10 ms·

Getting Started with DNS over HTTPS on Firefox

78 points by nykolasz 8y ago

mderazon 8y ago
I have enabled DNS over https on Android P (it has built in system wide cpapbility) with Cloudflare. Problem is that I have no idea how to test if it is really working :-)
- ggm 8y ago
  Install stubby on your mac or linux host. Ask the same questions on both. See what happens.
- jedisct1 8y ago
  Go to https://cloudflare-dns.com/help/ https://cloudflare-dns.com/help/
  - mderazon 8y ago
    Nice ! Didn't know about that. For a reference, this is what I get when I set my dns as 1dot1dot1dot1.cloudflare-dns.com on Android P: https://cloudflare-dns.com/help/#eyJpc0NmIjoiWWVzIiwiaXNEb3QiOiJZZXMiLCJpc0RvaCI6Ik5vIiwicmVzb2x2ZXJJcC0xLjEuMS4xIjoiWWVzIiwicmVzb2x2ZXJJcC0xLjAuMC4xIjoiWWVzIiwicmVzb2x2ZXJJcC0yNjA2OjQ3MDA6NDcwMDo6MTExMSI6Ik5vIiwicmVzb2x2ZXJJcC0yNjA2OjQ3MDA6NDcwMDo6MTAwMSI6Ik5vIiwiZGF0YWNlbnRlckxvY2F0aW9uIjoiWlJIIiwiaXNwTmFtZSI6IkNsb3VkZmxhcmUiLCJpc3BBc24iOiIxMzMzNSJ9 https://cloudflare-dns.com/help/#eyJpc0NmIjoiWWVzIiwiaXNEb3Q...
- cup-of-tea 8y ago
  Intercept the traffic somewhere and inspect it with Wireshark. You can decrypt the HTTPS packets if you can manage to log the keys on Android (see https://jimshaver.net/2015/02/11/decrypting-tls-browser-traffic-with-wireshark-the-easy-way/ https://jimshaver.net/2015/02/11/decrypting-tls-browser-traf...).
krylon 8y ago
This is probably kind of a dumb question, but can I run my own DoH server? If so, where can I find a tutorial?
- jedisct1 8y ago
  Install rust-doh: https://github.com/jedisct1/rust-doh https://github.com/jedisct1/rust-doh There are also tutorials on how to set up your own DNSCrypt server: https://github.com/jedisct1/dnscrypt-proxy/wiki/How-to-setup-your-own-DNSCrypt-server-in-less-than-10-minutes https://github.com/jedisct1/dnscrypt-proxy/wiki/How-to-setup...
  - krylon 8y ago
    Thank you!
- LinuxBender 8y ago
  That is not a dumb question at all. Running your own servers gives you control over your DNS, your cache and where it is directed upstream.
  - krylon 8y ago
    I have been running BIND9 on my home network, both as an authoritative name server for my local zone, and as a recursive resolver, for more than ten years. ;-) But for DoH to make sense, the server must be outside of my private network and my ISP's network.
    - LinuxBender 8y ago
      Exactly. You can forward traffic from DoH to TLS upstream servers, or servers sitting in tier-1 networks that are well outside of your ISP.
forcer 8y ago
Google does no evil. Yep :)
jacob019 8y ago
So is this where we are going, application level dns implementations?
- MaxBarraclough 8y ago
  Seems the sensible place to start, no? We're a long way off secure DNS from the OS.
  - lnx01 8y ago
    As part of releasing 1.1.1.1, Cloudflare implemented DNS-Over-HTTPS proxy functionality in to one of their tools: cloudflared, also known as argo-tunnel. You can install it and configure the OS to do lookups agains cloudflared on localhost instead of some outside DNS server.
  - Spivak 8y ago
    And by a long way, you mean you can do it right now on pretty much all Linux systems. https://github.com/systemd/systemd/pull/8849 https://github.com/systemd/systemd/pull/8849
  - mderazon 8y ago
    Android P (beta) has it in system settings. I am using it right now. (Although I have no idea how to test if it's really working) There's also this interesting app: https://play.google.com/store/apps/details?id=app.intra https://play.google.com/store/apps/details?id=app.intra
  - jedisct1 8y ago
    Use https://github.com/jedisct1/dnscrypt-proxy https://github.com/jedisct1/dnscrypt-proxy
- blueatlas 8y ago
  I think we can also say that SSL is "application level". I mean, the network isn't secure, so the application (ie. a web browser) must do something to encrypt data in transit.
- 8y ago
ilovetux 8y ago
What is the point of using DNS over HTTPS if you use google's DoH server?
- pwned1 8y ago
  Preventing your ISP from logging your DNS queries?
  - ilovetux 8y ago
    Well I suppose that this is a concern, and with recent regulatory roll-backs even more so today. I'm creeped out now...
MaxBarraclough 8y ago
See also this article by a Mozillian https://hacks.mozilla.org/2018/05/a-cartoon-intro-to-dns-over-https/ https://hacks.mozilla.org/2018/05/a-cartoon-intro-to-dns-ove...
Communitivity 8y ago
