Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Improving DNS Privacy with Oblivious DoH

blog.cloudflare.com

Post reply on HN
Print view View original

231–240 of 367 posts

Re: Improving DNS Privacy with Oblivious DoH

#231

Post by josephcsible »

TrueDuality wrote: post #119

The biggest and most consistent downside I see with these DNS enhancements is that it prevents filtering at the network level. Querying nameservers is being pushed into applications themselves to support these new features (such as Chrome and Firefox), which bypasses any system resolvers configured on the host. In most cases there is no way to signal from the network that it is not desirable to do this (Firefox being…

It's a good thing that network-level filtering is getting harder. If you can use network-level filtering to block ads/trackers/malware from your own devices, countries and ISPs can use network-level filtering to censor other people's devices. If you want to protect your own devices, do it locally, even if it means configuring Firefox instead of just the OS.

Re: Improving DNS Privacy with Oblivious DoH

#232

Post by josephcsible »

mmis1000 wrote: post #170
darkwater wrote: post #43

Until we get rid of SNI[1] in HTTPS for good there will still be providers (like my ISP) that do deep packet inspection on SNI and kill the connection right away if you happen to visit a forbidden site (and this was western Europe, yesterday, on a site behind CloudFlare) [1] https://en.m.wikipedia.org/wiki/Server_Name_Indication

The correct answer will be reverse, get rid of SNI completely and enforce ESNI everywhere. Most bad entity now only need to block ESNI, and then the client will happily fallback to plain SNI. If everyone enforce ESNI only, then it is not gonna going to work. Just like nowadays, a browser can't view https site is completely useless because most of sites on internet were already encrypted(and the percentage is only goi…

We don't need to kill regular SNI to fix that problem. If a site's DNS record indicates that it supports eSNI, and a connection with eSNI fails, then the browser should hard-fail. And middleboxes can't lie about whether a site supports eSNI, since that's protected by DNSSEC (and it should be coming over DoH anyway). This would break the bad actors without breaking every site that didn't upgrade to eSNI.

Re: Improving DNS Privacy with Oblivious DoH

#233

Post by judge2020 »

1over137 wrote: post #218
judge2020 wrote: post #211

Earlier quoted context omitted.

iOS and MacOS technically have this (requires a profile[0]) but Microsoft will probably drag their feed on this for the next 2 years with the amount of enterprise customers they have to keep happy; and, given that the network adapter config is still based on Aero controls, they're probably in no rush to add more configuration options before upgrading it to Metro controls. 0: https://paulmillr.com/posts/encrypted-dns/

Why on earth is a "configuration profile" required for this?

I imagine Apple is weary about having a UI for this since it might cause more bad PR/complaints about people being able to get around (for example) school website filters. Chrome eased its UI rollout by introducing a managed policy that admins could configure before the UI was enabled. https://cloud.google.com/docs/chrome-enterprise/policies/?po...

Re: Improving DNS Privacy with Oblivious DoH

#234

Post by iso947 »

stevepike wrote: post #145
TrueDuality wrote: post #119

The biggest and most consistent downside I see with these DNS enhancements is that it prevents filtering at the network level. Querying nameservers is being pushed into applications themselves to support these new features (such as Chrome and Firefox), which bypasses any system resolvers configured on the host. In most cases there is no way to signal from the network that it is not desirable to do this (Firefox being…

As someone who recently set up a pihole, I was shocked that it was possible to redirect all DNS requests on the network (in plain text!) to the pi. I did the method where you set up a network firewall at the router level that redirects all port 53 traffic to the pi. It's a nice feature for getting my xbox filtered, but it really felt like an insecure historical quirk rather than a feature we should be praising. Surel…

It’s progress if you control your devices, or you don’t control your network.

I don’t. Like most people I can control my network.

I have all sorts of crap on my network from Bose and amazon and Nintendo and Apple etc on my IoT vlan.

Without going to a monk style digital life aka RMS, the best bet is to segment them into a secure network and limit what they can communicate with. The DOH Culture and the like takes away my freedoms.

Re: Improving DNS Privacy with Oblivious DoH

#235

Post by SkyPuncher »

fiddlerwoaroof wrote: post #167
acdha wrote: post #151

Earlier quoted context omitted.

The problem is that the things you most want to block can trivially bypass your local DNS filtering - DoH is just standardizing something which has been done for decades. The only effective measure is to block outbound network access and require use of a proxy, possibly optimized by allowing direct traffic only from clients with functioning endpoint monitoring agents.

How can they trivially bypass this local filtering? If the router is redirecting all port 53 traffic, there is no way to bypass aside from some alternate name resolution scheme.

Based on this: https://stackoverflow.com/questions/33099569/how-does-sock-5...

> Firefox, for example, sends hostname to SOCKS proxy without resolving it.

So a simple proxy can bypass local restrictions.

-----

I remember doing something similar back in my IT days just to see if it was possible. It was.

Re: Improving DNS Privacy with Oblivious DoH

#236

Post by dj_mc_merlin »

Is it not still possible to do a pi-hole kind of setup for DoH or ODoH? All you have to do is setup the server as a proxy for all http(s) connections on top of DNS connections and trust its cert on the client. If we can reliably block all ad networks with uBlock origin, picking out DNS requests from other http requests should be even simpler, right?

Re: Improving DNS Privacy with Oblivious DoH

#237

Post by judge2020 »

jamescun wrote: post #19

Preventing the target resolver from seeing client's IP address breaks GeoDNS. This is already a problem with 1.1.1.1 which doesn't honour the EDNS client subnet extension. Given generally DNS is just the start of an intereaction, usually followed by the connection directly between the client and intended destination, I don't see what kind of snooping these privacy measures are there to prevent.

> which doesn't honour the EDNS client subnet extension.

background: https://news.ycombinator.com/item?id=19828702

Re: Improving DNS Privacy with Oblivious DoH

#238

Post by joshspankit »

simonh wrote: post #96
joshspankit wrote: post #91

Earlier quoted context omitted.

I’m guessing they want to hide it more from users. The recent bypassing of local firewalls shows this, for example.

Wouldn't it still show up in netstat?

https://twitter.com/patrickwardle/status/1318465421796782082

Re: Improving DNS Privacy with Oblivious DoH

#239

Post by joshspankit »

lawnchair_larry wrote: post #141
joshspankit wrote: post #91

Earlier quoted context omitted.

I’m guessing they want to hide it more from users. The recent bypassing of local firewalls shows this, for example.

The bypassing has nothing to do with wanting to hide it from users Even if they did care about hiding it, they know how trivial it would be to discover it, as we already saw only hours after the release. And those lookups have nothing to do with DNS, so this wouldn’t help nor hurt anything related to that.

The bypassing has to do with exerting their control despite user wishes. Hiding “complexity” from users is one method that is at the core of Apple’s brand.

Yes, very smart people uncover this kind of thing regularly, but the trend feels like Apple is just trying to refine the process until they have a “perfectly secure” device by virtue of the fact that not even legitimate owners are able to enforce their wishes when those wishes are counter to Apple’s mandates.

Post reply on HN