Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

DNS over HTTPS

github.com

Post reply on HN
Print view View original

191–195 of 195 posts

Re: DNS over HTTPS

#191

Post by loup-vaillant »

pbhjpbhj wrote: post #186
loup-vaillant wrote: post #185

Earlier quoted context omitted.

"I used iodine all the time, so I can't even notice the presence of a captive portal, if any." "My son handles the computer stuff for me, I don't even know about that logging page you're talking about." "I thought restricted networks had a WPA-2 password? That's what they use at my workplace."

"The door to the house was open, move of the stuff was tied down, how could i be expected to know I wasn't authorised to use it??" Judges just aren't that stupid.

Here's the thing: I never give my real name to captive portals. I don't even give a real email address.

Who can tell me with a straight face that this is criminal behaviour

Re: DNS over HTTPS

#192

Post by gsich »

squeaky-clean wrote: post #169
gsich wrote: post #144

Earlier quoted context omitted.

Who is the "someone else" in your case? Where does the someone else's hardware come from? OP mentioned this to get rid off e.g captive portals. Iodine requires a client and a server. Both belong to you, what is the problem here? That I use a network to transmit packets? We are not talking about installing iodine on someone else's computer!

> That I use a network to transmit packets? Maybe I'm not understanding this correctly, but if a coffee shop has wifi and you need to enter info into a captive portal before you can use their network, by circumventing it, the "Someone else" is the coffee shop owner, and the hardware is their router. "Please get off my router if you don't agree to my conditions". "Nah I'm just using DNS, it's fine" probably is not an…

The assumption from the coffee shop is that wifi == internet == browser, which is not true. Why should I open the browser if I don't need it?

Re: DNS over HTTPS

#193

Post by pbhjpbhj »

gsich wrote: post #192
squeaky-clean wrote: post #169

Earlier quoted context omitted.

> That I use a network to transmit packets? Maybe I'm not understanding this correctly, but if a coffee shop has wifi and you need to enter info into a captive portal before you can use their network, by circumventing it, the "Someone else" is the coffee shop owner, and the hardware is their router. "Please get off my router if you don't agree to my conditions". "Nah I'm just using DNS, it's fine" probably is not an…

The assumption from the coffee shop is that wifi == internet == browser, which is not true. Why should I open the browser if I don't need it?

Do you dispute that a coffee shop providing WiFi with a captive portal only intends to provide web access through that portal? Just as they only intend customers to take sugar packets for use in their coffee, etc..

If the shop don't intend the use its not authorised. Your ethical framework may not put any value on that lack of authorisation, but you see the action is unauthorised, surely?

Re: DNS over HTTPS

#194

Post by jedisct1 »

skuzye wrote: post #86
est wrote: post #76

Earlier quoted context omitted.

http is not overhead, http is the only transport that can go through middle boxes.

if the traffic is encrypted how can you tell whether it's http or plain dns?

Because the purpose of middle boxes is to log your traffic no matter what, usually by installing a root certificate on your devices.

Re: DNS over HTTPS

#195

Post by nly »

DavideNL wrote: post #161
nly wrote: post #121

I've been pushing all my DNS traffic over a VPN, transparently, for the whole house, for years now (by setting the VPN remote IP as the upstream resolver on my router). It seems the only advantage of DNS-over-HTTPS is that it does DNS over TLS on port 443, which is harder for militant netadmins to block. It's definitely a solution to a niche problem, but if we really want to encrypt DNS at scale then we could do it e…

When you run DNS requests over VPN, you are sharing your "browsing history" with (at least) 1 other third party: whoever runs the VPN server, and whoever runs the (public) DNS server. Your ISP can see the IPs you connect to regardless of whether you use your ISPs DNS server or not (unless of course you tunnel ALL traffic of all clients through the vpn as well.)

It's low hanging fruit. Logging DNS queries is a lot cheaper for an ISP than filtering out and logging SNI entries in TLS handshakes.
Post reply on HN