Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Improving DNS Privacy with Oblivious DoH

blog.cloudflare.com

Post reply on HN
Print view View original

81–90 of 367 posts

Re: Improving DNS Privacy with Oblivious DoH

#81

Post by api »

gwbas1c wrote: post #78

I suspect that practical matters will interfere with widespread adoption of encrypted DNS. In my state, Comcast is going to start charging heavy bandwidth users extra. After a few people get surprise bills, I suspect that lawmakers will require that internet providers break down a bill by application.

I’d just get Starlink. Even if the deal was worse in terms of cost it would be a way to say fuck you to the ISP. Without some way to do that ISPs will not be able to get away with such customer hostile behavior.

Re: Improving DNS Privacy with Oblivious DoH

#82

Post by throwaway67239 »

xoa wrote: post #59
gsnedders wrote: post #17

Earlier quoted context omitted.

> DoH has at least Mozilla and Google on board, and presumably Microsoft are tailing along. Note that DoH (and DoT) shipped in iOS 14 and Big Sur, though aren't particularly easy to enable.

> Note that DoH (and DoT) shipped in iOS 14 and Big Sur, though aren't particularly easy to enable. Specifically, you must install a properly configured .mobileprofile with HTTPS/TLS in the DNSSettings > DNSProtocol part of the payload (along with DNS server addresses of course). Merely pointing at a DoH/DoT supporting DNS server in the settings GUI won't do it, the OS doesn't do any probing and automatically use it…

Also, macOS will not let you enable a DoH profile and Little Snitch (or probably any other tool using the Network Extension framework) at the same time. I don't know if this is a bug or intended behavior, but it's a disappointment.

Re: Improving DNS Privacy with Oblivious DoH

#83

Post by wp381640 »

crumbshot wrote: post #72

This is a neat design, but, does this not just shift the issue of trust as to whether the proxy and the target are colluding: > However, each of these guarantees relies on one fundamental property — that the proxy and the target servers do not collude. So long as there is no collusion, an attacker succeeds only if both the proxy and target are compromised. I'm not sure how an end user would be expected to assess this…

Add a few more proxy hops and you’ve effectively reinvented Tor

Re: Improving DNS Privacy with Oblivious DoH

#84

Post by fsflover »

Avtomatk wrote: post #68
landerwust wrote: post #5

Opened this post expecting to be hating on another power grab dressed up as protocol engineering, but this one seems to actively /reduce/ the centralization of user data collection in DoH. Props to Cloudflare, I'm impressed.

I would like someone to correct me if I am wrong, but I think we can never have 100% privacy because the destination IPs cannot be encrypted or hidden, so as long as the destination IP can be observed, the server that you are connecting at can be obtained (I know a server can host many web pages, but this requires the port, which cannot be encrypted either). So I don't know to what extent this protocol can be useful.

> but I think we can never have 100% privacy because the destination IPs cannot be encrypted or hidden

This problem is solved in I2P (https://geti2p.net) by adding a few intermediate hops between you and destination. You will know someone is connecting to the network, but you can't find what they're doing.

Re: Improving DNS Privacy with Oblivious DoH

#85

Post by joshspankit »

I understand why Cloudflare wants this (marketing, as well as being able to serve their customer’s content through restrictions, thus making them more valuable to those customers),

but why does Apple want this?

My knee-jerk is that they want to further hide/make unstoppable things like the Gatekeeper network checks, but there has to be more right?

Re: Improving DNS Privacy with Oblivious DoH

#86

Post by PartiallyTyped »

joshspankit wrote: post #85

I understand why Cloudflare wants this (marketing, as well as being able to serve their customer’s content through restrictions, thus making them more valuable to those customers), but why does Apple want this? My knee-jerk is that they want to further hide/make unstoppable things like the Gatekeeper network checks, but there has to be more right?

It is part of their marketing. The fact that others sell or actively use your data, e.g. google, facebook, microsoft, apple was handed the opportunity to charge a premium for the absence of such tracking and data usage. If you watch the presentations, they branded/poised themselves as the privacy centric approach.

Re: Improving DNS Privacy with Oblivious DoH

#87

Post by ReactiveJelly »

judge2020 wrote: post #67
darkwater wrote: post #43

Until we get rid of SNI[1] in HTTPS for good there will still be providers (like my ISP) that do deep packet inspection on SNI and kill the connection right away if you happen to visit a forbidden site (and this was western Europe, yesterday, on a site behind CloudFlare) [1] https://en.m.wikipedia.org/wiki/Server_Name_Indication

Part of the counter-argument that has been so prevalent on HN (most recently: [0]) is that when you prevent middlemen on your network from being able to see what website you're browsing, you're doing exactly that: preventing anyone, even a trusted network administrator, from being able to inspect traffic. I'm all for DoH and ECH since US ISPs have a history of inspecting and logging traffic, but it seems like there s…

> a way to manage the devices on your network besides being forced to set up MDM on everything.

It's sort of like cleaning malware off of an infected PC from within the infected OS.

It was always theoretically impossible, and now we're just seeing the gap of "Well in this case the enemy was imperfect" closing. It was never going to stay open in the first place.

Re: Improving DNS Privacy with Oblivious DoH

#88

Post by bennettnate5 »

Avtomatk wrote: post #68
landerwust wrote: post #5

Opened this post expecting to be hating on another power grab dressed up as protocol engineering, but this one seems to actively /reduce/ the centralization of user data collection in DoH. Props to Cloudflare, I'm impressed.

I would like someone to correct me if I am wrong, but I think we can never have 100% privacy because the destination IPs cannot be encrypted or hidden, so as long as the destination IP can be observed, the server that you are connecting at can be obtained (I know a server can host many web pages, but this requires the port, which cannot be encrypted either). So I don't know to what extent this protocol can be useful.

I think there's still pretty good worth in this protocol. DNS is one of the key areas where we voluntarily give away information on every single website we're connecting to to a third party. This protocol certainly helps that--as long as the proxy and recursive resolver do not collude, neither will be able to associate the websites you're looking up with your IP.

It does have its limitations; a MITM can still just as easily see which IP addresses you connect to and determine which websites are associated with those IPs. But ODoH isn't really meant to fix that. A VPN would be better suited to fix that particular privacy concern.

Re: Improving DNS Privacy with Oblivious DoH

#89

Post by simonh »

joshspankit wrote: post #85

I understand why Cloudflare wants this (marketing, as well as being able to serve their customer’s content through restrictions, thus making them more valuable to those customers), but why does Apple want this? My knee-jerk is that they want to further hide/make unstoppable things like the Gatekeeper network checks, but there has to be more right?

Why would Apple care about hiding Gatekeeper traffic from internet providers?

Re: Improving DNS Privacy with Oblivious DoH

#90

Post by joshspankit »

PartiallyTyped wrote: post #86
joshspankit wrote: post #85

I understand why Cloudflare wants this (marketing, as well as being able to serve their customer’s content through restrictions, thus making them more valuable to those customers), but why does Apple want this? My knee-jerk is that they want to further hide/make unstoppable things like the Gatekeeper network checks, but there has to be more right?

It is part of their marketing. The fact that others sell or actively use your data, e.g. google, facebook, microsoft, apple was handed the opportunity to charge a premium for the absence of such tracking and data usage. If you watch the presentations, they branded/poised themselves as the privacy centric approach.

I see your point about how they (will) position it, but I’m still curious about their actual motives.
Post reply on HN