I'm interested to see how the implementation performs in practice, but I don't see DNS over HTTPS as better than some of the other solutions out there. Some have been around for a while and are well-tried but failed to gain wide adoption, like DNSSEC. Others are new kids, unproven but with lots of promise on paper, like IPFS service discovery. In no particular order, here are some alternative technologies. As always YMMV and the proof is not just in the technical implementation of the protocol, but also the policies and politics around the adoption. A good chunk of them overlap DNS's goals in what they aim to do, but only partially. * DNSSEC - https://www.icann.org/resources/pages/dnssec-qaa-2014-01-29-en https://www.icann.org/resources/pages/dnssec-qaa-2014-01-29-... Various Distributed Hash Table (DHT) based approaches: * IPNS - https://medium.com/@yaniv_g/hosting-websites-on-ipfs-with-ipns-b94659c42b52 https://medium.com/@yaniv_g/hosting-websites-on-ipfs-with-ip... * Telehash - http://telehash.org/ http://telehash.org/ Various cryptocurrency approaches: * Namecoin - https://bit.namecoin.org/ https://bit.namecoin.org/ * DomainToken - http://www.domaintoken.io/ http://www.domaintoken.io/ * Steemit - https://steemit.com/ https://steemit.com/ If you know of others, please comment with the name and a link.
- georgyo 8y ago
  Ipns lookups take over a minute: https://github.com/ipfs/go-ipfs/issues/3860 https://github.com/ipfs/go-ipfs/issues/3860 Dnssec is just as vulnerable to mitm attacks, because you just strip the dnssec responses and the client has no way to know if it the resolver just doesn't support DNSSEC The crypto ones don't even warrant a response, they are non compatible with anything that happens today.
  - phicoh 8y ago
    The reason DNSSEC is vulnerable to that kind of MITM attack is because browsers refuse to do client side validation. For privacy reasons, DNS over TLS and DNS over HTTPS are still a good idea. So even with DNSSEC you would need one of those.
    - tptacek 8y ago
      Browsers tried to do DNSSEC validation. It didn't work. DNSSEC features in Chrome, OS X, and Firefox were rolled back. Also: it is part of the architecture of DNSSEC for clients not to do full validation, which requires that they act as their own recursive resolvers and eliminates shared caches.
e12e 8y ago
> GET https://dns.google.com/experimental?ct&dns=AAABAAABAAAAAAAAB2V4YW1wbGUDY29tAACAAE https://dns.google.com/experimental?ct&dns=AAABAAABAAAAAAAAB... HTTP/2.0” I guess the stuff in the dns=bit is a query to look up the ip of dns.google.com? ;) I'm not sure if I think trusting certs for ip addresses (as opposed to domain names) is a great idea. And how else would this bootstrap?
XparentX 8y ago
Many of us that use local DNS (pi-hole and similar technology), this is not an option. On the other hand, I feel more secure with my local ISP than with mega ad-corporation like Google. I think that DNS over HTTPS is loved by the ad-community. No local DNS that can disturb or block user generated data. Don’t get fooled people. #DeleteGoogle
- ac29 8y ago
  There's no reason you can't use DNS over HTTPS and pi-hole, just use dnscrypt-proxy, and point your pi-hole at that: https://github.com/jedisct1/dnscrypt-proxy https://github.com/jedisct1/dnscrypt-proxy
  - XparentX 8y ago
    Thanks for tip! Will look into it.
- krylon 8y ago
  As I just learned a few minutes ago, you can run your own DNS over HTTPS server. Then you do not need to trust either Google or your ISP.
  - mike-cardwell 8y ago
    Just another thing that you need to remember to configure on each of the applications that don't use the system resolver, on each of your systems. I guess for me that equates to Firefox on 3 systems. Although I have three separate Firefox profiles, so I guess that's 9 times it needs configuring. And at some point 3 copies of Chrome, and another 3 Chromiums I guess. And then whatever other apps decide they want their own custom name resolution. That's assuming I'm actively notified that they have been changed to work that way, and assuming I remember to do it after each install. Because by the sound of it, without remembering to configure my systems, I'm going to end up in a situation where I'm now shipping off a list of all the websites I visit to some American corp for safe keeping, by default. Along with everyone else in the World. I can't even sit here in the UK, visiting a UK website, without asking an American corp for the IP. At least today, I'm asking my ISP for the IP. A company based in my legal jurisdiction, with whom I have a business relationship. [edit] I forgot Firefox on my phone too. Thankfully I don't have a tablet.
akerro 8y ago
Can I use it with OpenNIC resolvers? https://github.com/DNSCrypt/dnscrypt-resolvers/blob/master/v2/public-resolvers.md https://github.com/DNSCrypt/dnscrypt-resolvers/blob/master/v...
js2 8y ago
I installed doh-client from https://github.com/m13253/dns-over-https https://github.com/m13253/dns-over-https onto my EdgeOS router, then pointed dnsmasq at doh-client and, well, it works and I have nothing else exciting to report. One less thing for AT&T to snoop.

