Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Improving DNS Privacy with Oblivious DoH

blog.cloudflare.com

Post reply on HN
Print view View original

261–270 of 367 posts

Re: Improving DNS Privacy with Oblivious DoH

#261

Post by lawnchair_larry »

joshspankit wrote: post #239
lawnchair_larry wrote: post #141

Earlier quoted context omitted.

The bypassing has nothing to do with wanting to hide it from users Even if they did care about hiding it, they know how trivial it would be to discover it, as we already saw only hours after the release. And those lookups have nothing to do with DNS, so this wouldn’t help nor hurt anything related to that.

The bypassing has to do with exerting their control despite user wishes. Hiding “complexity” from users is one method that is at the core of Apple’s brand. Yes, very smart people uncover this kind of thing regularly, but the trend feels like Apple is just trying to refine the process until they have a “perfectly secure” device by virtue of the fact that not even legitimate owners are able to enforce their wishes when…

You’re making assumptions about their motivations, and they’re not correct. They are not doing it despite user wishes. They did it under the reasonable assumption that the user has no such wish. It likely didn’t cross their mind.

Re: Improving DNS Privacy with Oblivious DoH

#262

Post by xg15 »

stevepike wrote: post #145
TrueDuality wrote: post #119

The biggest and most consistent downside I see with these DNS enhancements is that it prevents filtering at the network level. Querying nameservers is being pushed into applications themselves to support these new features (such as Chrome and Firefox), which bypasses any system resolvers configured on the host. In most cases there is no way to signal from the network that it is not desirable to do this (Firefox being…

As someone who recently set up a pihole, I was shocked that it was possible to redirect all DNS requests on the network (in plain text!) to the pi. I did the method where you set up a network firewall at the router level that redirects all port 53 traffic to the pi. It's a nice feature for getting my xbox filtered, but it really felt like an insecure historical quirk rather than a feature we should be praising. Surel…

If I get access to those devices, yeah, sure. But in practice, I'd argue this actually reduces privacy for users, as it gives apps and devices a secure path through the network which cannot be monitored by any intermediary - including the user of the app or the owner of the device themselves. So no chance to find out what kind of data is being transmitted there either.

To me, DoH seems less about protecting the user from attackers and more about protecting apps and devices from the user.

Re: Improving DNS Privacy with Oblivious DoH

#264

Post by SamuelAdams »

Lammy wrote: post #188

It bothers me how "privacy" has been redefined in recent years to mean "encrypted" and not "surveillance-resistant". We keep building things that make more requests I can't terminate locally, e.g. to a PiHole. Never forget the lesson in "Using Metadata to find Paul Revere": https://kieranhealy.org/blog/archives/2013/06/09/using-metad...

I've not read that analysis before, thanks for the great read!

Re: Improving DNS Privacy with Oblivious DoH

#265

Post by freebuju »

alwillis wrote: post #249
freebuju wrote: post #241

Earlier quoted context omitted.

I don't think you understand how DNS works. DoT and DoH should not be confused for encrypted DNS. Encrypted dns is still a myth to most users. Major resolvers do not support it since it directly conflicts with with their data collection business. All forms of Internet communications can be largely encrypted. Dns is the last frontier remaining. It remains so for good reason...

I don't think you understand how DNS works. I don't think you're in a position to comment on what I do or don't know about DNS. Encrypted dns is still a myth to most users. Major resolvers do not support it since it directly conflicts with with their data collection business. Except those users using Firefox or Chrome, which come with DNS over HTTPS (DoH) preconfigured. Or those who've been running DoT on their home…

Again you keep referring to DoT and DoH which I insist do not encrypt your dns queries from your ISP. They may offer added security but do not keep your requests private. ODoH attempts to keep your requests private from the resolver only. A benefit which is a good step but doesn't ultimately keep your dns private from your ISP.

This is the major flaw I find with such claims of encrypted dns. Your isp can still see which sites you visit, oDoH or not.

Re: Improving DNS Privacy with Oblivious DoH

#266

Post by xg15 »

JoshTriplett wrote: post #252
iso947 wrote: post #234

Earlier quoted context omitted.

