Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Analyzing DNS-over-HTTPS and DNS-over-TLS Privacy and Security Claims

blog.technitium.com

Post reply on HN
Print view View original

31–40 of 67 posts

Re: Analyzing DNS-over-HTTPS and DNS-over-TLS Privacy and Security Claims

#31

Post by judge2020 »

jdsnape wrote: post #24
shawnz wrote: post #22

> DNS is one important control planes in a network. It essentially allows network administrators to block content based on domain names making it quite useful tool in the arsenal. It is being widely used to provide content filtering services, parental controls, and to block known malware command and control. Its so popular that a lot of people install a locally running DNS server on their home networks to block Inter…

I'm not convinced IP-based blocking can be more effective than DNS blocking. Very often many different sites are hosted on one IP address (e.g. a CDN in the 'worst' case), and IP blocking would mean lots of things become inaccessible. Users access services by DNS name, so if you want to control access it has to be at that level. Whether DNS can be effectively blocked while maintaining privacy is another issue, but I…

I agree, CF allows porn and blocking every Cloudflare site isn't a viable course of action for most people. Governments like UK that mandate restricting access shouldn't be doing it for you by DPI'ing DNS.

Instead, any blocking needs to be done on the device, whether it be MDM for any business-related blocking or via Parental Controls/Restrictions for blocking porn.

Re: Analyzing DNS-over-HTTPS and DNS-over-TLS Privacy and Security Claims

#32

Post by judge2020 »

icebraining wrote: post #13
the8472 wrote: post #10

Earlier quoted context omitted.

How would chrome know whether getaddrinfo() uses DoH to resolve a host?

Anyone can link to their own getaddrinfo(), including an internal function, they don't have to use one from whichever libc happens to be laying around on the system. In theirs, they read the DNS servers from the OS (like the original), and then if it's part of a list of known DoH providers, they try to connect over DoH before falling back to regular DNS queries.

For reference, the code that does the protocol upgrade: https://github.com/chromium/chromium/blob/711b1ba2735f8af4bd...

Re: Analyzing DNS-over-HTTPS and DNS-over-TLS Privacy and Security Claims

#33

Post by zzzcpan »

tptacek wrote: post #29
jchw wrote: post #28

Earlier quoted context omitted.

>DoH sacrifices the security of networks in favor of end-users I agree, if you are considering the approach of just using an arbitrary DoH server. But I think it would be nice if people would at least acknowledge that this is not a fault of DoH. One could envision a future where local DNS servers could support DoH. I don't know how far away from reality this is, though. If this is somehow a fault of DoH, I apologize…

It's not at all a fault of DoH, since preventing "control plane operators" from coercing end-users into giving up their privacy is DoH's primary goal.

End users are not coerced by operators, they are the operators on their own devices and can do whatever the hell they want. The primary goal of DoH as proposed and implemented is to take away that ability from end users, hide that control from them. It's nothing more but malicious anti-user behavior.

Re: Analyzing DNS-over-HTTPS and DNS-over-TLS Privacy and Security Claims

#34

Post by judge2020 »

kchamplewski wrote: post #21
tptacek wrote: post #19

Earlier quoted context omitted.

Two primary use cases were considered during this protocol's development. These use cases are preventing on-path devices from interfering with DNS operations, and also allowing web applications to access DNS information via existing browser APIs in a safe way consistent with Cross Origin Resource Sharing (CORS). Virtually all the opposition to DoH is rooted in two complaints: 1. It centralizes DNS at Cloudflare (obvi…

The biggest complaint I have regarding DoH is that it's extremely painful to configure because every application does it individually. If I could configure DoH at the system level, as I do normal DNS, I'd be perfectly happy. As it stands, DoH could trivially be co-opted by browser vendors to ignore system DNS settings, and even if it isn't, it still makes DNS configuration a worse experience.

You can do this on Android Pie and newer, but the overall rollout on other systems might be held up due to the potential issues with enterprises not being happy that their DNS systems are no longer working (and that this is probably far from having priority P0).

Re: Analyzing DNS-over-HTTPS and DNS-over-TLS Privacy and Security Claims

#35

Post by zzzcpan »

jchw wrote: post #23

Part of Paul Vixie’s argument is that DNS is part of the control plane, and that DoH will bypass security policy. Let’s at least address this with some skepticism. 1. Is security policy via DNS really a good way to go? There are other, imo more effective, ways of handling this. If your security policy can be defeated by using a DoH resolver, it’s evidently not very hard to bypass. 2. While this can be true, it’s not…

> The control plane is not under their control necessarily.

It is. They can even install a VPN everywhere they want, that's how much control they have. DoH wants to take it away.

> I suspect ESNI will have no trouble gaining meaningful marketshare.

You have not been paying attention. Those same organizations removed the exact ability esni proposes once governments applied a bit of pressure on them (I'm talking about collateral freedom domain fronting thing).