78 points by nykolasz 8y ago

I have enabled DNS over https on Android P (it has built in system wide cpapbility) with Cloudflare. Problem is that I have no idea how to test if it is really working :-)

ggm 8y ago
Install stubby on your mac or linux host. Ask the same questions on both. See what happens.
jedisct1 8y ago
Go to https://cloudflare-dns.com/help/ https://cloudflare-dns.com/help/
- mderazon 8y ago
  Nice ! Didn't know about that. For a reference, this is what I get when I set my dns as 1dot1dot1dot1.cloudflare-dns.com on Android P: https://cloudflare-dns.com/help/#eyJpc0NmIjoiWWVzIiwiaXNEb3QiOiJZZXMiLCJpc0RvaCI6Ik5vIiwicmVzb2x2ZXJJcC0xLjEuMS4xIjoiWWVzIiwicmVzb2x2ZXJJcC0xLjAuMC4xIjoiWWVzIiwicmVzb2x2ZXJJcC0yNjA2OjQ3MDA6NDcwMDo6MTExMSI6Ik5vIiwicmVzb2x2ZXJJcC0yNjA2OjQ3MDA6NDcwMDo6MTAwMSI6Ik5vIiwiZGF0YWNlbnRlckxvY2F0aW9uIjoiWlJIIiwiaXNwTmFtZSI6IkNsb3VkZmxhcmUiLCJpc3BBc24iOiIxMzMzNSJ9 https://cloudflare-dns.com/help/#eyJpc0NmIjoiWWVzIiwiaXNEb3Q...
cup-of-tea 8y ago
Intercept the traffic somewhere and inspect it with Wireshark. You can decrypt the HTTPS packets if you can manage to log the keys on Android (see https://jimshaver.net/2015/02/11/decrypting-tls-browser-traffic-with-wireshark-the-easy-way/ https://jimshaver.net/2015/02/11/decrypting-tls-browser-traf...).

