Improving DNS Privacy with Oblivious DoH • Hacker News Board

Re: Improving DNS Privacy with Oblivious DoH

#31

Post by ignoramous » Tue, Dec 08, 2020, 1:44 PM UTC

jamescun wrote: post #19

Preventing the target resolver from seeing client's IP address breaks GeoDNS. This is already a problem with 1.1.1.1 which doesn't honour the EDNS client subnet extension. Given generally DNS is just the start of an intereaction, usually followed by the connection directly between the client and intended destination, I don't see what kind of snooping these privacy measures are there to prevent.

Valid points, but...

> Preventing the target resolver from seeing client's IP address breaks GeoDNS.

If the proxy and the target are in the same metro as the user, it shouldn't really matter.

> This is already a problem with 1.1.1.1 which doesn't honour the EDNS client subnet extension.

1.1.1.1 runs at Cloudflare's edge. Most likely it is recursing DNS from more or less the same location as the user and so ECS isn't really required when in fact it exposes the client unnecessarily to upstream name-servers.

> I don't see what kind of snooping these privacy measures are there to prevent.

The one where DNS resolvers build to sell browsing profile of its users?

Re: Improving DNS Privacy with Oblivious DoH

#32

Post by cblconfederate » Tue, Dec 08, 2020, 1:44 PM UTC

> Sullivan said a few partner organizations are already running proxies, allowing for early adopters to begin using the technology through Cloudflare’s existing 1.1.1.1 DNS resolver.

In other words, in order to thwart efforts to make the internet anonymous , US companies are planning to takeover DNS for the vast majority of people.

Re: Improving DNS Privacy with Oblivious DoH

#33

Post by nalekberov » Tue, Dec 08, 2020, 1:44 PM UTC

selykg wrote: post #20

techelite wrote: post #10

I urge people to stop repeating Apple Advertising. Claims of privacy and security are debunked weekly. You put yourself at risk if you believe it.

Do you have actual proof of this or are you just going to make misleading claims yourself?

Privacy is a buzzword to boost sales even more. Perhaps the biggest problem with Apple is its nasty monopoly strategies, remember the times you could easily add more RAM, change batteries?

Re: Improving DNS Privacy with Oblivious DoH

#34

Post by izacus » Tue, Dec 08, 2020, 1:45 PM UTC

So Google got sued by ISPs which lobbied an investigation by DOJ for trying to encrypt DNS: https://www.engadget.com/2019-09-29-congress-doj-scrutinze-g...

Will ISPs be too scared to sue Apple and Cloudflare for this? Or are they giving them an out?

Re: Improving DNS Privacy with Oblivious DoH

#35

Post by MrStonedOne » Tue, Dec 08, 2020, 1:45 PM UTC

So I do wonder how such systems can be designed or implemented such that geoip systems can still work.

While I'm sure aws route53 and cloudflare's own routing systems can handle this properly, Cloud isn't quite the answer. Not every workload fits on the cloud (see: Discord, which runs on leased servers), and a system that breaks down if your rented datacenters aren't in alignment with Cloud operating regions doesn't make a great solution.

Re: Improving DNS Privacy with Oblivious DoH

#36

Post by aorth » Tue, Dec 08, 2020, 1:47 PM UTC

TimWolla wrote: post #3

Probably better source, the blog post at Cloudflare: https://blog.cloudflare.com/oblivious-dns/ See also: https://news.ycombinator.com/item?id=25344220

Thanks. The original post redirects to:

https://guce.advertising.com/collectIdentifiers?sessionId=3_...

Which is blocked at the DNS level on my network.

Re: Improving DNS Privacy with Oblivious DoH

#37

Post by teddyh » Tue, Dec 08, 2020, 1:47 PM UTC

Sounds promising. Get back to me when it’s gotten to the RFC stage. A ready-made solution thrown over the wall like this, is rarely what is ultimately adopted.

Re: Improving DNS Privacy with Oblivious DoH

#38

Post by nuker » Tue, Dec 08, 2020, 1:47 PM UTC

Why not DoT? And DoH is mum on http cookies: "Determining whether or not a DoH implementation requires HTTP cookie support is particularly important because HTTP cookies are the primary state tracking mechanism in HTTP." https://tools.ietf.org/html/rfc8484

Re: Improving DNS Privacy with Oblivious DoH

#39

Post by arminiusreturns » Tue, Dec 08, 2020, 1:48 PM UTC

techelite wrote: post #8

seek3r wrote: post #4

I’m good with the Apple’s privacy-oriented stance. But I can’t stop to think what will happen when advertisers knock on Apple’s door trying to get their hands on the users’ data that one else can access. Is Apple going to sell it out for more profits?

It's just marketing. Apple has already shown they will sell you out with PRISM. Who knows what other backroom deals are happening outside our knowledge. The only reason we found out about PRISM is because the gigantic scale and Snowden sacrificed Everything to let it be known.

One thing I like to remind people of is the fact that the Snowden docs that revealed PRISM were years old at the time of Snowden gathering them, and even older at release... just imagine how much further things have progressed in the 10+ years since. (iirc lots of them had 2007 dates on them)

Re: Improving DNS Privacy with Oblivious DoH

#40

Post by jgrahamc » Tue, Dec 08, 2020, 1:48 PM UTC

cblconfederate wrote: post #32

> Sullivan said a few partner organizations are already running proxies, allowing for early adopters to begin using the technology through Cloudflare’s existing 1.1.1.1 DNS resolver. In other words, in order to thwart efforts to make the internet anonymous , US companies are planning to takeover DNS for the vast majority of people.

Oh, please. ODoH is a proposed standard. Use whatever the hell proxy/resolver you feel like, wherever you like.

DNS is a shit show of unencrypted data flying around being scooped up by God-knows-who and along comes someone proposing a standard to fix said shit show and this is the response people get.