Re: Analyzing DNS-over-HTTPS and DNS-over-TLS Privacy and Security Claims

#36

Post by jchw »

zzzcpan wrote: post #35
jchw wrote: post #23

Part of Paul Vixie’s argument is that DNS is part of the control plane, and that DoH will bypass security policy. Let’s at least address this with some skepticism. 1. Is security policy via DNS really a good way to go? There are other, imo more effective, ways of handling this. If your security policy can be defeated by using a DoH resolver, it’s evidently not very hard to bypass. 2. While this can be true, it’s not…

> The control plane is not under their control necessarily. It is. They can even install a VPN everywhere they want, that's how much control they have. DoH wants to take it away. > I suspect ESNI will have no trouble gaining meaningful marketshare. You have not been paying attention. Those same organizations removed the exact ability esni proposes once governments applied a bit of pressure on them (I'm talking about…

> It is. They can even install a VPN everywhere they want, that's how much control they have. DoH wants to take it away.

The network control plane is not on the end user’s computer. For a home network, this is probably their ISPs modem, followed their ISPs actual edge. You could opt to set up your own DNS server or use an alternate DNS server, which is bypassing the control plane, assuming your ISP doesn’t force you to use their restrictive equipment.

The difference between DoH and regular DNS here is that even if you choose another resolver, unencrypted DNS can still be intercepted, logged, and modified by the control plane; many providers have been doing this to monetize NX DOMAIN responses even when the user is using another DNS resolver. I first realized this when attempting to get rid of annoying NX DOMAIN search SPAM pages on my phone years ago... That is precisely why this issue is coming up now and not earlier when cleartext alternate DNS resolvers gained some popularity.

> DoH wants to take it away.

What does DoH take away? You can still configure your resolver today.

> You have not been paying attention. Those same organizations removed the exact ability esni proposes once governments applied a bit of pressure on them (I'm talking about collateral freedom domain fronting thing).

What have providers removed from ESNI?

Re: Analyzing DNS-over-HTTPS and DNS-over-TLS Privacy and Security Claims

#37

Post by tptacek »

zzzcpan wrote: post #33
tptacek wrote: post #29

Earlier quoted context omitted.

It's not at all a fault of DoH, since preventing "control plane operators" from coercing end-users into giving up their privacy is DoH's primary goal.

End users are not coerced by operators, they are the operators on their own devices and can do whatever the hell they want. The primary goal of DoH as proposed and implemented is to take away that ability from end users, hide that control from them. It's nothing more but malicious anti-user behavior.

This is obviously false.

Re: Analyzing DNS-over-HTTPS and DNS-over-TLS Privacy and Security Claims

#38

Post by zzzcpan »

jchw wrote: post #36
zzzcpan wrote: post #35

Earlier quoted context omitted.

> The control plane is not under their control necessarily. It is. They can even install a VPN everywhere they want, that's how much control they have. DoH wants to take it away. > I suspect ESNI will have no trouble gaining meaningful marketshare. You have not been paying attention. Those same organizations removed the exact ability esni proposes once governments applied a bit of pressure on them (I'm talking about…

> It is. They can even install a VPN everywhere they want, that's how much control they have. DoH wants to take it away. The network control plane is not on the end user’s computer. For a home network, this is probably their ISPs modem, followed their ISPs actual edge. You could opt to set up your own DNS server or use an alternate DNS server, which is bypassing the control plane, assuming your ISP doesn’t force you…

> which is bypassing the control plane

This is not bypassing the control plane, this is the control plane. Each device is essentially its own network that connects to other networks. This is how operating systems work today.

> You can still configure your resolver today.

Yes, because of people who pushed back Mozilla.

Re: Analyzing DNS-over-HTTPS and DNS-over-TLS Privacy and Security Claims

#39

Post by fanf2 »

Ayesh wrote: post #2

I like Chrome's approach to DoH. If the local DNS server is capable of DoH, then, and only then, Chrome switches to DoH. It is the safest choice to make, since if you are querying that name server, they have your data anyway, so you might as well encrypt it in transit.

Chrome has a short list of known DoH servers that it will use, and they are all public cloud DNS providers so it will not use your local DoH server. https://www.chromium.org/developers/dns-over-https

Re: Analyzing DNS-over-HTTPS and DNS-over-TLS Privacy and Security Claims

#40

Post by jniedrauer »

shawnz wrote: post #22

> DNS is one important control planes in a network. It essentially allows network administrators to block content based on domain names making it quite useful tool in the arsenal. It is being widely used to provide content filtering services, parental controls, and to block known malware command and control. Its so popular that a lot of people install a locally running DNS server on their home networks to block Inter…

IP blocking (or whitelisting) is useless when your target lives in the cloud. Many CDNs have a massive pool of IPs which change rapidly. Autoscaling systems have TTLs as low as 60 seconds. Not only will you fail to block (or allow) requests, but you will also block (or allow) requests to completely different organizations on the same multi-tenant cloud environment.
Post reply on HN