Project dnsprivacy-monitoring, auto updated table of supported security features by DNS provider:
DNS over TLS – Thoughts and Implementation
31–40 of 88 posts
Re: DNS over TLS – Thoughts and Implementation
#32What's the point of confidentiality for DNS? Can't an attacker pretty easily get IP-to-DNS mappings to discover who you're talking to? I guess not in the case of VPNs/TOR?
Not in the case of Tor, but also not in the case of almost all/most cloud hosted services. For example, consider that Cloudflare proxies about 10% of the Internet. Well, if you request a site they proxy, and DNS is in the clear, it's obvious who you are connecting to. But if you request a site and the DNS is encrypted, you could be visiting any one of 10% of the sites out there. Similarly, if hosting on AWS or Google…
> Cloudflare proxies about 10% of the Internet
... and strips SSL off on their side, so 10% of internet is, in fact, MITMed.
Re: DNS over TLS – Thoughts and Implementation
#33Earlier quoted context omitted.
I kinda agree on this. It's like pumping everything into an electron app. Not everything needs to be pumped through 80/443.
Do you want to not be blocked? That's a reason to go through 80/443.
Is this even an issue? Just look at games. They use various ports all the time. It still works. Don't optimize for crappy networks, it's not worth it.
Re: DNS over TLS – Thoughts and Implementation
#34Earlier quoted context omitted.
Why? What's the specific harm? AIUI, as long as the request still fits into a single frame, its not anymore inneficient.
First, I think it gives too much power to the browsers. Firefox was already taking some dangerous choices with DNS over HTTPS on some of their recent changes. Chrome as well, doing changes that will benefit Google, in detriment of the rest of the web. Second, I think it is an overall bad design choice to tunnel a lightweight protocol on top of HTTP on top of TLS. Instead of just tunneling it under TLS.
I don't really see how encoding a DNS request as HTTP gives extra power to browsers. What power do they gain by writing "GET www.example.com" after a TLS handshake with port 443 versus writing "1234 0 0 0 0 1 0 0 1 0 0 0 ..." after a handshake with port 53?
Browsers can already do whatever they want to the URL you type in. What DNS packets look like does not add or remove any power.
Meanwhile, https isn't exactly heavy, and it's very well supported by everything. Every programming language has an https library. Writing an DNS-over-HTTPS program will be 3 lines of code.
Re: DNS over TLS – Thoughts and Implementation
#35Earlier quoted context omitted.
Not in the case of Tor, but also not in the case of almost all/most cloud hosted services. For example, consider that Cloudflare proxies about 10% of the Internet. Well, if you request a site they proxy, and DNS is in the clear, it's obvious who you are connecting to. But if you request a site and the DNS is encrypted, you could be visiting any one of 10% of the sites out there. Similarly, if hosting on AWS or Google…
... except that SNI isn't encrypted.
[deleted]
Re: DNS over TLS – Thoughts and Implementation
#36Earlier quoted context omitted.
Not in the case of Tor, but also not in the case of almost all/most cloud hosted services. For example, consider that Cloudflare proxies about 10% of the Internet. Well, if you request a site they proxy, and DNS is in the clear, it's obvious who you are connecting to. But if you request a site and the DNS is encrypted, you could be visiting any one of 10% of the sites out there. Similarly, if hosting on AWS or Google…
... except that SNI isn't encrypted.
Not yet, but encrypted SNI is on the way.
Re: DNS over TLS – Thoughts and Implementation
#37Article starts by stating that DNS doesn't provide a means to guarantee integrity of the returned DNS data. Then mentions DNSSEC as a protocol which exists to provide such guarantee and promptly dismisses it along with DNSCURVE and DNSCRYPT as protocols which have been so infrequently deployed as to be non-existent. Further on states that DNS over TLS and DNS over HTTPS don't solve the integrity problem but that is o…
There's two ways to ensure the authenticity of data delivered over the Internet. You can authenticate the content or you can authenticate the channel . Overwhelmingly, practical security schemes on the Internet rely on channel security . We rely on TLS to ensure the integrity of the DOM on websites; we don't cryptographically sign the pages themselves. All things being equal, you'd like to be doing both things . You'…
Practical forgery attacks against an arbitrary client are hard, but configuring a public WiFi AP to intercept your favourite repeating-digit DNS server is trivial. Lots of people use public WiFi!
In such a scenario a VPN is a more secure answer than DNS-over-TLS, but this isn’t a realistic answer for the average user. It has to be something that is free and easy to enable.
Re: DNS over TLS – Thoughts and Implementation
#38Earlier quoted context omitted.
Not in the case of Tor, but also not in the case of almost all/most cloud hosted services. For example, consider that Cloudflare proxies about 10% of the Internet. Well, if you request a site they proxy, and DNS is in the clear, it's obvious who you are connecting to. But if you request a site and the DNS is encrypted, you could be visiting any one of 10% of the sites out there. Similarly, if hosting on AWS or Google…
> Cloudflare proxies about 10% of the Internet ... and strips SSL off on their side, so 10% of internet is, in fact, MITMed.
Be fair, this is configurable. So only 9.9% of the internet is probably MITMable.
(:
Re: DNS over TLS – Thoughts and Implementation
#39I used Stubby and Quad9 for a few months last year but I found the latency pretty terrible unfortunately. I would be curious to hear what other people are using and what their experience has been.
I used SSH SOCKS tunnels with stubby to keep myself online inside China's state firewall two recent trips. commercial VPN are routinely slowed down or blocked, if you have the luxury of an SSH enabled host "outside" you can use, Stubby and this are good, to get around DNS rewriting tricks and port/ip filters. Yes, you have have slower paths, trombone paths. But in the circumstances I was in, Stubby was a godsend. Als…
This is surprising, as I've had my SSH connection throttled from within China.
Re: DNS over TLS – Thoughts and Implementation
#40Earlier quoted context omitted.
Not in the case of Tor, but also not in the case of almost all/most cloud hosted services. For example, consider that Cloudflare proxies about 10% of the Internet. Well, if you request a site they proxy, and DNS is in the clear, it's obvious who you are connecting to. But if you request a site and the DNS is encrypted, you could be visiting any one of 10% of the sites out there. Similarly, if hosting on AWS or Google…
> Cloudflare proxies about 10% of the Internet ... and strips SSL off on their side, so 10% of internet is, in fact, MITMed.
The majority of the Internet is MITMed nowadays.