Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Improving DNS Privacy with Oblivious DoH

blog.cloudflare.com

Post reply on HN
Print view View original

221–230 of 367 posts

Re: Improving DNS Privacy with Oblivious DoH

#221

Post by e12e »

diegocg wrote: post #105
baskire wrote: post #69

Earlier quoted context omitted.

All I see is a proxy service and a way for cloudflare to get access to the data

The proxy sees the client IP, but can't look at the encrypted DNS request. The DNS server sees (deciphers) the DNS query, but not the client IP address. It's a proxy, but with the sensible data encrypted with the server's public keys to hide it from the proxy. Cloudflare never knows who is sending the requests. How can they get access to the data?

They run both, or buy data from the company that runs the other half?

I'm not sure I see the point,tbh. If you want to control dns, why not resolve yourself, with whatever cache you need? And if you trust a company to do that for you - assuming the two companies do log "their half" - you're just a data breach, data broker agreement or an acquisition away from a commercial entity having all the data (again)?

Re: Improving DNS Privacy with Oblivious DoH

#222

Post by 1over137 »

gsnedders wrote: post #17
landerwust wrote: post #13

Earlier quoted context omitted.

DNSCrypt needs meaningful industry support otherwise it's sadly irrelevant. I think by now we can all agree "industry support" basically means the 3 browser vendors. DoH has at least Mozilla and Google on board, and presumably Microsoft are tailing along.

> DoH has at least Mozilla and Google on board, and presumably Microsoft are tailing along. Note that DoH (and DoT) shipped in iOS 14 and Big Sur, though aren't particularly easy to enable.

Anyone have any idea why they chose to require 'configuration profiles' here?

Also, don't 'configuration profiles' require that your Mac have an associated AppleID?

Re: Improving DNS Privacy with Oblivious DoH

#223

Post by [deleted] »

wil421 wrote: post #103
baskire wrote: post #69

Earlier quoted context omitted.

All I see is a proxy service and a way for cloudflare to get access to the data

Do you want Google and your ISPs to see everything? Cloudflare and maybe Apple (not sure what infrastructure they’d have in this if any)? Another company like Cloudflare? I don’t know the answer but I’m curious to hear everyone’s thoughts. Personally I’d like to prevent Google and my ISPs but Cloudflare could easily become Google in many ways.

[deleted]

Re: Improving DNS Privacy with Oblivious DoH

#224

Post by 1over137 »

g42gregory wrote: post #164

Do I understand this correctly that if DoH is implemented, none of the firewalls will be able to block the web sites? Including the pi-hole firewalls, as an example. If that's the case, this situation can't stand for long. Does this meant that the DoH would need to be extended to allow firewalls to decrypt it? If not, here is a PaloAlto Networks blog advertising capability to block all DoH traffic, presumably at work…

>Do I understand this correctly that if...

You understand correctly. DoH mostly defeats pihole and the like. Presumably Google and other ad companies love this.

Re: Improving DNS Privacy with Oblivious DoH

#225

Post by dhaavi »

judge2020 wrote: post #216
fiddlerwoaroof wrote: post #184

Earlier quoted context omitted.

Well, it’s more complicated, but in theory you could do some deep packet inspection that understands the protocols: personally, I’d use this to break DoH connections (for every host name seen in SNI, attempt a DoH query, if it resolves, reset the connection) and attempt to force everything to fall back to plain DNS. Then, whitelist a couple outbound ports (on most networks, maybe just 443 + 53?) and block VPNs.

> or every host name seen in SNI Not going to be possible in a few years or so: https://news.ycombinator.com/item?id=25344311

meh. The outer SNI and the IP address still tell a lot about what you are doing online.

Re: Improving DNS Privacy with Oblivious DoH

#226

Post by rsync »

wtetzner wrote: post #183
TrueDuality wrote: post #119

The biggest and most consistent downside I see with these DNS enhancements is that it prevents filtering at the network level. Querying nameservers is being pushed into applications themselves to support these new features (such as Chrome and Firefox), which bypasses any system resolvers configured on the host. In most cases there is no way to signal from the network that it is not desirable to do this (Firefox being…

I don't know much about the tech, but would it be possible to setup your own local DNS server that your machines point to, and do the filtering within that DNS server?

I run my own recursive resolver (DNS server) in a datacenter.

