5 ms·

Some ISPs block outbound DNS from customers to anywhere but their resolvers, filtering based on target port. This is a particularly common trick in countries th

Some ISPs block outbound DNS from customers to anywhere but their resolvers, filtering based on target port. This is a particularly common trick in countries that attempt to censor the internet. It's a lot harder to do that with DNS-over-HTTPS because it looks like normal traffic. That said, in this case ISPs can just null route the IP address of the obvious main resolvers such as 1.1.1.1. I imagine most of the benefit is surely to people who can spin up their own resolvers.

bluejekyll 9y ago
When we add TLS on top of the protocol, ISPs can only filter based on port at that point. We can run DNS on 443 if that helps, but as you said, static well-known IPs can then be blocked. > I imagine most of the benefit is surely to people who can spin up their own resolvers. There are already many easily run DNS resolvers available. Is there a benefit you see in operating them over HTTPS that improves on that?
- gsnedders 9y ago
  > When we add TLS on top of the protocol, ISPs can only filter based on port at that point. And SNI… :(
  - Operyl 9y ago
    If this were to become an issue, I guess Cloudflare could try to disable SNI.
    - hsivonen 9y ago
      The client sends SNI, so how could the server opt out?
      - Operyl 9y ago
        You just solved your own question. Cloudflare creates an opensource client that users install locally.
        majewsky 9y ago
        Where's the button to install your own DNS resolver on iOS? Or non-rooted Android, for that matter.
        thisacctforreal 9y ago
        Someone shared this lovely iOS app yesterday: DNSCloak • DNSCrypt DoH client by Sergey Smirnov https://itunes.apple.com/ca/app/dnscloak-dnscrypt-doh-client/id1330471557 https://itunes.apple.com/ca/app/dnscloak-dnscrypt-doh-client... It supports DNSCrypt, DNSSEC and DNS-over-HTTPS, the IAP are for tips :) It works via running a VPN server on your device. To change your normal plaintext DNS resolver just tap the circle-i on your WiFi network.
        epse 9y ago
        Non-rooted android, you have to set a static IP for every network and then there will be an option to enter DNS names. They default to Google DNS Static IP settings are under advanced.
        MertsA 9y ago
        Well with SNI the concern isn't DNS. Any TLS connection that supports SNI (basically everything that isn't ancient) would have to be fixed. Also, ANI is a pretty useful thing to have and getting rid of it doesn't exactly fix much. Without SNI the server only has the destination IP address to determine which site and thus which certificate to send to the client. Having https sites with multiple certificates hosted on one IP address only works because of SNI. You would break a large portion of the web by disabling it. Also, even if you do disable SNI, the server still sends back the certificate with the domain names in it. And even if you ignore all of that, there's still reverse DNS which will probably be accurate if they send mail from that server and you can always do a DNS lookup for every domain name there is to get a map of which domains point to a given IP. Due to DNS based geolocation that won't work for every site but the sites using that are going to be big enough to find their IP address ranges via another method. In short, there's really no good solution here but an amendment to TLS could conceivably make it to where it wouldn't be possible to narrow it down to which site that an IP address hosts the user was visiting. That could actually be good enough for traffic to e.g. cloudflare.
      - d33 9y ago
        Server could advertise no need to use SNI in advance. Or we could do SNI after actually establishing an encrypted session...
  - tonyztan 9y ago
    There's domain fronting, which uses SNI to bypass censorship! :) https://en.wikipedia.org/wiki/Domain_fronting https://en.wikipedia.org/wiki/Domain_fronting
  - bscphil 9y ago
    This is really the elephant in the room. For all we know, ISP bad-actors have never cared about DNS for data-collection purposes, and they're already using SNI to gather data to sell to marketers. I think it's absolutely crucial to find a way to (at least optionally) send SNI encrypted to the server.
skybrian 9y ago
I suppose there is also domain fronting [1], but it won't be fast or an easy-to-remember IP address anymore. And if you need that, you might need a VPN anyway? [1] https://en.wikipedia.org/wiki/Domain_fronting https://en.wikipedia.org/wiki/Domain_fronting
- fjsolwmv 9y ago
  It's amazing that governments haven't shut down shared domains to prevent domain-frontong.

