A cartoon intro to DNS over HTTPS • Hacker News Board

Re: A cartoon intro to DNS over HTTPS

#21

Post by ikeyany » Thu, May 31, 2018, 8:59 PM UTC

cremp wrote: post #16

barbegal wrote: post #10

As a cynic I would say this is an attempt by Google and Cloudflare to collect DNS data. Why else would they provide this service for free? Both Google's [1] and Cloudflare's [2] DNS privacy policy prohibits them from storing personally identifiable information or from correlating DNS information with other Google data coming from the same IP/account but it does allow them to store information about which domains are…

Cloudflare itself never made sense to me. What possible incentive do they have to stop their primary purpose (DDoS protection) - They have value in promoting the behavior. Whats worse, is everyone and their dog is using them. What happens when they push a bad config to their core routers, or foobar their anycast?

It doesn't make sense to you to do the right thing and protect people at the expense of profit?

Re: A cartoon intro to DNS over HTTPS

#22

Post by Klathmon » Thu, May 31, 2018, 9:00 PM UTC

jchw wrote: post #11

Klathmon wrote: post #2

There was a good chunk of time where my ISP (Verizon FIOS at the time) was having some kind of DNS hijacking attack happening where many CDN IPs were being replaced with an IP of a server that was adding some ad-injecting javascript into many pages (and god knows what else, I still have the payload laying around somewhere as I saved it for future curiosity). At the time my only real recourse was to pump my whole hous…

I don't think DNS-over-HTTPS precludes the use of DNSSEC - I think the intent is that eventually, you will in fact use both in tandem. DNSSEC alone would only give you the ability to check the integrity of a record, but DNS-over-HTTPS makes the transaction confidential and prevents third parties from censoring the request.

I guess I was just heading off the flurry of comments along the lines of "Why use DoH when we have DNSSEC?" that always seem to come up when discussing DoH.

Re: A cartoon intro to DNS over HTTPS

#23

Post by Klathmon » Thu, May 31, 2018, 9:02 PM UTC

philip1209 wrote: post #5

DNS over HTTPS uses DNS in the protocol. Does that make it extra-recursive DNS?

Isn't the expectation that the hostname header will be hardcoded for DoH requests?

Re: A cartoon intro to DNS over HTTPS

#24

Post by Klathmon » Thu, May 31, 2018, 9:06 PM UTC

mcone wrote: post #7

Klathmon wrote: post #2

There was a good chunk of time where my ISP (Verizon FIOS at the time) was having some kind of DNS hijacking attack happening where many CDN IPs were being replaced with an IP of a server that was adding some ad-injecting javascript into many pages (and god knows what else, I still have the payload laying around somewhere as I saved it for future curiosity). At the time my only real recourse was to pump my whole hous…

> Does anyone know of a way to force all DNS queries in windows to use DoH? I think you could use pi-hole to do this. https://docs.pi-hole.net/guides/dns-over-https/

Thanks a ton, this looks fantastic! Do you know if it's possible to setup Pihole to use this (and possibly other features) but not do any adblocking?

Re: A cartoon intro to DNS over HTTPS

#25

Post by patrickmcmanus » Thu, May 31, 2018, 9:10 PM UTC

iampims wrote: post #4

I applaud the efforts to increase privacy,reduce data collection and hardened security. Do we really want a SPOF in Cloudflare for this though? A single outage (or AT&T snafu) and many millions of users would be affected.

Definitely don't want SPOF. Firefox has both soft-fail and hard-fail modes.. for a soft fail it will fallback to traditional port 53 DNS. Its likely that will be the most common deployment - you need it to deal with captive portals and other split horizon issues as well cloud uptime incidents. But there is a hard fail mode if that is suitable for your environment.

and of course defaults matter a lot, but you will be able to select your preferred DoH endpoint (or not use it at all). Firefox wouldn't lock something like that down.

Re: A cartoon intro to DNS over HTTPS

#26

Post by patrickmcmanus » Thu, May 31, 2018, 9:18 PM UTC

bluejekyll wrote: post #19

jchw wrote: post #17

Earlier quoted context omitted.

