Improving DNS Privacy with Oblivious DoH

I’m good with the Apple’s privacy-oriented stance. But I can’t stop to think what will happen when advertisers knock on Apple’s door trying to get their hands on the users’ data that one else can access. Is Apple going to sell it out for more profits?

Re: Improving DNS Privacy with Oblivious DoH

#5

Post by landerwust » Tue, Dec 08, 2020, 1:08 PM UTC

Opened this post expecting to be hating on another power grab dressed up as protocol engineering, but this one seems to actively /reduce/ the centralization of user data collection in DoH. Props to Cloudflare, I'm impressed.

Re: Improving DNS Privacy with Oblivious DoH

#6

Post by TimWolla » Tue, Dec 08, 2020, 1:09 PM UTC

So, having read the blog post from Cloudflare I don't understand why the proxy (needs to terminate|terminates) TLS.

I thought HTTPS proxying (or rather: Any TCP protocol) was a solved problem by the HTTP CONNECT verb or SOCKS proxies.

What am I missing?

Re: Improving DNS Privacy with Oblivious DoH

#7

Post by landerwust » Tue, Dec 08, 2020, 1:10 PM UTC

TimWolla wrote: post #6

So, having read the blog post from Cloudflare I don't understand why the proxy (needs to terminate|terminates) TLS. I thought HTTPS proxying (or rather: Any TCP protocol) was a solved problem by the HTTP CONNECT verb or SOCKS proxies. What am I missing?

The user's IP address is masqueraded by the proxy, and neither the DNS mothership (Cloudflare) nor the ISP get to see both who the user is and what they requested. It's an extremely desirable property DoH currently lacks

Re: Improving DNS Privacy with Oblivious DoH

#8

Post by techelite » Tue, Dec 08, 2020, 1:10 PM UTC

seek3r wrote: post #4

I’m good with the Apple’s privacy-oriented stance. But I can’t stop to think what will happen when advertisers knock on Apple’s door trying to get their hands on the users’ data that one else can access. Is Apple going to sell it out for more profits?

It's just marketing. Apple has already shown they will sell you out with PRISM.

Who knows what other backroom deals are happening outside our knowledge. The only reason we found out about PRISM is because the gigantic scale and Snowden sacrificed Everything to let it be known.

Re: Improving DNS Privacy with Oblivious DoH

#9

Post by ignoramous » Tue, Dec 08, 2020, 1:11 PM UTC

Key bits from the Cloudflare blog https://blog.cloudflare.com/oblivious-dns/

> The target [resolver] sees only the [DNS] query and the proxy’s IP address. The proxy has no visibility into the DNS messages, with no ability to identify, read, or modify either the query being sent by the client or the answer being returned by the target. Only the intended target [resolver] can read the content of the [DNS] query and produce a [DNS] response.

> The whole process begins with clients that encrypt their query for the target using HPKE. Clients obtain the target’s public key via DNS, where it is bundled into a [SVCB/HTTPS] HTTPS resource record and protected by DNSSEC.

> Clients transmit these encrypted queries to a proxy over an HTTPS connection. Upon receipt, the proxy forwards the query to the designated target. The target then decrypts the query, produces a response by sending the query to a recursive resolver such as 1.1.1.1, and then encrypts the response to the client. The encrypted query from the client contains encapsulated keying material from which targets derive the response encryption symmetric key.

> ...50% of the time ODoH queries are resolved in fewer than 228ms.

BTW, DNSCrypt supports "oblivious" encrypted DNS queries via what it calls Anonymized Relays https://github.com/DNSCrypt/dnscrypt-proxy/wiki/Anonymized-D...

Re: Improving DNS Privacy with Oblivious DoH

#10

Post by techelite » Tue, Dec 08, 2020, 1:13 PM UTC

I urge people to stop repeating Apple Advertising. Claims of privacy and security are debunked weekly. You put yourself at risk if you believe it.