A cartoon intro to DNS over HTTPS

#1

Post by johannh » Thu, May 31, 2018, 2:10 PM UTC

A cartoon intro to DNS over HTTPS
hacks.mozilla.org

Re: A cartoon intro to DNS over HTTPS

#2

Post by Klathmon » Thu, May 31, 2018, 7:37 PM UTC

There was a good chunk of time where my ISP (Verizon FIOS at the time) was having some kind of DNS hijacking attack happening where many CDN IPs were being replaced with an IP of a server that was adding some ad-injecting javascript into many pages (and god knows what else, I still have the payload laying around somewhere as I saved it for future curiosity).

At the time my only real recourse was to pump my whole house through a VPN, as even Google's DNS (8.8.8.8) was being hijacked, but ONLY when it was coming from my home IP. (Full disclosure, i'm not very well versed in the networking stack. I know enough to get myself in trouble, but not much more. This was what I understood to be happening, but I could be way off base. However it was happening on multiple devices, multiple OSs, multiple verizon IPs, multiple DNS servers, both with and without a router, and would stop instantly if any of those machines were pointed at a wireless hotspot, or a VPN was turned on. At one point I even sent my router's WAN connection through my phone's hotspot and the problem went away)

After talking with verizon many times and each time having to spend an hour or so trying to get through to someone that knew even remotely what I was talking about, all they were able to do was reset my IP, which fixed nothing.

Now that DNS-over-HTTPS is becoming more common, i'm going to use it everywhere I can. Yes, DNSSEC might be a "better" solution, but I can use DoH right now to protect myself on all sites and (hopefully soon) all devices.

Just the other day I discovered Intra [0] a (still unreleased) app by Google for android which has your whole android phone use DNS-over-HTTPS.

I've been running it the last few days and i'm quite pleased with it. Does anyone know of a way to force all DNS queries in windows to use DoH?

[0] https://play.google.com/store/apps/details?id=app.intra&hl=e...

Re: A cartoon intro to DNS over HTTPS

#3

Post by textmode » Thu, May 31, 2018, 7:58 PM UTC

"Threats to users' privacy and security are growing."

s/privacy/&, autonomy/'

Case in point about autonomy is on HN front page at present: https://news.ycombinator.com/item?id=17196888

The author cites a hypothetical example where a user shopping at Megastore is blocked from accessing her preferred source of DNS data in order to prevent her from checking a price.

Extending this hypothetical, imagine if in response to her request for an unbiased price quote the user was shown unwanted ads with inflated, customised pricing (informed by data gathered about her through tracking).

Choice of DNS data is an effective way for users to block advertising and tracking.

The issue with user control over DNS also arises with mobile and other devices (e.g. Chromecast/Google Cast/Google Home) that discourage or prevent a user from using her preferred source of DNS data, forcing her to use a commercially-oriented source which may block certain lookups.

This is relevant with any computer that connects to the internet.

It is an issue of autonomy.

There is a long tradition of HOSTS files and later non-commercial DNS where users can autonomously determine where on the network they want to "go". They have the final control over the source of DNS data the computer will use. They can delegate DNS service to someone else, however, following that long tradition, they still retain the autonomy to choose the source of the DNS data, whether it is another third party, their own DNS servers or perhaps /etc/hosts in place of DNS.

When an organization (e.g. running an "app store") seeks to circumvent the ability of the user to choose her own DNS data source on her own computer, that is an attack on autonomy.

The author mentions that Firefox will allow users to choose their own "DOH DNS" servers. If so, this respects users' autonomy.

(No one seems to be mentioning one obvious advantange of DOH DNS for browsers: bulk DNS "prefetch" lookups. One can use HTTP/1.1 pipelining to retrieve the IP addresses for every hostname contained in an HTML page, with a single HTTP request, instead of numerous, simultaneous DNS requests. As for privacy problems with TLS fingerprints, HTTP requests can be secured by CurveCP as an alternative to TLS - example is in my profile.)

Re: A cartoon intro to DNS over HTTPS

#4

Post by iampims » Thu, May 31, 2018, 8:22 PM UTC

I applaud the efforts to increase privacy,reduce data collection and hardened security. Do we really want a SPOF in Cloudflare for this though? A single outage (or AT&T snafu) and many millions of users would be affected.

Re: A cartoon intro to DNS over HTTPS

#5

Post by philip1209 » Thu, May 31, 2018, 8:28 PM UTC

DNS over HTTPS uses DNS in the protocol. Does that make it extra-recursive DNS?