This DNS server gets its upstream resolution from nextdns.io which is configured with several blocklists - including one that is roughly analogous to ublock origin.

On my local network, my DHCP server hands out my DNS server to all clients.

This means that all clients on my network get fairly robust ad-blocking even if they do not have an adblocker installed. It also means that non-browser clients (Sonos, AppleTV, etc.) get ad/tracker blocking as well.

DoH sort of breaks all of this, unfortunately.

Individual devices or clients or browsers can now connect to trackers and ad-servers over HTTPS, bypassing my adblocking resolver.

I thought that perhaps there was a solution wherein you would pre-query every single new IP you connected to over HTTPS and send it a test DNS query .. and if it answered DNS, you would just refuse to talk to it. I think this falls apart, however, if (for instance) google just queries "google.com" ... now you're denying google.com because it answers DNS queries over HTTPS...

Look, back when 8.8.8.8 came online I could just smell it ... I knew there was a user-hostile arms race somewhere in there I just didn't know where. Now we know.

Re: Improving DNS Privacy with Oblivious DoH

#227

Post by dhaavi »

fiddlerwoaroof wrote: post #184
chipb wrote: post #176

Earlier quoted context omitted.

How well does the redirect scheme work for a device that connects to a central DNS server listening on, say, port 5353 instead? What about 80 or 443?

Well, it’s more complicated, but in theory you could do some deep packet inspection that understands the protocols: personally, I’d use this to break DoH connections (for every host name seen in SNI, attempt a DoH query, if it resolves, reset the connection) and attempt to force everything to fall back to plain DNS. Then, whitelist a couple outbound ports (on most networks, maybe just 443 + 53?) and block VPNs.

With the Portmaster (https://github.com/safing/portmaster) we're going in that direction, but it will take a couple more years to be able to go that deep. Have a look!

Re: Improving DNS Privacy with Oblivious DoH

#228

Post by rsync »

hkt wrote: post #122
TrueDuality wrote: post #119

The biggest and most consistent downside I see with these DNS enhancements is that it prevents filtering at the network level. Querying nameservers is being pushed into applications themselves to support these new features (such as Chrome and Firefox), which bypasses any system resolvers configured on the host. In most cases there is no way to signal from the network that it is not desirable to do this (Firefox being…

Applications still have fallback though, right? If so, I foresee blocks on DoH/etc to common resolvers like 8.8.8.8 and 1.1.1.1. I'll be blocking them at home on the assumption that I only want regular DNS lookups so I can point them to my own DNS server etc.

"If so, I foresee blocks on DoH/etc to common resolvers like 8.8.8.8 and 1.1.1.1. I'll be blocking them at home on the assumption that I only want regular DNS lookups so I can point them to my own DNS server etc."

I wish it were that easy but it's very predictable that google will start resolving DoH on plain old "google.com".

So will everyone else ... it's not going to be malicious.userhostile.resolver.samsung.com, it's just going to be samsung.com ... so you can block it but you'll be blocking more than just the resolver ...

Re: Improving DNS Privacy with Oblivious DoH

#229

Post by dhaavi »

TrueDuality wrote: post #119

The biggest and most consistent downside I see with these DNS enhancements is that it prevents filtering at the network level. Querying nameservers is being pushed into applications themselves to support these new features (such as Chrome and Firefox), which bypasses any system resolvers configured on the host. In most cases there is no way to signal from the network that it is not desirable to do this (Firefox being…

> bypasses any system resolvers configured on the host

With the Portmaster (https://github.com/safing/portmaster) we actually tackle this problem by notifying software (eg. Firefox) or blocking their connections, forcing them back to plain DNS, which we can redirect and handle. Take a look!

Re: Improving DNS Privacy with Oblivious DoH

#230

Post by dhaavi »

0x426577617265 wrote: post #127
hkt wrote: post #122

Earlier quoted context omitted.

Applications still have fallback though, right? If so, I foresee blocks on DoH/etc to common resolvers like 8.8.8.8 and 1.1.1.1. I'll be blocking them at home on the assumption that I only want regular DNS lookups so I can point them to my own DNS server etc.

Blocking traffic for known DoH services would be trivial. How about blocking unknown, how would you block that?

Think out of the box: Just don't let the app connect to an IP it has not resolved a domain name for.

That's what we can do with the Portmaster (https://github.com/safing/portmaster). Check it out!

Post reply on HN