Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A cartoon intro to DNS over HTTPS

hacks.mozilla.org

Post reply on HN
Print view View original

41–50 of 137 posts

Re: A cartoon intro to DNS over HTTPS

#41

Post by Skunkleton »

Klathmon wrote: post #2

There was a good chunk of time where my ISP (Verizon FIOS at the time) was having some kind of DNS hijacking attack happening where many CDN IPs were being replaced with an IP of a server that was adding some ad-injecting javascript into many pages (and god knows what else, I still have the payload laying around somewhere as I saved it for future curiosity). At the time my only real recourse was to pump my whole hous…

Personally, I highjack all DNS requests made on my network at my router, then use a VPN tunnel to resolve them on a server that I control that runs unbound. My guess is that FIOS was doing the same to you, just without your interests in mind.

A similar setup to mine could be deployed at your network edge, and it could then force all of your port 53 DNS requests to go over a more secure protocol. Of course you would have to figure out how to set this up, and it wouldn't protect your devices anywhere except your home network.

Re: A cartoon intro to DNS over HTTPS

#42

Post by vetinari »

textmode wrote: post #3

"Threats to users' privacy and security are growing." s/privacy/&, autonomy/' Case in point about autonomy is on HN front page at present: https://news.ycombinator.com/item?id=17196888 The author cites a hypothetical example where a user shopping at Megastore is blocked from accessing her preferred source of DNS data in order to prevent her from checking a price. Extending this hypothetical, imagine if in response to…

I see additional problem with this, which actually endangers autonomy.

The resolving is not only done for user-initiated action, but is being done by many programs, even which you might not want to do it. For the same reason, many users use a local firewall to block outcoming connections, like Little Snitch.

(Sidenote: if you are using MS Office 2016 for Mac, and are not satisfied with the choice of telemetry that Microsoft offered you in the last update, and you are interested in third option, "None", the hostnames to block are nexusrules.officeapps.live.com and nexus.officeapps.live.com)

With apps using DoH and ignoring the local resolver, that firewall will now have a problem, especially if multiple, separate hostnames resolve to the same IP. Until now, Little Snitch used a guess (last resolved hostname that matches the IP); now it won't have that chance.

That's why, if the user wants to have a chance to who their local processes talk to, they must be forced to use a local resolver under user's control, not implement their private resolver. And of course, on non-public networks, it should be supplie-able by DHCP or RA.

Re: A cartoon intro to DNS over HTTPS

#43

Post by txcwpalpha »

cremp wrote: post #16
barbegal wrote: post #10

As a cynic I would say this is an attempt by Google and Cloudflare to collect DNS data. Why else would they provide this service for free? Both Google's [1] and Cloudflare's [2] DNS privacy policy prohibits them from storing personally identifiable information or from correlating DNS information with other Google data coming from the same IP/account but it does allow them to store information about which domains are…

Cloudflare itself never made sense to me. What possible incentive do they have to stop their primary purpose (DDoS protection) - They have value in promoting the behavior. Whats worse, is everyone and their dog is using them. What happens when they push a bad config to their core routers, or foobar their anycast?

It probably doesn't make sense because you misunderstand their primary purpose. It's not DDoS protection. Cloudflare has a pretty wide-spanning platform of products and services, but if you had to pick one out as their "primary", it would be their CDN product. The DDoS protection is just more visible because of the nature of the product (a good CDN will never make you aware it even exists), and because mitigating DDoS attacks makes for good news headlines.

Even if DDoS was their main business driver, what you're saying is similar to "doctors don't make any sense to me. what possible incentive do they have for keeping people healthy? they have incentive for promoting bad health."

As someone who works in security, believe me, there are plenty of cyber attackers out there that will easily keep companies like Cloudflare in business, no "promotion" of bad behavior required.

Re: A cartoon intro to DNS over HTTPS

#44

Post by frio »

nykolasz wrote: post #9

There are 3 major protocols available for DNS privacy: * DNSCrypt * DNS over TLS * DNS over HTTPS DNSCrypt is the one with better client support and a long list of providers available. If you pick DNS over TLS or DNS over HTTPS you will be restricted to 3 or 4 major players (google, quad9, cloudflare and cleanbrowsing). If you trust them, you are good. For example, this is the list of providers with DNSCrypt support:…

Do the dnscrypt providers actually work, though? I tried setting it up from my machine, and it seemed like many of them were gone. I eventually managed to find a working provider in Iceland, but being that I'm in a country on the opposite side of the planet, the increased latency made the internet markedly more sluggish.

