Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Improving DNS Privacy with Oblivious DoH

blog.cloudflare.com

Post reply on HN
Print view View original

241–250 of 367 posts

Re: Improving DNS Privacy with Oblivious DoH

#241

Post by freebuju »

alwillis wrote: post #162
freebuju wrote: post #41

Misleading title. Apple devices are not anywhere near ready to utilize this dns protocol. Apart from that, yeah let's shift our dns trust to one of the biggest data resolvers! The irony... Encrypted dns might be already in use by government or military agencies, but they know too well the effects of cascading this tech down to the masses. They will never let this reach the public.

Apple devices are not anywhere near ready to utilize this dns protocol. The latest versions of macOS and iOS already support DoH and DoT; Apple could push an update tomorrow to enable ODoH tomorrow if they wanted to. Encrypted dns might be already in use by government or military agencies, but they know too well the effects of cascading this tech down to the masses. They will never let this reach the public. You do k…

I don't think you understand how DNS works.

DoT and DoH should not be confused for encrypted DNS.

Encrypted dns is still a myth to most users. Major resolvers do not support it since it directly conflicts with with their data collection business.

All forms of Internet communications can be largely encrypted. Dns is the last frontier remaining. It remains so for good reason...

Re: Improving DNS Privacy with Oblivious DoH

#242

Post by tptacek »

theamk wrote: post #199
tptacek wrote: post #93

Earlier quoted context omitted.

It has nothing to do with DNSSEC.

Huh? They say this: > The whole process begins with clients that encrypt their query for the target using HPKE. Clients obtain the target’s public key via DNS, where it is bundled into a HTTPS resource record and protected by DNSSEC. When the TTL for this key expires, clients request a new copy of the key as needed (just as they would for an A/AAAA record when that record’s TTL expires). The usage of a target’s DNSSE…

Oh, gross! I missed that; I read the TechCrunch article and thought I understand what they were going for. Thanks for the correction. That's disgusting.

Re: Improving DNS Privacy with Oblivious DoH

#243

Post by yardstick »

acdha wrote: post #151
TrueDuality wrote: post #119

The biggest and most consistent downside I see with these DNS enhancements is that it prevents filtering at the network level. Querying nameservers is being pushed into applications themselves to support these new features (such as Chrome and Firefox), which bypasses any system resolvers configured on the host. In most cases there is no way to signal from the network that it is not desirable to do this (Firefox being…

The problem is that the things you most want to block can trivially bypass your local DNS filtering - DoH is just standardizing something which has been done for decades. The only effective measure is to block outbound network access and require use of a proxy, possibly optimized by allowing direct traffic only from clients with functioning endpoint monitoring agents.

DoH is highlighting the security nightmare that is AWS, GCP, Azure, Cloudflare etc with their reverse proxies and virtual hosts, making it impossible to safely restrict a network from communicating with only a specific cloud-hosted service.

Also often perfect security isn’t required. Doors with locks are good, but useless if the burglar just breaks the full length glass window next to it. They still serve a purpose, but don’t need to be an absolute comprehensive solution.

Re: Improving DNS Privacy with Oblivious DoH

#244

Post by Denvercoder9 »

OJFord wrote: post #206
stevepike wrote: post #145

Earlier quoted context omitted.

As someone who recently set up a pihole, I was shocked that it was possible to redirect all DNS requests on the network (in plain text!) to the pi. I did the method where you set up a network firewall at the router level that redirects all port 53 traffic to the pi. It's a nice feature for getting my xbox filtered, but it really felt like an insecure historical quirk rather than a feature we should be praising. Surel…

The 'historical quirk' per my understanding is pretty much IPv4 NAT. At least, I couldn't figure out how to do it with IPv6 (no (need for) NAT) - I ended up dropping them if not destined for my desired DNS instead. (NAT lets you Translate Addresses, usually to save IPv4 space, but here to redirect to a different DNS. IPv6 fixes the address space problem with more addresses, so the hack is done away with, and everythi…

Any firewall worth its salt can do this with IPv6 as well. There's nothing on a technical level preventing it.

Re: Improving DNS Privacy with Oblivious DoH

#245

Post by mike_d »

ignoramous wrote: post #31
jamescun wrote: post #19

Preventing the target resolver from seeing client's IP address breaks GeoDNS. This is already a problem with 1.1.1.1 which doesn't honour the EDNS client subnet extension. Given generally DNS is just the start of an intereaction, usually followed by the connection directly between the client and intended destination, I don't see what kind of snooping these privacy measures are there to prevent.

Valid points, but... > Preventing the target resolver from seeing client's IP address breaks GeoDNS. If the proxy and the target are in the same metro as the user, it shouldn't really matter. > This is already a problem with 1.1.1.1 which doesn't honour the EDNS client subnet extension. 1.1.1.1 runs at Cloudflare's edge. Most likely it is recursing DNS from more or less the same location as the user and so ECS isn't…

> If the proxy and the target are in the same metro as the user, it shouldn't really matter.

Having ran one of the largest public DNS resolvers on the internet, I can tell you it is a big problem. GeoIP providers do not have the fine grained data to be able to tell that a resolvers unicast address is in Seattle vs Chicago for example.

