Improving DNS Privacy with Oblivious DoH

Post by iso947 » Wed, Dec 09, 2020, 9:23 PM UTC

JoshTriplett wrote: post #278

xg15 wrote: post #266

Earlier quoted context omitted.

Complain to who exactly? > people taking what devices could already do and standardizing it so that anyone can use it in a more uniform way. In this case, standardization makes a huge difference. Before DoH, this was theoretically possible, but needed enormous effort to pull off: The simplest thing a device could do was to hardcode custom DNS servers - but the network admin could easily bypass that by redirecting the…

> With DoH, there are publicly accessible servers that accept requests over plain HTTPS Which is a good thing for end users on balance. The Internet is going 100% encrypted and that's a good thing. This helps towards that goal. Relying on unencrypted traffic will no longer work. Networks must not have the ability to intercept device traffic unless the device administrator ( not the network administrator) configures i…

Post by pcwrt » Wed, Dec 09, 2020, 11:48 PM UTC

darkwater wrote: post #43

Until we get rid of SNI[1] in HTTPS for good there will still be providers (like my ISP) that do deep packet inspection on SNI and kill the connection right away if you happen to visit a forbidden site (and this was western Europe, yesterday, on a site behind CloudFlare) [1] https://en.m.wikipedia.org/wiki/Server_Name_Indication

Post by JoshTriplett » Thu, Dec 10, 2020, 12:24 AM UTC

iso947 wrote: post #351

JoshTriplett wrote: post #278

Earlier quoted context omitted.

> With DoH, there are publicly accessible servers that accept requests over plain HTTPS Which is a good thing for end users on balance. The Internet is going 100% encrypted and that's a good thing. This helps towards that goal. Relying on unencrypted traffic will no longer work. Networks must not have the ability to intercept device traffic unless the device administrator ( not the network administrator) configures i…

I’m not held hostage by my ISP - I choose one that doesn’t do that. Even if I didn’t trust the last mile, that’s why I can choose to implement a vpn for some or all of my devices on my network so I can bypass a hostile isp. It might be good for the average technophobic end user to trust google instead of their ISP, but it’s not good for me to trust google over my ISP.

Post by JoshTriplett » Thu, Dec 10, 2020, 12:41 AM UTC

unionpivo wrote: post #342

JoshTriplett wrote: post #278

Earlier quoted context omitted.

> With DoH, there are publicly accessible servers that accept requests over plain HTTPS Which is a good thing for end users on balance. The Internet is going 100% encrypted and that's a good thing. This helps towards that goal. Relying on unencrypted traffic will no longer work. Networks must not have the ability to intercept device traffic unless the device administrator ( not the network administrator) configures i…

I am cynical and maybe paranoid. Be careful what you wish for What I think will end up happening, most of the devices will go encrypted route [1]. Most things will run over https, and with encrypted sni, you won't even be able to block domains. Encryption will be backdoored by governments (and of course other people that will reverse those backdoors or have friends in LEA ). End result is encryption that people are c…

Post by tptacek » Thu, Dec 10, 2020, 3:37 AM UTC

JoshTriplett wrote: post #356

Reelin wrote: post #317

Earlier quoted context omitted.

> there continue to be threads full of arguments that amount to "It should be possible for 'good' network admins to intercept traffic from devices that don't trust them, but 'bad' network admins shouldn't be able to intercept traffic from devices that don't trust them" That's not what I see at all. I see people pointing out that DoH hurts privacy and reduces control for end users by providing a convenient turnkey sol…

> I also see it pointed out that DoH could have been specified in a way that facilitated filtering for the local network. Given that it's so obviously possible No, it couldn't have been, and this is exactly what I was referring to in my comment. Any mechanism that allows the local network to intercept the traffic of a device that doesn't trust the network can and will be abused. The entire point of DoH was to make DN…

    #!/bin/sh
    while read domain
    do 
      ds=$(dig ds $domain +short)
      echo "$domain $ds"
    done