Improving DNS Privacy with Oblivious DoH

Post by 1vuio0pswjnm7 » Wed, Dec 09, 2020, 12:58 AM UTC

rsync wrote: post #226

wtetzner wrote: post #183

Earlier quoted context omitted.

I don't know much about the tech, but would it be possible to setup your own local DNS server that your machines point to, and do the filtering within that DNS server?

I run my own recursive resolver (DNS server) in a datacenter. This DNS server gets its upstream resolution from nextdns.io which is configured with several blocklists - including one that is roughly analogous to ublock origin. On my local network, my DHCP server hands out my DNS server to all clients. This means that all clients on my network get fairly robust ad-blocking even if they do not have an adblocker install…

Post by teddyfrozevelt » Wed, Dec 09, 2020, 1:21 AM UTC

judge2020 wrote: post #211

saurik wrote: post #205

Earlier quoted context omitted.

On every single operating system it is possible for this kind of improvement to be installed as a system-wide replacement for the local resolver, whether by a direct plugin or by running a resolver on localhost. This is how these upgrades can be deployed if you don't want to wait for the OS. The problem is that browsers and other applications are just unwilling to let the user see how their products work or decide an…

iOS and MacOS technically have this (requires a profile[0]) but Microsoft will probably drag their feed on this for the next 2 years with the amount of enterprise customers they have to keep happy; and, given that the network adapter config is still based on Aero controls, they're probably in no rush to add more configuration options before upgrading it to Metro controls. 0: https://paulmillr.com/posts/encrypted-dns/

Post by bandie91 » Wed, Dec 09, 2020, 1:27 AM UTC

cesarb wrote: post #138

Avtomatk wrote: post #68

Earlier quoted context omitted.

I would like someone to correct me if I am wrong, but I think we can never have 100% privacy because the destination IPs cannot be encrypted or hidden, so as long as the destination IP can be observed, the server that you are connecting at can be obtained (I know a server can host many web pages, but this requires the port, which cannot be encrypted either). So I don't know to what extent this protocol can be useful.

> I know a server can host many web pages, but this requires the port, which cannot be encrypted either You can host multiple web sites in the same port since the 1990s, using name-based virtual hosts ( https://en.wikipedia.org/wiki/Virtual_hosting#Name-based ). It's rare nowadays to use a port other than 80 (for http:// ) or 443 (for https:// ) for public web sites.

Post by JMTQp8lwXL » Wed, Dec 09, 2020, 1:35 AM UTC

iso947 wrote: post #247

JMTQp8lwXL wrote: post #152

Earlier quoted context omitted.

Can't you do something analogous to editing your hosts file (but for name servers) and then re-centralize all of your apps using a single name server, which you can then control however you like?

No, because instead of setting your network to give out your DNs server to all of your devices, it’s ignored by the apps Instead of setting your devices to use a dns server of your choice it’s ignored by the apps Some apps allow you to configure them, so now you’re configuring 200 apps on 20 devices rather than just one dhcp setting. (Oh and OSs have generally broken hosts files)

Post by Spivak » Wed, Dec 09, 2020, 1:42 AM UTC

vetinari wrote: post #219

specto wrote: post #200

Earlier quoted context omitted.

I have blocked 1.1.1.1 and 8.8.8.8 and noticed some devices behave very badly, often crashing or restarting. Debugging the issue, once I removed the firewall rule they behaved normally. Almost all of the affected devices were google related, Android TV for example.

You can also DNAT all port 53 traffic to your resolver. Devices will think they are talking to 8.8.8.8 or whatever, but in reality they will ask your resolver and your filtering will apply. Your filtering can still break these devices.