DNS over TLS – Thoughts and Implementation • Hacker News Board

Re: DNS over TLS – Thoughts and Implementation

#21

Post by nykolasz » Sun, Sep 09, 2018, 4:32 AM UTC

dagenix wrote: post #18

nykolasz wrote: post #14

Earlier quoted context omitted.

I hope you are wrong. We don't need one more protocol tunneled through HTTP.

Why? What's the specific harm? AIUI, as long as the request still fits into a single frame, its not anymore inneficient.

First, I think it gives too much power to the browsers. Firefox was already taking some dangerous choices with DNS over HTTPS on some of their recent changes. Chrome as well, doing changes that will benefit Google, in detriment of the rest of the web.

Second, I think it is an overall bad design choice to tunnel a lightweight protocol on top of HTTP on top of TLS. Instead of just tunneling it under TLS.

Re: DNS over TLS – Thoughts and Implementation

#22

Post by kromem » Sun, Sep 09, 2018, 4:33 AM UTC

dagenix wrote: post #15

kromem wrote: post #12

Earlier quoted context omitted.

Not in the case of Tor, but also not in the case of almost all/most cloud hosted services. For example, consider that Cloudflare proxies about 10% of the Internet. Well, if you request a site they proxy, and DNS is in the clear, it's obvious who you are connecting to. But if you request a site and the DNS is encrypted, you could be visiting any one of 10% of the sites out there. Similarly, if hosting on AWS or Google…

... except that SNI isn't encrypted.

Good point - I totally forgot about that.

So yeah - it mostly only matters for VPN/Tor traffic.

Re: DNS over TLS – Thoughts and Implementation

#23

Post by bubblethink » Sun, Sep 09, 2018, 4:33 AM UTC

bogomipz wrote: post #4

I used Stubby and Quad9 for a few months last year but I found the latency pretty terrible unfortunately. I would be curious to hear what other people are using and what their experience has been.

Try cloudflare ? I found it beats quad9 in latency by a margin.

Re: DNS over TLS – Thoughts and Implementation

#24

Post by spc476 » Sun, Sep 09, 2018, 4:37 AM UTC

dagenix wrote: post #18

nykolasz wrote: post #14

Earlier quoted context omitted.

I hope you are wrong. We don't need one more protocol tunneled through HTTP.

Why? What's the specific harm? AIUI, as long as the request still fits into a single frame, its not anymore inneficient.

Why not tunnel everything over HTTPS then? Then even SSH will be secure!

Re: DNS over TLS – Thoughts and Implementation

#25

Post by nykolasz » Sun, Sep 09, 2018, 4:39 AM UTC

bubblethink wrote: post #23

bogomipz wrote: post #4

I used Stubby and Quad9 for a few months last year but I found the latency pretty terrible unfortunately. I would be curious to hear what other people are using and what their experience has been.

Try cloudflare ? I found it beats quad9 in latency by a margin.

Really? They both have anycast pops all over the world - and in my tests, very close performance (couple of ms of difference - if that) to be felt by anyone.

ex: https://medium.com/@nykolas.z/dns-resolvers-performance-comp...

Re: DNS over TLS – Thoughts and Implementation

#26

Post by dagenix » Sun, Sep 09, 2018, 4:48 AM UTC

nykolasz wrote: post #21

dagenix wrote: post #18

Earlier quoted context omitted.

Why? What's the specific harm? AIUI, as long as the request still fits into a single frame, its not anymore inneficient.

First, I think it gives too much power to the browsers. Firefox was already taking some dangerous choices with DNS over HTTPS on some of their recent changes. Chrome as well, doing changes that will benefit Google, in detriment of the rest of the web. Second, I think it is an overall bad design choice to tunnel a lightweight protocol on top of HTTP on top of TLS. Instead of just tunneling it under TLS.

> First, I think it gives too much power to the browsers. Firefox was already taking some dangerous choices with DNS over HTTPS on some of their recent changes. Chrome as well, doing changes that will benefit Google, in detriment of the rest of the web.

I really don't understand how DNS-over-HTTPs benefits Google to the detriment of the web anymore than over TLS would. I'm not really sure how either hurts the web.

> Second, I think it is an overall bad design choice to tunnel a lightweight protocol on top of HTTP on top of TLS. Instead of just tunneling it under TLS.

Port 443 is generally unblocked. Port 853 is often blocked. How does tunneling via HTTP on port 443 hurt anyone? Yeah, it's ridiculous, and, a result of ridiculous middle boxes imposing silly policy. But, if you can't change that (and you can't), then, what is the harm? A few wasted bytes? So what? As long as it still fits in a single frame, it still a single round trip on the network.

Re: DNS over TLS – Thoughts and Implementation

#27

Post by auslander » Sun, Sep 09, 2018, 4:48 AM UTC

I recently configured my OPNsense router, for DNS over TLS with Quad9, with certificate domain validation. It uses included Unbound resolver. Not sure what I achieved, but it does feel good :)

https://forum.opnsense.org/index.php?topic=9197.msg41265#msg...

Re: DNS over TLS – Thoughts and Implementation

#28

Post by dagenix » Sun, Sep 09, 2018, 4:48 AM UTC

djsumdog wrote: post #20

nykolasz wrote: post #14

Earlier quoted context omitted.

I hope you are wrong. We don't need one more protocol tunneled through HTTP.

I kinda agree on this. It's like pumping everything into an electron app. Not everything needs to be pumped through 80/443.

Do you want to not be blocked? That's a reason to go through 80/443.

Re: DNS over TLS – Thoughts and Implementation

#29

Post by dagenix » Sun, Sep 09, 2018, 4:49 AM UTC

spc476 wrote: post #24

dagenix wrote: post #18

Earlier quoted context omitted.

Why? What's the specific harm? AIUI, as long as the request still fits into a single frame, its not anymore inneficient.

Why not tunnel everything over HTTPS then? Then even SSH will be secure!

... which has nothing to do with what I'm talking about.

Re: DNS over TLS – Thoughts and Implementation

#30

Post by bubblethink » Sun, Sep 09, 2018, 5:27 AM UTC

nykolasz wrote: post #25

bubblethink wrote: post #23

Earlier quoted context omitted.

Try cloudflare ? I found it beats quad9 in latency by a margin.

Really? They both have anycast pops all over the world - and in my tests, very close performance (couple of ms of difference - if that) to be felt by anyone. ex: https://medium.com/@nykolas.z/dns-resolvers-performance-comp...

I don't have any benchmarking data, but in my brief testing I found that to be the case. I'm using this setup on my openwrt 18.06 router.