Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A cartoon intro to DNS over HTTPS

hacks.mozilla.org

Post reply on HN
Print view View original

71–80 of 137 posts

Re: A cartoon intro to DNS over HTTPS

#71

Post by walrus01 »

barbegal wrote: post #10

As a cynic I would say this is an attempt by Google and Cloudflare to collect DNS data. Why else would they provide this service for free? Both Google's [1] and Cloudflare's [2] DNS privacy policy prohibits them from storing personally identifiable information or from correlating DNS information with other Google data coming from the same IP/account but it does allow them to store information about which domains are…

As an ISP, I'm skeptical of the motivations of big CDNs and Google in general, but it's becoming an ietf standard. I run recursive resolvers for clients numbering in the hundreds of thousands, with an ACL that allows only our ARIN IP blocks to query them.

It is not hard to put a dns-over-https frontend in place for my clients which pulls queries from my own trusted bind9 servers.

Any ISP with a clue can do the same.

Re: A cartoon intro to DNS over HTTPS

#72

Post by walrus01 »

mike-cardwell wrote: post #28

I kind of hate this. Taking a decentralised service, and replacing it with a service provided by a small handful of tech giants. "But this doesn’t mean you have to use Cloudflare. Users can configure Firefox to use whichever DoH-supporting recursive resolver they want. As more offerings crop up, we plan to make it easy to discover and switch to them." Only defaults matter. Your average web user wont be interested in…

It does not need to be centralized at all. Any internet service provider with a modicum of Clue can install a DNS over https frontend listening on the IPs of their recursive resolvers, and pull data from their existing bind servers.

This does not contain any sort of proprietary or non free software. People are free to ignore the content delivery Network provided recursive resolvers, and set up their own.

Re: A cartoon intro to DNS over HTTPS

#73

Post by mholt »

Was just wondering... what value will DNS over HTTPS provide if/when we all move to IPv6 and presumably everything could potentially be identified by IP address directly? Will datacenters/ISPs be incentivized to do NAT with IPv6 or have some other way of introducing indirection into the routing?

Re: A cartoon intro to DNS over HTTPS

#74

Post by walrus01 »

gsich wrote: post #61
Skunkleton wrote: post #46

Doesn't TCP, TLS, HTTP, and finally DNS seem like overkill? Why not DTLS + plain DNS requests?

Standard HN response: Because my corporate firewall does not allow me to use UDP! Which is the nowadays excuse to use 80/443 for everything. Customers at home don't have this problem. But there are alternatives, DNS over TLS (essentially the same without HTTP) and dnscrypt which uses UDP.

This is why I run an openvpn server on port 443 in tcp mode, not UDP, for places like shitty airport captive portal wifi.

Re: A cartoon intro to DNS over HTTPS

#75

Post by walrus01 »

iampims wrote: post #4

I applaud the efforts to increase privacy,reduce data collection and hardened security. Do we really want a SPOF in Cloudflare for this though? A single outage (or AT&T snafu) and many millions of users would be affected.

There is no need for cloudflare to be a single point of failure. Any ISP that is capable of operating a high availability bind9 cluster has sysadmins with the knowledge to implement DNS over TLS and DNS over https. The software is all either gpl, bsd, lgpl or Apache licensed.

Re: A cartoon intro to DNS over HTTPS

#76

Post by bluejekyll »

gsich wrote: post #70
bluejekyll wrote: post #65

Earlier quoted context omitted.

Because it's much more complicated to implement, where-as DNS-over-TLS and DNS-over-HTTPS are far simpler to integrate into existing software and operations.

How? Both HTTPS and TLS implementations require custom software in order to work, as no OS supports this natively (yet). It boils down to install a stub that your local resolver will use instead of the upstream directly.

Well, basically because there are TLS libraries available in nearly every language. DNSCrypt is a custom protocol.

For example here is my implementation over rustls in TRust-DNS: https://github.com/bluejekyll/trust-dns/blob/master/rustls/s...

Basically that’s a thin wrapper over the TLS library, and I was able to do three different libraries. DNSCrypt on the other hand was a much larger project, and I gave up on implementing it when I saw the DNS-over-TLS RFC complete.

Re: A cartoon intro to DNS over HTTPS

#77

Post by gsich »

mholt wrote: post #73

Was just wondering... what value will DNS over HTTPS provide if/when we all move to IPv6 and presumably everything could potentially be identified by IP address directly? Will datacenters/ISPs be incentivized to do NAT with IPv6 or have some other way of introducing indirection into the routing?

Have fun remembering every IP by heart.

Re: A cartoon intro to DNS over HTTPS

#78

Post by mholt »

gsich wrote: post #77
mholt wrote: post #73

Was just wondering... what value will DNS over HTTPS provide if/when we all move to IPv6 and presumably everything could potentially be identified by IP address directly? Will datacenters/ISPs be incentivized to do NAT with IPv6 or have some other way of introducing indirection into the routing?

Have fun remembering every IP by heart.

No, I mean that simply by observing the IP address of packets, you can know which hosts are being requested, since there are enough IP addresses to go around.

Re: A cartoon intro to DNS over HTTPS

#79

Post by gsnedders »

mholt wrote: post #78
gsich wrote: post #77

Earlier quoted context omitted.

Have fun remembering every IP by heart.

No, I mean that simply by observing the IP address of packets, you can know which hosts are being requested, since there are enough IP addresses to go around.

That's a reason to get rid of the TLS SNI extension and the HTTP Host header, but it's entirely unrelated to how DNS messages are transmitted.

Re: A cartoon intro to DNS over HTTPS

#80

Post by moderation »

Klathmon wrote: post #2

There was a good chunk of time where my ISP (Verizon FIOS at the time) was having some kind of DNS hijacking attack happening where many CDN IPs were being replaced with an IP of a server that was adding some ad-injecting javascript into many pages (and god knows what else, I still have the payload laying around somewhere as I saved it for future curiosity). At the time my only real recourse was to pump my whole hous…

Great find with Intra. Installed and working well on Pixel XL 2.
Post reply on HN