the network level. Querying nameservers is being pushed into applications themselves to support these new features (such as Chrome and Firefox), which bypasses any system resolvers configured on the host. In most cases there is no way to signal from the network that it is not desirable to do this (Firefox being…

As someone who recently set up a pihole, I was shocked that it was possible to redirect all DNS requests on the network (in plain text!) to the pi. I did the method where you set up a network firewall at the router level that redirects all port 53 traffic to the pi. It's a nice feature for getting my xbox filtered, but it really felt like an insecure historical quirk rather than a feature we should be praising.

Surely it's progress for devices to be able to securely access name servers? I can't snoop on the network traffic going over https but somehow I can get a list of all names queried?

Re: Improving DNS Privacy with Oblivious DoH

#146

Post by wlesieutre »

alwillis wrote: post #125
wlesieutre wrote: post #102

Earlier quoted context omitted.

Because it's none of Comcast's business what software I run?

Because it's none of Comcast's business what software I run? There's no way for your ISP to know what software you're running. Gatekeeper checks if your app is malware (or not) and if its been signed with a valid Apple developer certificate. The OCSP look up goes over in the clear currently, but that's how OCSP works everywhere. Your DNS provider can see the OCSP lookup but that's about it. Apple is in the process of…

For most of the software on my computer, the developer certificate is enough information to know what software I'm running.

Are they going to think I'm running some other piece of software signed by Slack Inc.?

Re: Improving DNS Privacy with Oblivious DoH

#147

Post by TrueDuality »

stevepike wrote: post #145
TrueDuality wrote: post #119

The biggest and most consistent downside I see with these DNS enhancements is that it prevents filtering at the network level. Querying nameservers is being pushed into applications themselves to support these new features (such as Chrome and Firefox), which bypasses any system resolvers configured on the host. In most cases there is no way to signal from the network that it is not desirable to do this (Firefox being…

As someone who recently set up a pihole, I was shocked that it was possible to redirect all DNS requests on the network (in plain text!) to the pi. I did the method where you set up a network firewall at the router level that redirects all port 53 traffic to the pi. It's a nice feature for getting my xbox filtered, but it really felt like an insecure historical quirk rather than a feature we should be praising. Surel…

You're definitely right that it is an issue that the traffic is plaintext but there are trade off costs that are not addressed by these standards, mostly in user control and fall back behaviour.

You've started using a pi-hole, and presumably are getting value from it. These protocols can potentially make it so you can't use that pi-hole at all.

Traffic that is local to a network being unencrypted is not a huge privacy problem. If this protocol was adopted by local resolvers, your pi-hole or network router could use it for any requests it makes while still preserving its ability to filter the traffic. It's basically all win under this scenario.

The problem comes back to applications implementing this in ways that can't be managed taking the option away from end users and administrators. Without the protocols specifying control and fall-back behaviours on networks that don't need or want this, it's more harmful than useful.

Re: Improving DNS Privacy with Oblivious DoH

#148

Post by alwillis »

gsnedders wrote: post #17
landerwust wrote: post #13

Earlier quoted context omitted.

DNSCrypt needs meaningful industry support otherwise it's sadly irrelevant. I think by now we can all agree "industry support" basically means the 3 browser vendors. DoH has at least Mozilla and Google on board, and presumably Microsoft are tailing along.

> DoH has at least Mozilla and Google on board, and presumably Microsoft are tailing along. Note that DoH (and DoT) shipped in iOS 14 and Big Sur, though aren't particularly easy to enable.

Note that DoH (and DoT) shipped in iOS 14 and Big Sur, though aren't particularly easy to enable.

You can use something like iMazing Profile Editor [1] to create a .mobileprofile (which is just XML) to configure DoH or DoT.

[1]: https://imazing.com/profile-editor

Re: Improving DNS Privacy with Oblivious DoH

#149

Post by alwillis »

wlesieutre wrote: post #146
alwillis wrote: post #125

Earlier quoted context omitted.

Because it's none of Comcast's business what software I run? There's no way for your ISP to know what software you're running. Gatekeeper checks if your app is malware (or not) and if its been signed with a valid Apple developer certificate. The OCSP look up goes over in the clear currently, but that's how OCSP works everywhere. Your DNS provider can see the OCSP lookup but that's about it. Apple is in the process of…

For most of the software on my computer, the developer certificate is enough information to know what software I'm running. Are they going to think I'm running some other piece of software signed by Slack Inc.?

For most of the software on my computer, the developer certificate is enough information to know what software I'm running.

All your ISP can see is certificate hashes, OCSP lookups and DNS queries. It can't know what certificate hash is connected to what developer application…

Re: Improving DNS Privacy with Oblivious DoH

#150

Post by karmakaze »

In a nutshell: client encrypts to proxy, which decrypts & removes client info, then asks resolver.

> “What ODoH is meant to do is separate the information about who is making the query and what the query is,” said Nick Sullivan, Cloudflare’s head of research.

> In other words, ODoH ensures that only the proxy knows the identity of the internet user and that the DNS resolver only knows the website being requested. Sullivan said that page loading times on ODoH are “practically indistinguishable” from DoH and shouldn’t cause any significant changes to browsing speed.

Post reply on HN