Cloudflare doesn't care about edns-client-subnet because the only downside is that other CDNs appear slower to their users.

Re: Improving DNS Privacy with Oblivious DoH

#246

Post by hrez »

TrueDuality wrote: post #169
stevepike wrote: post #160

Earlier quoted context omitted.

Can you explain (or share a link) to some proposal for how to enable my pihole to securely talk to upstream resolvers but force all embedded devices on my network to go through the pihole? Anything that lets my pihole sidestep my ISP seems like it'd also work for my xbox.

I don't have any resources handily available for that. I would be truly surprised if pi-hole's don't support DoH though so I'd just try searching for something like "enabling DoH on a pihole" or similar. Basically sounds like you've already done the hardest parts. Your router is redirecting all DNS traffic to your pi-hole, this will prevent any normal unencrypted DNS traffic from leaving your local network. You pi-ho…

Nothing would prevent DOH to use : as a resolver. Be it an application or a device. Pi-hole will never see it.

Re: Improving DNS Privacy with Oblivious DoH

#247

Post by iso947 »

JMTQp8lwXL wrote: post #152
TrueDuality wrote: post #119

The biggest and most consistent downside I see with these DNS enhancements is that it prevents filtering at the network level. Querying nameservers is being pushed into applications themselves to support these new features (such as Chrome and Firefox), which bypasses any system resolvers configured on the host. In most cases there is no way to signal from the network that it is not desirable to do this (Firefox being…

Can't you do something analogous to editing your hosts file (but for name servers) and then re-centralize all of your apps using a single name server, which you can then control however you like?

No, because instead of setting your network to give out your DNs server to all of your devices, it’s ignored by the apps

Instead of setting your devices to use a dns server of your choice it’s ignored by the apps

Some apps allow you to configure them, so now you’re configuring 200 apps on 20 devices rather than just one dhcp setting.

(Oh and OSs have generally broken hosts files)

Re: Improving DNS Privacy with Oblivious DoH

#248

Post by [deleted] »

TrueDuality wrote: post #119

The biggest and most consistent downside I see with these DNS enhancements is that it prevents filtering at the network level. Querying nameservers is being pushed into applications themselves to support these new features (such as Chrome and Firefox), which bypasses any system resolvers configured on the host. In most cases there is no way to signal from the network that it is not desirable to do this (Firefox being…

[deleted]

Re: Improving DNS Privacy with Oblivious DoH

#249

Post by alwillis »

freebuju wrote: post #241
alwillis wrote: post #162

Earlier quoted context omitted.

Apple devices are not anywhere near ready to utilize this dns protocol. The latest versions of macOS and iOS already support DoH and DoT; Apple could push an update tomorrow to enable ODoH tomorrow if they wanted to. Encrypted dns might be already in use by government or military agencies, but they know too well the effects of cascading this tech down to the masses. They will never let this reach the public. You do k…

I don't think you understand how DNS works. DoT and DoH should not be confused for encrypted DNS. Encrypted dns is still a myth to most users. Major resolvers do not support it since it directly conflicts with with their data collection business. All forms of Internet communications can be largely encrypted. Dns is the last frontier remaining. It remains so for good reason...

I don't think you understand how DNS works. I don't think you're in a position to comment on what I do or don't know about DNS.

Encrypted dns is still a myth to most users. Major resolvers do not support it since it directly conflicts with with their data collection business.

Except those users using Firefox or Chrome, which come with DNS over HTTPS (DoH) preconfigured. Or those who've been running DoT on their home networks, which I setup quite a while ago now.

From the Wikipedia article on DoH, emphasis mine: "A goal of the method is to increase user privacy and security by preventing eavesdropping and manipulation of DNS data by man-in-the-middle attacks[1] by using the HTTPS protocol to encrypt the data between the DoH client and the DoH-based DNS resolver.

DNS over TLS (DoT) RFC: "This document describes the use of Transport Layer Security (TLS) to provide privacy for DNS. Encryption provided by TLS eliminates opportunities for eavesdropping and on-path tampering with DNS queries in the network, such as discussed in RFC 7626."

The lack of DNS encryption isn't what Apple and Cloudflare are addressing; it's that whoever runs the DNS resolver can still see the websites you're visiting and ODoH fixes that.

Re: Improving DNS Privacy with Oblivious DoH

#250

Post by JoshTriplett »

judge2020 wrote: post #211
saurik wrote: post #205

Earlier quoted context omitted.

On every single operating system it is possible for this kind of improvement to be installed as a system-wide replacement for the local resolver, whether by a direct plugin or by running a resolver on localhost. This is how these upgrades can be deployed if you don't want to wait for the OS. The problem is that browsers and other applications are just unwilling to let the user see how their products work or decide an…

iOS and MacOS technically have this (requires a profile[0]) but Microsoft will probably drag their feed on this for the next 2 years with the amount of enterprise customers they have to keep happy; and, given that the network adapter config is still based on Aero controls, they're probably in no rush to add more configuration options before upgrading it to Metro controls. 0: https://paulmillr.com/posts/encrypted-dns/

This is exactly why browsers support doing their own name resolution: because some OSes advance much more slowly.
Post reply on HN