bluejekyll 9y ago

When we add TLS on top of the protocol, ISPs can only filter based on port at that point. We can run DNS on 443 if that helps, but as you said, static well-known IPs can then be blocked. > I imagine most of the benefit is surely to people who can spin up their own resolvers. There are already many easily run DNS resolvers available. Is there a benefit you see in operating them over HTTPS that improves on that?

gsnedders 9y ago
> When we add TLS on top of the protocol, ISPs can only filter based on port at that point. And SNI… :(
- Operyl 9y ago
  If this were to become an issue, I guess Cloudflare could try to disable SNI.
  - hsivonen 9y ago
    The client sends SNI, so how could the server opt out?
    - Operyl 9y ago
      You just solved your own question. Cloudflare creates an opensource client that users install locally.
      - majewsky 9y ago
        Where's the button to install your own DNS resolver on iOS? Or non-rooted Android, for that matter.
        thisacctforreal 9y ago
        Someone shared this lovely iOS app yesterday: DNSCloak • DNSCrypt DoH client by Sergey Smirnov https://itunes.apple.com/ca/app/dnscloak-dnscrypt-doh-client/id1330471557 https://itunes.apple.com/ca/app/dnscloak-dnscrypt-doh-client... It supports DNSCrypt, DNSSEC and DNS-over-HTTPS, the IAP are for tips :) It works via running a VPN server on your device. To change your normal plaintext DNS resolver just tap the circle-i on your WiFi network.
        epse 9y ago
        Non-rooted android, you have to set a static IP for every network and then there will be an option to enter DNS names. They default to Google DNS Static IP settings are under advanced.
        MertsA 9y ago
        Well with SNI the concern isn't DNS. Any TLS connection that supports SNI (basically everything that isn't ancient) would have to be fixed. Also, ANI is a pretty useful thing to have and getting rid of it doesn't exactly fix much. Without SNI the server only has the destination IP address to determine which site and thus which certificate to send to the client. Having https sites with multiple certificates hosted on one IP address only works because of SNI. You would break a large portion of the web by disabling it. Also, even if you do disable SNI, the server still sends back the certificate with the domain names in it. And even if you ignore all of that, there's still reverse DNS which will probably be accurate if they send mail from that server and you can always do a DNS lookup for every domain name there is to get a map of which domains point to a given IP. Due to DNS based geolocation that won't work for every site but the sites using that are going to be big enough to find their IP address ranges via another method. In short, there's really no good solution here but an amendment to TLS could conceivably make it to where it wouldn't be possible to narrow it down to which site that an IP address hosts the user was visiting. That could actually be good enough for traffic to e.g. cloudflare.
    - d33 9y ago
      Server could advertise no need to use SNI in advance. Or we could do SNI after actually establishing an encrypted session...
- tonyztan 9y ago
  There's domain fronting, which uses SNI to bypass censorship! :) https://en.wikipedia.org/wiki/Domain_fronting https://en.wikipedia.org/wiki/Domain_fronting
- bscphil 9y ago
  This is really the elephant in the room. For all we know, ISP bad-actors have never cared about DNS for data-collection purposes, and they're already using SNI to gather data to sell to marketers. I think it's absolutely crucial to find a way to (at least optionally) send SNI encrypted to the server.

skybrian 9y ago

I suppose there is also domain fronting [1], but it won't be fast or an easy-to-remember IP address anymore. And if you need that, you might need a VPN anyway? [1] https://en.wikipedia.org/wiki/Domain_fronting https://en.wikipedia.org/wiki/Domain_fronting

fjsolwmv 9y ago
It's amazing that governments haven't shut down shared domains to prevent domain-frontong.