Re: A cartoon intro to DNS over HTTPS

#6

Post by bluejekyll » Thu, May 31, 2018, 8:31 PM UTC

I am very conflicted about DNS-over-HTTPS vs. DNS-over-TLS.

Most of DNS-over-HTTPS' interesting use-cases start coming into play when you're using the same HTTPS session as the one being used to serve the site you're visiting. Otherwise, DNS-over-TLS is sufficient for the same level of privacy.

At that point though, DNS-over-HTTPS has a provenance issue that I don't fully grok how we're going to avoid. What I mean by that: if the site you're visiting supports DNS-over-HTTPS, where requests to that site for DNS records are requested, what happens when they decide to issue custom responses to DNS requests that ignore or supplement actual data in a zone? Won't that lead to a bifurcation of the DNS network, where web-sites can start issuing custom response to DNS queries?

Cloudflare, and Quad9, both offer DNS-over-TLS, this will be preferable for non-HTTP use-cases. Some of the points in the article imply that DNS when using DNS-over-HTTPS can't be used for tracking you, but really that just means you're passing that trust to Cloudflare, Quad9, or Google. I suppose the choice is open to you at that point.

Re: A cartoon intro to DNS over HTTPS

#7

Post by mcone » Thu, May 31, 2018, 8:37 PM UTC

Klathmon wrote: post #2

There was a good chunk of time where my ISP (Verizon FIOS at the time) was having some kind of DNS hijacking attack happening where many CDN IPs were being replaced with an IP of a server that was adding some ad-injecting javascript into many pages (and god knows what else, I still have the payload laying around somewhere as I saved it for future curiosity). At the time my only real recourse was to pump my whole hous…

> Does anyone know of a way to force all DNS queries in windows to use DoH?

I think you could use pi-hole to do this. https://docs.pi-hole.net/guides/dns-over-https/

Re: A cartoon intro to DNS over HTTPS

#8

Post by jchw » Thu, May 31, 2018, 8:39 PM UTC

bluejekyll wrote: post #6

I am very conflicted about DNS-over-HTTPS vs. DNS-over-TLS. Most of DNS-over-HTTPS' interesting use-cases start coming into play when you're using the same HTTPS session as the one being used to serve the site you're visiting. Otherwise, DNS-over-TLS is sufficient for the same level of privacy. At that point though, DNS-over-HTTPS has a provenance issue that I don't fully grok how we're going to avoid. What I mean by…

I'm not sure I understand.

I was under the impression that DNS-over-HTTPS was nothing more than just an alternative DNS protocol just like DNS-over-TLS, where you perform an HTTPS request in order to query for a DNS name, and that DNS-over-TLS was just plain old DNS wrapped in TLS.

You seem to be implying that DNS-over-HTTPS would enable sites themselves to deliver DNS records. I don't see how that is possible, because connecting to HTTPS with a hostname requires resolving a DNS record. Am I misunderstanding?

Re: A cartoon intro to DNS over HTTPS

#9

Post by nykolasz » Thu, May 31, 2018, 8:40 PM UTC

There are 3 major protocols available for DNS privacy:

* DNSCrypt

* DNS over TLS

* DNS over HTTPS

DNSCrypt is the one with better client support and a long list of providers available. If you pick DNS over TLS or DNS over HTTPS you will be restricted to 3 or 4 major players (google, quad9, cloudflare and cleanbrowsing). If you trust them, you are good.

For example, this is the list of providers with DNSCrypt support: https://download.dnscrypt.info/dnscrypt-resolvers/v2/public-...

For DNS over (HTTPS|TLS), there is very little client tools available for troubleshooting. The best one I found was these 2 in PHP:

https://github.com/dcid/dns-over-tls-php-client https://github.com/dcid/doh-php-client

Re: A cartoon intro to DNS over HTTPS

#10

Post by barbegal » Thu, May 31, 2018, 8:41 PM UTC

As a cynic I would say this is an attempt by Google and Cloudflare to collect DNS data. Why else would they provide this service for free?

Both Google's [1] and Cloudflare's [2] DNS privacy policy prohibits them from storing personally identifiable information or from correlating DNS information with other Google data coming from the same IP/account but it does allow them to store information about which domains are popular, from which locations and from which type of device.

TLS (and therefore HTTPS) provides a very useful fingerprint based on accepted cipher suites, extensions, compression methods...

[1] https://developers.google.com/speed/public-dns/privacy

[2] https://developers.cloudflare.com/1.1.1.1/commitment-to-priv...

[3] https://devcentral.f5.com/articles/tls-fingerprinting-a-meth...