krylon 8y ago

This is probably kind of a dumb question, but can I run my own DoH server? If so, where can I find a tutorial?

jedisct1 8y ago
Install rust-doh: https://github.com/jedisct1/rust-doh https://github.com/jedisct1/rust-doh There are also tutorials on how to set up your own DNSCrypt server: https://github.com/jedisct1/dnscrypt-proxy/wiki/How-to-setup-your-own-DNSCrypt-server-in-less-than-10-minutes https://github.com/jedisct1/dnscrypt-proxy/wiki/How-to-setup...
- krylon 8y ago
  Thank you!
LinuxBender 8y ago
That is not a dumb question at all. Running your own servers gives you control over your DNS, your cache and where it is directed upstream.
- krylon 8y ago
  I have been running BIND9 on my home network, both as an authoritative name server for my local zone, and as a recursive resolver, for more than ten years. ;-) But for DoH to make sense, the server must be outside of my private network and my ISP's network.
  - LinuxBender 8y ago
    Exactly. You can forward traffic from DoH to TLS upstream servers, or servers sitting in tier-1 networks that are well outside of your ISP.

forcer 8y ago

Google does no evil. Yep :)

jacob019 8y ago

So is this where we are going, application level dns implementations?

MaxBarraclough 8y ago
Seems the sensible place to start, no? We're a long way off secure DNS from the OS.
- lnx01 8y ago
  As part of releasing 1.1.1.1, Cloudflare implemented DNS-Over-HTTPS proxy functionality in to one of their tools: cloudflared, also known as argo-tunnel. You can install it and configure the OS to do lookups agains cloudflared on localhost instead of some outside DNS server.
- Spivak 8y ago
  And by a long way, you mean you can do it right now on pretty much all Linux systems. https://github.com/systemd/systemd/pull/8849 https://github.com/systemd/systemd/pull/8849
- mderazon 8y ago
  Android P (beta) has it in system settings. I am using it right now. (Although I have no idea how to test if it's really working) There's also this interesting app: https://play.google.com/store/apps/details?id=app.intra https://play.google.com/store/apps/details?id=app.intra
- jedisct1 8y ago
  Use https://github.com/jedisct1/dnscrypt-proxy https://github.com/jedisct1/dnscrypt-proxy
blueatlas 8y ago
I think we can also say that SSL is "application level". I mean, the network isn't secure, so the application (ie. a web browser) must do something to encrypt data in transit.
8y ago

ilovetux 8y ago

What is the point of using DNS over HTTPS if you use google's DoH server?

pwned1 8y ago
Preventing your ISP from logging your DNS queries?
- ilovetux 8y ago
  Well I suppose that this is a concern, and with recent regulatory roll-backs even more so today. I'm creeped out now...

MaxBarraclough 8y ago

See also this article by a Mozillian https://hacks.mozilla.org/2018/05/a-cartoon-intro-to-dns-over-https/ https://hacks.mozilla.org/2018/05/a-cartoon-intro-to-dns-ove...

Communitivity 8y ago

I'm interested to see how the implementation performs in practice, but I don't see DNS over HTTPS as better than some of the other solutions out there. Some have been around for a while and are well-tried but failed to gain wide adoption, like DNSSEC. Others are new kids, unproven but with lots of promise on paper, like IPFS service discovery. In no particular order, here are some alternative technologies. As always YMMV and the proof is not just in the technical implementation of the protocol, but also the policies and politics around the adoption. A good chunk of them overlap DNS's goals in what they aim to do, but only partially. * DNSSEC - https://www.icann.org/resources/pages/dnssec-qaa-2014-01-29-en https://www.icann.org/resources/pages/dnssec-qaa-2014-01-29-... Various Distributed Hash Table (DHT) based approaches: * IPNS - https://medium.com/@yaniv_g/hosting-websites-on-ipfs-with-ipns-b94659c42b52 https://medium.com/@yaniv_g/hosting-websites-on-ipfs-with-ip... * Telehash - http://telehash.org/ http://telehash.org/ Various cryptocurrency approaches: * Namecoin - https://bit.namecoin.org/ https://bit.namecoin.org/ * DomainToken - http://www.domaintoken.io/ http://www.domaintoken.io/ * Steemit - https://steemit.com/ https://steemit.com/ If you know of others, please comment with the name and a link.

