Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Improving DNS Privacy with Oblivious DoH

blog.cloudflare.com

Post reply on HN
Print view View original

321–330 of 367 posts

Re: Improving DNS Privacy with Oblivious DoH

#321

Post by fiddlerwoaroof »

kelnos wrote: post #318
fiddlerwoaroof wrote: post #168

Earlier quoted context omitted.

You can snoop SNI and use that to block traffic, right? In another thread, someone suggested also stripping the keys for encrypted SNI from DNS queries which, when combined with a firewall that attempts to make a DoH query to every new SNI name it sees might potentially work.

For now. Encrypted SNI is in development and will eventually be used by devices and apps that want to do this sort of thing and hide what they're doing.

The solution to that is pretty simple. ESNI, I believe, requires encryption keys in DNS records: if you control DNS, you control ESNI. ECH might be harder to deal with, but you can always just block HTTPS connections you don’t want to support. Also, will some sort of certificate fingerprinting still work?

Re: Improving DNS Privacy with Oblivious DoH

#322

Post by fiddlerwoaroof »

pdonis wrote: post #295
fiddlerwoaroof wrote: post #167

Earlier quoted context omitted.

How can they trivially bypass this local filtering? If the router is redirecting all port 53 traffic, there is no way to bypass aside from some alternate name resolution scheme.

> If the router is redirecting all port 53 traffic Then it won't do anything to DNS over HTTPS traffic that is going over port 443. And it won't be able to distinguish that traffic from any other HTTPS traffic.

There’s theoretically ways to solve that: https://news.ycombinator.com/item?id=25349358

Re: Improving DNS Privacy with Oblivious DoH

#323

Post by fiddlerwoaroof »

dhaavi wrote: post #225
judge2020 wrote: post #216

Earlier quoted context omitted.

> or every host name seen in SNI Not going to be possible in a few years or so: https://news.ycombinator.com/item?id=25344311

meh. The outer SNI and the IP address still tell a lot about what you are doing online.

Also, with things like this, you can just reset connections using HTTPS features you don’t support. It might eventually become painful, but it’ll be fine for the near future. And, if enough enterprise middleboxes do this, the standards will be DOA.

Re: Improving DNS Privacy with Oblivious DoH

#324

Post by alwillis »

1over137 wrote: post #218
judge2020 wrote: post #211

Earlier quoted context omitted.

iOS and MacOS technically have this (requires a profile[0]) but Microsoft will probably drag their feed on this for the next 2 years with the amount of enterprise customers they have to keep happy; and, given that the network adapter config is still based on Aero controls, they're probably in no rush to add more configuration options before upgrading it to Metro controls. 0: https://paulmillr.com/posts/encrypted-dns/

Why on earth is a "configuration profile" required for this?

Because if you need to configure a fleet of Macs or iOS devices for a school or business, it’s easy to push a configuration profile to all of them using tools commonly in use by IT departments and admins.

Re: Improving DNS Privacy with Oblivious DoH

#325

Post by toast0 »

OJFord wrote: post #206
stevepike wrote: post #145

Earlier quoted context omitted.

As someone who recently set up a pihole, I was shocked that it was possible to redirect all DNS requests on the network (in plain text!) to the pi. I did the method where you set up a network firewall at the router level that redirects all port 53 traffic to the pi. It's a nice feature for getting my xbox filtered, but it really felt like an insecure historical quirk rather than a feature we should be praising. Surel…

The 'historical quirk' per my understanding is pretty much IPv4 NAT. At least, I couldn't figure out how to do it with IPv6 (no (need for) NAT) - I ended up dropping them if not destined for my desired DNS instead. (NAT lets you Translate Addresses, usually to save IPv4 space, but here to redirect to a different DNS. IPv6 fixes the address space problem with more addresses, so the hack is done away with, and everythi…

Transparent proxying works for IPv6 as well as IPv4. It's a little challenging to do transparent proxying on a box that's not the firewall. If the firewall and the proxy are on the same ethernet broadcast domain, you can forward the packets (i think for Linux you'd need to do policy routing on the port?, for ipfw there's a forward action, i think pf would be route-to); and if they're not, you'd need to tunnel the packets to the proxy.

NAT doesn't really have much to do with it, other than you with NAT, you certainly have a device on your network that's capable of being a transparent proxy, whereas without NAT, you could just have a unmanaged switch to share your upstream connection between multiple computers; assuming your provider is enlightened and provides ethernet or an ethernet bridge with nothing else in the way.