Re: A cartoon intro to DNS over HTTPS

#45

Post by Klathmon »

Skunkleton wrote: post #41
Klathmon wrote: post #2

There was a good chunk of time where my ISP (Verizon FIOS at the time) was having some kind of DNS hijacking attack happening where many CDN IPs were being replaced with an IP of a server that was adding some ad-injecting javascript into many pages (and god knows what else, I still have the payload laying around somewhere as I saved it for future curiosity). At the time my only real recourse was to pump my whole hous…

Personally, I highjack all DNS requests made on my network at my router, then use a VPN tunnel to resolve them on a server that I control that runs unbound. My guess is that FIOS was doing the same to you, just without your interests in mind. A similar setup to mine could be deployed at your network edge, and it could then force all of your port 53 DNS requests to go over a more secure protocol. Of course you would h…

>My guess is that FIOS was doing the same to you, just without your interests in mind.

It wasn't FIOS doing it, the IP was in Israel and was known as a malware serving IP.

Re: A cartoon intro to DNS over HTTPS

#47

Post by bogomipz »

nykolasz wrote: post #9

There are 3 major protocols available for DNS privacy: * DNSCrypt * DNS over TLS * DNS over HTTPS DNSCrypt is the one with better client support and a long list of providers available. If you pick DNS over TLS or DNS over HTTPS you will be restricted to 3 or 4 major players (google, quad9, cloudflare and cleanbrowsing). If you trust them, you are good. For example, this is the list of providers with DNSCrypt support:…

Might you or anyone else have suggestions/feedback of which providers supporting DNSCrypt you have good luck with?

Re: A cartoon intro to DNS over HTTPS

#48

Post by chipperyman573 »

iampims wrote: post #18
barbegal wrote: post #10

As a cynic I would say this is an attempt by Google and Cloudflare to collect DNS data. Why else would they provide this service for free? Both Google's [1] and Cloudflare's [2] DNS privacy policy prohibits them from storing personally identifiable information or from correlating DNS information with other Google data coming from the same IP/account but it does allow them to store information about which domains are…

For Google it makes sense. The faster you resolve DNS, the more webpages with ads you visit. Small price to pay to increase impressions.

DNS is not the bottleneck for page load speeds, especially now that 99% of the internet has images or video (even if the images are not a main focus of the webpage, such as a news article's image header)

Re: A cartoon intro to DNS over HTTPS

#49

Post by dsr_ »

inetknght wrote: post #34
mike-cardwell wrote: post #28

I kind of hate this. Taking a decentralised service, and replacing it with a service provided by a small handful of tech giants. "But this doesn’t mean you have to use Cloudflare. Users can configure Firefox to use whichever DoH-supporting recursive resolver they want. As more offerings crop up, we plan to make it easy to discover and switch to them." Only defaults matter. Your average web user wont be interested in…

Then put it as part of your startup process, whether that's first-time startup or just-upgraded-from-a-previous-version startup. Do not select any default. Randomize the selections.

We have the NTP pool groups as a model for how to organize groups to offer services like DNS-over-HTTPS.

Re: A cartoon intro to DNS over HTTPS

#50

Post by gsich »

jedisct1 wrote: post #39
gsich wrote: post #29

I tried DNS over TLS (somewhat similar) and it has some potential. But not with those strict timeouts. 1.1.1.1 closes the TCP connection almost instantly after the query response, 9.9.9.9 waits a bit longer, about 10 seconds (need to check again). So everytime you want to make a query, you have to wait several RTTs before getting a response. The connection need to be open for as long as possible, at least 5 minutes.…

Because DNS servers were never designed to keep many open TCP connections.

Doesn't matter what they were designed for. With TCP they need to behave that way. Otherwise this is a solution for people with latency I'll argue that the TCP and TLS handshake take more processing power then keeping the connection open.
Post reply on HN