Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

DNS over HTTPS

github.com

Post reply on HN
Print view View original

51–60 of 195 posts

Re: DNS over HTTPS

#51

Post by finchisko »

_0w8t wrote: post #27

I can see how DNS over HTTPS addresses security, but I do not see how it helps with privacy. After resolving the IP address over secure connection HTTPS still sends the host name unencrypted, so one can just eavesdrop on that. And if encrypted DNS becomes widespread, I suspect that various state-imposed firewalls like one Russia will just look for HTTPS connection header to block a particular site.

>HTTPS still sends the host name unencrypted.

needed for webservers because of multiple domains (SNI) on single IP address. Didn't read the spec, but couldn't be hostname encrypted in case of DNS resolving? (eg. hostname can be sent in http body).

Re: DNS over HTTPS

#52

Post by tzahola »

dyu wrote: post #8
tzahola wrote: post #4

Isn’t this a chicken vs egg problem?

You can remember a small set of resolved hosts for this purpose, not unlike remembering DNS servers or CAs to trust. A quick search online also says it's possible to issue a cert to a public IP address, so you can also do HTTPS to a numbered IP instead of a host name.

I haven't heard of any respectable CAs that would issue certs for IP addresses...

Re: DNS over HTTPS

#53

Post by [deleted] »

coinerone wrote: post #9
politelemon wrote: post #3

> for privacy, performance and security. I understand the privacy and security aspects. But I am wondering - how can DNS over HTTPS be more performant in the case of curl commands? A browser could probably persist the connection to the resolver and issue several requests together, but with a single curl command surely there's the overhead of initiating the first DNS resolve, the HTTPS connection, the second DNS resol…

"Performant" is a word in German. It translates to exact what "perfomant" would mean in english if it were an english word. The funny thing is, google translate, translates the german word "performant" to the english word "performant". https://translate.google.com/?hl=de#de/en/per%C2%ADfor%C2%AD...

[deleted]

Re: DNS over HTTPS

#54

Post by nijaru »

coinerone wrote: post #9
politelemon wrote: post #3

> for privacy, performance and security. I understand the privacy and security aspects. But I am wondering - how can DNS over HTTPS be more performant in the case of curl commands? A browser could probably persist the connection to the resolver and issue several requests together, but with a single curl command surely there's the overhead of initiating the first DNS resolve, the HTTPS connection, the second DNS resol…

"Performant" is a word in German. It translates to exact what "perfomant" would mean in english if it were an english word. The funny thing is, google translate, translates the german word "performant" to the english word "performant". https://translate.google.com/?hl=de#de/en/per%C2%ADfor%C2%AD...

It is not actually translating anything since performant is not considered a real word in English, although I commonly see it used in the tech world.

Re: DNS over HTTPS

#55

Post by kuschku »

kodablah wrote: post #25
kuschku wrote: post #20

So what use does this have? DNSSEC already gives us validation of the records, and thanks to SNI, this doesn't give us any privacy. It is more complex, more centralized, and ends up slower than using actual DNS, and doesn't seem to provide any benefits. Am I missing something?

Easier to prevent censoring. DNSSEC doesn't hide the fact that you're making a DNS call, correct? With HTTPS, censors/MITMs can only see the domain you go to. The censor/MITM won't know whether I went to google.com to search or perform DNS query. Plenty of countries have blocked DNS providers they don't like, now that's harder w/out also blocking the site as a whole.

Easier to prevent censoring from the ISP, but you're now just reliant on another company's systems.

If you just want a solution for having a remote server execute DNS queries for you, you can just use any of the existing VPN protocols purely for DNS resolution, or even make a better performing version.

All that overhead HTTP adds is wasted for this.

Re: DNS over HTTPS

#56

Post by askvictor »

kodablah wrote: post #25
kuschku wrote: post #20

So what use does this have? DNSSEC already gives us validation of the records, and thanks to SNI, this doesn't give us any privacy. It is more complex, more centralized, and ends up slower than using actual DNS, and doesn't seem to provide any benefits. Am I missing something?

Easier to prevent censoring. DNSSEC doesn't hide the fact that you're making a DNS call, correct? With HTTPS, censors/MITMs can only see the domain you go to. The censor/MITM won't know whether I went to google.com to search or perform DNS query. Plenty of countries have blocked DNS providers they don't like, now that's harder w/out also blocking the site as a whole.

I suspect it wouldn't be too hard for a nation state or similar to determine the signature of DNS over HTTPS requests to see if someone is making a DNS request, unless you add a bunch of noise to the transaction.

Re: DNS over HTTPS

#57

Post by kodablah »

kuschku wrote: post #55
kodablah wrote: post #25

Earlier quoted context omitted.

Easier to prevent censoring. DNSSEC doesn't hide the fact that you're making a DNS call, correct? With HTTPS, censors/MITMs can only see the domain you go to. The censor/MITM won't know whether I went to google.com to search or perform DNS query. Plenty of countries have blocked DNS providers they don't like, now that's harder w/out also blocking the site as a whole.

Easier to prevent censoring from the ISP, but you're now just reliant on another company's systems. If you just want a solution for having a remote server execute DNS queries for you, you can just use any of the existing VPN protocols purely for DNS resolution, or even make a better performing version. All that overhead HTTP adds is wasted for this.

> All that overhead HTTP adds is wasted for this.

When you're in an area where your DNS provider is limited by the state, you won't consider it wasted. But if you're not and you do consider it wasted, don't use it. But saying it doesn't seem to provide any benefit is wrong and just telling people to use a VPN for DNS resolution is also wrong (at least until the ergonomics improve).

Re: DNS over HTTPS

#58

Post by kodablah »

askvictor wrote: post #56
kodablah wrote: post #25

Earlier quoted context omitted.

Easier to prevent censoring. DNSSEC doesn't hide the fact that you're making a DNS call, correct? With HTTPS, censors/MITMs can only see the domain you go to. The censor/MITM won't know whether I went to google.com to search or perform DNS query. Plenty of countries have blocked DNS providers they don't like, now that's harder w/out also blocking the site as a whole.

I suspect it wouldn't be too hard for a nation state or similar to determine the signature of DNS over HTTPS requests to see if someone is making a DNS request, unless you add a bunch of noise to the transaction.

Doubt it. How can a DNS HTTP GET look that much different than a favicon.ico GET over TLS? MTU/size alone is all they can use to shape, but there are many small web requests.

Re: DNS over HTTPS

#59

Post by kodablah »

_0w8t wrote: post #27

I can see how DNS over HTTPS addresses security, but I do not see how it helps with privacy. After resolving the IP address over secure connection HTTPS still sends the host name unencrypted, so one can just eavesdrop on that. And if encrypted DNS becomes widespread, I suspect that various state-imposed firewalls like one Russia will just look for HTTPS connection header to block a particular site.

> I suspect that various state-imposed firewalls like one Russia will just look for HTTPS connection header to block a particular site.

What if that site does a lot more things? Even they can only upset their population so much by blocking entire domains. With regards to Russia, Google's DNS over HTTPS is a perfect example. "Domain fronting" is a thing for a reason.

Post reply on HN