Re: Improving DNS Privacy with Oblivious DoH

#327

Post by alwillis »

1over137 wrote: post #222
gsnedders wrote: post #17

Earlier quoted context omitted.

> DoH has at least Mozilla and Google on board, and presumably Microsoft are tailing along. Note that DoH (and DoT) shipped in iOS 14 and Big Sur, though aren't particularly easy to enable.

Anyone have any idea why they chose to require 'configuration profiles' here? Also, don't 'configuration profiles' require that your Mac have an associated AppleID?

Anyone have any idea why they chose to require 'configuration profiles' here?

There are several tools that can push configuration profiles to many macOS or iOS devices in one go [1]. It's also the kind of thing you don't want users in managed environments messing with if they don't know what they're doing.

Also, don't 'configuration profiles' require that your Mac have an associated AppleID?

I can't see why they'd be connected; being able to configure network settings isn't a "feature" related to having an Apple ID.

[1]: https://support.apple.com/guide/deployment-reference-macos/w...

Re: Improving DNS Privacy with Oblivious DoH

#328

Post by quicksilver03 »

judge2020 wrote: post #215
stevepike wrote: post #160

Earlier quoted context omitted.

Can you explain (or share a link) to some proposal for how to enable my pihole to securely talk to upstream resolvers but force all embedded devices on my network to go through the pihole? Anything that lets my pihole sidestep my ISP seems like it'd also work for my xbox.

> force all embedded devices on my network to go through the pihole You can only do this for the devices that respect your DHCP-provided DNS config. Even if you redirect all port 53 traffic on your network to your pihole, a device can make its own (DoH or non-DoH) https connection and gets DNS responses via that, bypassing your pi-hole. This was discussed extensively a few days ago on a thread about "72% of smart TVs…

If you control DHCP and know the MAC address of those embedded devices, you can serve them a non-existing gateway so that they simply won't have a path outside of your home network.

Of course, that assumes IPv4, whereas with IPv6 and SLAAC I believe the only way is to firewall them out.

Re: Improving DNS Privacy with Oblivious DoH

#329

Post by iso947 »

JMTQp8lwXL wrote: post #287
iso947 wrote: post #247

Earlier quoted context omitted.

No, because instead of setting your network to give out your DNs server to all of your devices, it’s ignored by the apps Instead of setting your devices to use a dns server of your choice it’s ignored by the apps Some apps allow you to configure them, so now you’re configuring 200 apps on 20 devices rather than just one dhcp setting. (Oh and OSs have generally broken hosts files)

Sorry, what I was trying to say is: you know each app tries to use a certain DNS server. So, in your Rasp Pi, you route their DNS server to point your own (as you would with an /etc/hosts file), that way when DoH occurs, you control the final resolution. What I'm suggesting isn't merely setting up the 'default' dns server. What I'm suggesting is 'cnaming' the name servers that apps attempt connecting to, to point els…

If you know the iP the DOH client uses you can intercept it. But you can’t spoof it without breaking TLS, which means deploying your own certificate

This general industry move will lead to more tls breaking proxies and more network interception. All because people don’t want to understand how a network and os work.

Making doh at the application later normal it moves the power towards the centralised advertising network and away from the individual. That the SV culture likes this is unsurprising.

Re: Improving DNS Privacy with Oblivious DoH

#330

Post by cassianoleal »

RossM wrote: post #175
stevepike wrote: post #160

Earlier quoted context omitted.

Can you explain (or share a link) to some proposal for how to enable my pihole to securely talk to upstream resolvers but force all embedded devices on my network to go through the pihole? Anything that lets my pihole sidestep my ISP seems like it'd also work for my xbox.

Using Cloudflare with DoH is documented here: https://docs.pi-hole.net/guides/dns-over-https/ You essentially run a little proxy server on your pihole setup, and configure pihole to use it as your upstream dns resolver. E.g., a proxy server running at 127.0.0.1:5053 which uses the Cloudflare ipv4/ipv6 DNS over HTTPS endpoints. This can also use other DoH endpoints as desired: /usr/local/bin/cloudflared proxy-dns \ --…

That only does the part where the PiHole uses DoH. It doesn't stop individual devices from using it, and it doesn't force them to go via the PiHole.
Post reply on HN