Is this standardized/drafted? I am curious how one might implement this.

See this thread with one of the authors of the RFC: https://news.ycombinator.com/item?id=16728600

Everybody is right in this thread :)

First, just to avoid confusion, the post linked to this HN article is just about the classic recursive resolver model. That's the scope of what is being experimented with actively.

Second, the notion of resolverless dns (where dns records are obtained from somewhere other than your recursive resolver) is indeed something DoH contemplates but does not yet allow. That's because issues around tracking, correctness, and attacks haven't been fully explored. So unsolicited DNS is interesting but its not something any browser would accept yet.

There are some other opinions on how HTTPS matches the needs of DNS here: https://bitsup.blogspot.com/2018/05/the-benefits-of-https-fo...

Re: A cartoon intro to DNS over HTTPS

#27

Post by giggles_giggles » Thu, May 31, 2018, 9:21 PM UTC

ikeyany wrote: post #21

cremp wrote: post #16

Earlier quoted context omitted.

Cloudflare itself never made sense to me. What possible incentive do they have to stop their primary purpose (DDoS protection) - They have value in promoting the behavior. Whats worse, is everyone and their dog is using them. What happens when they push a bad config to their core routers, or foobar their anycast?

It doesn't make sense to you to do the right thing and protect people at the expense of profit?

It costs money to do the things they do. If there's no profit, the service has to beg for money, or die for lack of resources. CloudFlare is not a charity, and if it was one, it would be ineffectual because their services are too behind-the-scenes and technical to get a donor base wide enough to support them. Profit is not necessarily an anathema to doing the right thing, and if you can align your interests with your cash flow, you can do the right thing without begging for money, which imho is even better than doing the right thing but having to subsist on the money generated by profitable enterprises that aren't as noble (donated either directly, or by their employees). But of course, aligning those interests is a challenge.

Re: A cartoon intro to DNS over HTTPS

#28

Post by mike-cardwell » Thu, May 31, 2018, 9:32 PM UTC

I kind of hate this. Taking a decentralised service, and replacing it with a service provided by a small handful of tech giants.

"But this doesn’t mean you have to use Cloudflare. Users can configure Firefox to use whichever DoH-supporting recursive resolver they want. As more offerings crop up, we plan to make it easy to discover and switch to them."

Only defaults matter. Your average web user wont be interested in knowing about or configuring this, no matter how simple the explanation/choice is made.

Re: A cartoon intro to DNS over HTTPS

#29

Post by gsich » Thu, May 31, 2018, 9:40 PM UTC

I tried DNS over TLS (somewhat similar) and it has some potential. But not with those strict timeouts. 1.1.1.1 closes the TCP connection almost instantly after the query response, 9.9.9.9 waits a bit longer, about 10 seconds (need to check again).

So everytime you want to make a query, you have to wait several RTTs before getting a response.

The connection need to be open for as long as possible, at least 5 minutes.

I used stubby as forwarder with idle_timeout: 6500000, the idle timeout in ms. The connection gets closed by the remote party, not by stubby.

Re: A cartoon intro to DNS over HTTPS

#30

Post by moderation » Thu, May 31, 2018, 9:46 PM UTC

Klathmon wrote: post #24

mcone wrote: post #7

Earlier quoted context omitted.

> Does anyone know of a way to force all DNS queries in windows to use DoH? I think you could use pi-hole to do this. https://docs.pi-hole.net/guides/dns-over-https/

Thanks a ton, this looks fantastic! Do you know if it's possible to setup Pihole to use this (and possibly other features) but not do any adblocking?

I'm using cloudflared [0] for this. Allows me to have system level DoH and everything uses it (unless explicitly configured not to). Working on Linux machines (amd64 and aarch64) and MacOS.

The documentation is not great / accurate but with a bit of fiddling I have it running as a systemd service (launchctl on MacOS). I'm using the /metrics endpoint to get details in Prometheus on the stats.

0. https://github.com/cloudflare/cloudflared