georgyo 8y ago
Ipns lookups take over a minute: https://github.com/ipfs/go-ipfs/issues/3860 https://github.com/ipfs/go-ipfs/issues/3860 Dnssec is just as vulnerable to mitm attacks, because you just strip the dnssec responses and the client has no way to know if it the resolver just doesn't support DNSSEC The crypto ones don't even warrant a response, they are non compatible with anything that happens today.
- phicoh 8y ago
  The reason DNSSEC is vulnerable to that kind of MITM attack is because browsers refuse to do client side validation. For privacy reasons, DNS over TLS and DNS over HTTPS are still a good idea. So even with DNSSEC you would need one of those.
  - tptacek 8y ago
    Browsers tried to do DNSSEC validation. It didn't work. DNSSEC features in Chrome, OS X, and Firefox were rolled back. Also: it is part of the architecture of DNSSEC for clients not to do full validation, which requires that they act as their own recursive resolvers and eliminates shared caches.

e12e 8y ago

> GET https://dns.google.com/experimental?ct&dns=AAABAAABAAAAAAAAB2V4YW1wbGUDY29tAACAAE https://dns.google.com/experimental?ct&dns=AAABAAABAAAAAAAAB... HTTP/2.0” I guess the stuff in the dns=bit is a query to look up the ip of dns.google.com? ;) I'm not sure if I think trusting certs for ip addresses (as opposed to domain names) is a great idea. And how else would this bootstrap?

XparentX 8y ago

Many of us that use local DNS (pi-hole and similar technology), this is not an option. On the other hand, I feel more secure with my local ISP than with mega ad-corporation like Google. I think that DNS over HTTPS is loved by the ad-community. No local DNS that can disturb or block user generated data. Don’t get fooled people. #DeleteGoogle

ac29 8y ago
There's no reason you can't use DNS over HTTPS and pi-hole, just use dnscrypt-proxy, and point your pi-hole at that: https://github.com/jedisct1/dnscrypt-proxy https://github.com/jedisct1/dnscrypt-proxy
- XparentX 8y ago
  Thanks for tip! Will look into it.
krylon 8y ago
As I just learned a few minutes ago, you can run your own DNS over HTTPS server. Then you do not need to trust either Google or your ISP.
- mike-cardwell 8y ago
  Just another thing that you need to remember to configure on each of the applications that don't use the system resolver, on each of your systems. I guess for me that equates to Firefox on 3 systems. Although I have three separate Firefox profiles, so I guess that's 9 times it needs configuring. And at some point 3 copies of Chrome, and another 3 Chromiums I guess. And then whatever other apps decide they want their own custom name resolution. That's assuming I'm actively notified that they have been changed to work that way, and assuming I remember to do it after each install. Because by the sound of it, without remembering to configure my systems, I'm going to end up in a situation where I'm now shipping off a list of all the websites I visit to some American corp for safe keeping, by default. Along with everyone else in the World. I can't even sit here in the UK, visiting a UK website, without asking an American corp for the IP. At least today, I'm asking my ISP for the IP. A company based in my legal jurisdiction, with whom I have a business relationship. [edit] I forgot Firefox on my phone too. Thankfully I don't have a tablet.

akerro 8y ago

Can I use it with OpenNIC resolvers? https://github.com/DNSCrypt/dnscrypt-resolvers/blob/master/v2/public-resolvers.md https://github.com/DNSCrypt/dnscrypt-resolvers/blob/master/v...

js2 8y ago

I installed doh-client from https://github.com/m13253/dns-over-https https://github.com/m13253/dns-over-https onto my EdgeOS router, then pointed dnsmasq at doh-client and, well, it works and I have nothing else exciting to report. One less thing for AT&T to snoop.