DNS over TLS – Thoughts and Implementation • Hacker News Board

Re: DNS over TLS – Thoughts and Implementation

#41

Post by auslander » Sun, Sep 09, 2018, 9:36 AM UTC

ownagefool wrote: post #38

auslander wrote: post #32

Earlier quoted context omitted.

> Cloudflare proxies about 10% of the Internet ... and strips SSL off on their side, so 10% of internet is, in fact, MITMed.

Be fair, this is configurable. So only 9.9% of the internet is probably MITMable. (:

What is configurable, apart from not using CF?

Re: DNS over TLS – Thoughts and Implementation

#42

Post by spc476 » Sun, Sep 09, 2018, 9:43 AM UTC

dagenix wrote: post #29

spc476 wrote: post #24

Earlier quoted context omitted.

Why not tunnel everything over HTTPS then? Then even SSH will be secure!

... which has nothing to do with what I'm talking about.

It had everything to do with it, as more and more is being forced through HTTPS, because I don't know, it's more secure or it's the only port not being filtered. There were a few times I has to run sshd on port 443 (on a server I control---a preventive measure) because a network I was forced to use (a "public" wi-fi) only allowed ports 53, 80 and 443 outbound.

Re: DNS over TLS – Thoughts and Implementation

#43

Post by zaarn » Sun, Sep 09, 2018, 10:22 AM UTC

gsich wrote: post #33

dagenix wrote: post #28

Earlier quoted context omitted.

Do you want to not be blocked? That's a reason to go through 80/443.

Is this even an issue? Just look at games. They use various ports all the time. It still works. Don't optimize for crappy networks, it's not worth it.

Games run a subset of network connections: Consumer Homelines.

They don't run in corporate networks, over public wifi or over mobile networks, all three frequently block non-standard ports (my city's free wifi blocks everything except 80 and 443, DNS is hijacked).

These three network types are also important, maybe more important than simple home landlines since they affect the people paying shitloads of cash or represent a very significant marketshare.

Re: DNS over TLS – Thoughts and Implementation

#44

Post by tialaramex » Sun, Sep 09, 2018, 10:48 AM UTC

auslander wrote: post #41

ownagefool wrote: post #38

Earlier quoted context omitted.

Be fair, this is configurable. So only 9.9% of the internet is probably MITMable. (:

What is configurable, apart from not using CF?

CloudFlare's customers can choose whether the backhaul, between CloudFlare and their own web servers, is HTTP, HTTPS with a CloudFlare issued private certicate, or HTTPS using publicly trusted certs from the Web PKI.

If you choose either of the latter two options, bad guys can't MITM you, the middle option has the benefit that they can't even MITM you by subverting a public CA (since only CloudFlare's own certs are trusted) the latter option has the benefit that you can "just" switch off CloudFlare and your site now works as an ordinary HTTPS site with no changes, if you ever want to do that.

Re: DNS over TLS – Thoughts and Implementation

#45

Post by auslander » Sun, Sep 09, 2018, 10:58 AM UTC

tialaramex wrote: post #44

auslander wrote: post #41

Earlier quoted context omitted.

What is configurable, apart from not using CF?

CloudFlare's customers can choose whether the backhaul, between CloudFlare and their own web servers, is HTTP, HTTPS with a CloudFlare issued private certicate, or HTTPS using publicly trusted certs from the Web PKI. If you choose either of the latter two options, bad guys can't MITM you, the middle option has the benefit that they can't even MITM you by subverting a public CA (since only CloudFlare's own certs are t…

In all those options, CF still terminates (strips) SSL from user traffic to plaintext, on their platform, hence MITM by Cloudflare.

Re: DNS over TLS – Thoughts and Implementation

#46

Post by detaro » Sun, Sep 09, 2018, 11:03 AM UTC

auslander wrote: post #45

tialaramex wrote: post #44

Earlier quoted context omitted.

CloudFlare's customers can choose whether the backhaul, between CloudFlare and their own web servers, is HTTP, HTTPS with a CloudFlare issued private certicate, or HTTPS using publicly trusted certs from the Web PKI. If you choose either of the latter two options, bad guys can't MITM you, the middle option has the benefit that they can't even MITM you by subverting a public CA (since only CloudFlare's own certs are t…

In all those options, CF still terminates (strips) SSL from user traffic to plaintext, on their platform, hence MITM by Cloudflare.

And other large parts of the internet are "MITMed" by AWS, Heroku, Microsoft Azure or other hosting companies then. For some reason people don't make the same argument in every thread about AWS though.

Re: DNS over TLS – Thoughts and Implementation

#47

Post by fanf2 » Sun, Sep 09, 2018, 11:15 AM UTC

I deployed DNS-over-TLS on Cambridge University’s central recursive DNS servers last week, and they immediately started receiving traffic from Android P users - not very much traffic, a few queries per second, but not negligible. I did some followup investigation of how Android behaves in the wild and posted them to the IETF DoH list (and the dprive list but for some reason those copies did not go through) - see https://mailarchive.ietf.org/arch/msg/doh/I-ytiO6ykbt9krrC9F... and the corrections and further information in the replies.

I still need to verify that TCP fast open is working, to minimize the DoT latency.

Re: DNS over TLS – Thoughts and Implementation

#48

Post by gsich » Sun, Sep 09, 2018, 11:41 AM UTC

zaarn wrote: post #43

gsich wrote: post #33

Earlier quoted context omitted.

Is this even an issue? Just look at games. They use various ports all the time. It still works. Don't optimize for crappy networks, it's not worth it.

Games run a subset of network connections: Consumer Homelines. They don't run in corporate networks, over public wifi or over mobile networks, all three frequently block non-standard ports (my city's free wifi blocks everything except 80 and 443, DNS is hijacked). These three network types are also important, maybe more important than simple home landlines since they affect the people paying shitloads of cash or repr…

Besides public wlan this isn't an issue. In corporate networks it may be company policy to use their resolvers. External resolvers might not work for internal names, so their use is probably limited in the first place.

Mobile networks should allow all ports, if not call your regulator.

So 1 out of your 3 are actually important. Also, firewall rules can be changed.

Re: DNS over TLS – Thoughts and Implementation

#49

Post by gsich » Sun, Sep 09, 2018, 11:44 AM UTC

bogomipz wrote: post #8

gsich wrote: post #5

Earlier quoted context omitted.

You need to keep the connection open.

Can't that only be done for a max of 10 seconds though? So beyond 10 seconds, you have the connection overhead all over again no? https://dnsprivacy.org/wiki/display/DP/Configuring+Stubby

Yes. I run a bind on a server which forwards all queries to quad9 (udp) Then I stunnel that port and use stubby on my side.

The connection is open longer, but still closes occasionally, so I just resolve a name every x seconds. Not the best way.

Re: DNS over TLS – Thoughts and Implementation

#50

Post by gsich » Sun, Sep 09, 2018, 11:50 AM UTC

ownagefool wrote: post #38

auslander wrote: post #32

Earlier quoted context omitted.

> Cloudflare proxies about 10% of the Internet ... and strips SSL off on their side, so 10% of internet is, in fact, MITMed.

Be fair, this is configurable. So only 9.9% of the internet is probably MITMable. (:

Defaults matter. So you are probably right.