Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

DNS over HTTPS

github.com

Post reply on HN
Print view View original

71–80 of 195 posts

Re: DNS over HTTPS

#71

Post by banachtarski »

alien_at_work wrote: post #45

I really hope this doesn't catch on widely. It should be a tool for use where censorship issues can't be solved politically. Otherwise, why even have protocols at all? Just say the only protocol is HTTP. IP, etc. are just an HTTP implementation detail.

I would love this to catch on wildly! DNS through TLS means it's all end-to-end encrypted, DNS reflection attacks are harder, etc. The "why even have protocols" doesn't make sense. Protocol can be layered just fine (HTTP itself is a good example). DNS as it exists now is another random special snowflake that vendors need corresponding snowflake implementations for.

Re: DNS over HTTPS

#72

Post by molf »

userbinator wrote: post #70
CogitoCogito wrote: post #7

Earlier quoted context omitted.

> Side note - I just learned that performant is not a recognized word ( https://english.stackexchange.com/questions/38945/what-is-wr... ) I don't personally use the word since there are many alternatives, but its use is now definitely widespread and consistently understood. There's really no argument against the fact that it has entered the English lexicon.

I don't use it either, and I agree with the poster on that stackexchange link about it sounding like manager/marketing-speak, but when I see it, it makes me pause for a second to think about what really means (perhaps that's the point) --- I had this exchange with a coworker not long ago: CW: ...and this way it'll be more performant too. Me: Performant? As in faster? CW: Yes. Me (to self): Then why didn't you just sa…

To be fair, "faster" in the context of software development can also frequently refer to the time it takes to implement.

Re: DNS over HTTPS

#74

Post by gsich »

ce4 wrote: post #66
kabes wrote: post #60

You can also do http(s) over DNS: http://code.kryo.se/iodine/ . Nice way to avoid paying captive portals, although probably not legal.

What does this shady technique (dns tunneling) have to do with dns-over-ssl?

why shady? (assuming that shady is meant in a negative way)

Re: DNS over HTTPS

#75

Post by _0w8t »

kodablah wrote: post #59
_0w8t wrote: post #27

I can see how DNS over HTTPS addresses security, but I do not see how it helps with privacy. After resolving the IP address over secure connection HTTPS still sends the host name unencrypted, so one can just eavesdrop on that. And if encrypted DNS becomes widespread, I suspect that various state-imposed firewalls like one Russia will just look for HTTPS connection header to block a particular site.

> I suspect that various state-imposed firewalls like one Russia will just look for HTTPS connection header to block a particular site. What if that site does a lot more things? Even they can only upset their population so much by blocking entire domains. With regards to Russia, Google's DNS over HTTPS is a perfect example. "Domain fronting" is a thing for a reason.

In Russia the government does ban domains unless the domains are popular. At some point they even tried to ban based on IP addresses from DNS records, but people quickly learned how to use that to "ban" government-based media by changing IP addresses of banned domains to point to those sites.

Re: DNS over HTTPS

#76

Post by est »

bandrami wrote: post #73

Actual DNS servers and clients have supported TLS since the early years of this decade. What's gained by adding HTTP transport overhead?

http is not overhead, http is the only transport that can go through middle boxes.

Re: DNS over HTTPS

#77

Post by pbhjpbhj »

userbinator wrote: post #70
CogitoCogito wrote: post #7

Earlier quoted context omitted.

> Side note - I just learned that performant is not a recognized word ( https://english.stackexchange.com/questions/38945/what-is-wr... ) I don't personally use the word since there are many alternatives, but its use is now definitely widespread and consistently understood. There's really no argument against the fact that it has entered the English lexicon.

I don't use it either, and I agree with the poster on that stackexchange link about it sounding like manager/marketing-speak, but when I see it, it makes me pause for a second to think about what really means (perhaps that's the point) --- I had this exchange with a coworker not long ago: CW: ...and this way it'll be more performant too. Me: Performant? As in faster? CW: Yes. Me (to self): Then why didn't you just sa…

Performant to me implies performing better against the relevant metrics. So faster, maybe, but perhaps smaller and more energy efficient too. If the context of the metrics is already understood then it seems quite a cromulent word.

Re: DNS over HTTPS

#78

Post by spydum »

gsich wrote: post #74
ce4 wrote: post #66

Earlier quoted context omitted.

What does this shady technique (dns tunneling) have to do with dns-over-ssl?

why shady? (assuming that shady is meant in a negative way)

It's clearly to evade a security control.. As if you approached a door, to find it locked, but then discovered the front window was unlocked and let yourself in.. Clearly the occupant didn't want you to enter, and just failed to secure the entire building. Pretty sure nobody would ever suggest it was okay for you to enter in such a way.

Re: DNS over HTTPS

#79

Post by pbhjpbhj »

gsich wrote: post #63
kabes wrote: post #60

You can also do http(s) over DNS: http://code.kryo.se/iodine/ . Nice way to avoid paying captive portals, although probably not legal.

Why not?

In USA and UK at least unauthorised access or use of a computer is criminalised. On some situations you can argue for assumed consent, the law doesn't operate on "if I can do it then it's authorised". Unless you can show you have permission then it's not authorised, ergo not legal.

AIUI; not legal advice.

Re: DNS over HTTPS

#80

Post by ce4 »

gsich wrote: post #74
ce4 wrote: post #66

Earlier quoted context omitted.

What does this shady technique (dns tunneling) have to do with dns-over-ssl?

why shady? (assuming that shady is meant in a negative way)

It's unfit for general use and abuses the DNS protocol to stealthily convey data, hence the shadiness. You're right, it needn't be used in a negative way. DNS tunneling is slow, needs polling for incoming traffic (due to the way dns works over udp) and is usually used to circumvent firewalls for both good (censorship) and bad reasons (exfiltrating data).
Post reply on HN