It’s progress if you control your devices, or you don’t control your network. I don’t. Like most people I can control my network. I have all sorts of crap on my network from Bose and amazon and Nintendo and Apple etc on my IoT vlan. Without going to a monk style digital life aka RMS, the best bet is to segment them into a secure network and limit what they can communicate with. The DOH Culture and the like takes away…

Then complain about devices that hardcode settings and don't allow changing them, rather than complaining about people taking what devices could already do and standardizing it so that anyone can use it in a more uniform way.

Complain to who exactly?

> people taking what devices could already do and standardizing it so that anyone can use it in a more uniform way.

In this case, standardization makes a huge difference.

Before DoH, this was theoretically possible, but needed enormous effort to pull off: The simplest thing a device could do was to hardcode custom DNS servers - but the network admin could easily bypass that by redirecting the packets, as described in this subthread.

Any more interception-proof solutions would have involved designing a custom network protocol, running a custom server and implementing custom bootstrapping logic to connect the device to the server - and even then, the traffic would stand out enough than an admin could still block or redirect it easily enough.

With DoH, there are publicly accessible servers that accept requests over plain HTTPS: This means, someone who wants to keep their ads from being blocked does not need to run any server infrastructure and does not need to fiddle with network code at all - they can just drop in a DoH client library, hardcode a list of public DoH servers and client certs and be done. This is absolutely a game-changer.

Re: Improving DNS Privacy with Oblivious DoH

#268

Post by xg15 »

acdha wrote: post #179
fiddlerwoaroof wrote: post #167

Earlier quoted context omitted.

How can they trivially bypass this local filtering? If the router is redirecting all port 53 traffic, there is no way to bypass aside from some alternate name resolution scheme.

If the network allows outbound traffic, they can hard-code an IP list - this is how Cloudflare’s 1.1.1.1 works and malware has done this for decades – or they can use local DNS to resolve a single name which will answer or redirect to a service which does further queries. Malware commonly used IRC for this until that started getting blocked on most networks, but imagine how easy it would be to miss, say, a bot which…

> If the network allows outbound traffic, they can hard-code an IP list - this is how Cloudflare’s 1.1.1.1 works and malware has done this for decades – or they can use local DNS to resolve a single name

Why can't you redirect all 53 traffic to a pihole and block that single name?

Re: Improving DNS Privacy with Oblivious DoH

#269

Post by xg15 »

acdha wrote: post #202
fiddlerwoaroof wrote: post #186

Earlier quoted context omitted.

Yeah, it’s an arms race, but I suspect it’s solvable: at least solvable enough that it’s feasible to just not use devices that break your policies. For things like Pi-Hole, the setup I describe will reduce much of the ad noise even without more complicated systems.

The way to solve is either to segregate unmanaged devices onto a separate network and give up on controlling them or to implement the system I described. The same Pi running a DNS server can run a proxy which applies blocking policies on all hostnames.

> The same Pi running a DNS server can run a proxy which applies blocking policies on all hostnames.

With DoH, it's easy to not just hardcode the resolver's IP but also the resolver's certificate. How would a proxy be able to intercept that?

Re: Improving DNS Privacy with Oblivious DoH

#270

Post by xg15 »

Kalium wrote: post #220
Lammy wrote: post #188

It bothers me how "privacy" has been redefined in recent years to mean "encrypted" and not "surveillance-resistant". We keep building things that make more requests I can't terminate locally, e.g. to a PiHole. Never forget the lesson in "Using Metadata to find Paul Revere": https://kieranhealy.org/blog/archives/2013/06/09/using-metad...

As another HN user put it: https://news.ycombinator.com/item?id=25349426 > Administering devices with network settings is convenient, but rapidly vanishing because there's no technical difference between you administering your local network and a totalitarian ISP administering their users. Your ability to terminate things locally means that finding Paul Revere with metadata isn't needed. It's a lot of work when you c…

Until the country where all those network connections terminate turns totalitarian...
Post reply on HN