4 ms·

What's the point of confidentiality for DNS? Can't an attacker pretty easily get IP-to-DNS mappings to discover who you're talking to? I guess not in the case o

What's the point of confidentiality for DNS? Can't an attacker pretty easily get IP-to-DNS mappings to discover who you're talking to? I guess not in the case of VPNs/TOR?

kromem 8y ago
Not in the case of Tor, but also not in the case of almost all/most cloud hosted services. For example, consider that Cloudflare proxies about 10% of the Internet. Well, if you request a site they proxy, and DNS is in the clear, it's obvious who you are connecting to. But if you request a site and the DNS is encrypted, you could be visiting any one of 10% of the sites out there. Similarly, if hosting on AWS or Google Cloud platform, there's a LOT of other services hosted in those IP blocks, and IPs change frequently, so there's a significant degree of ambiguity. This is all in addition to fixing the threat of DNS leakage for VPN/Tor connections.
- dagenix 8y ago
  ... except that SNI isn't encrypted.
  - kromem 8y ago
    Good point - I totally forgot about that. So yeah - it mostly only matters for VPN/Tor traffic.
  - deleted 8y ago
    [deleted]
  - computerfriend 8y ago
    Not yet, but encrypted SNI is on the way.
- auslander 8y ago
  > Cloudflare proxies about 10% of the Internet ... and strips SSL off on their side, so 10% of internet is, in fact, MITMed.
  - ownagefool 8y ago
    Be fair, this is configurable. So only 9.9% of the internet is probably MITMable. (:
    - auslander 8y ago
      What is configurable, apart from not using CF?
      - tialaramex 8y ago
        CloudFlare's customers can choose whether the backhaul, between CloudFlare and their own web servers, is HTTP, HTTPS with a CloudFlare issued private certicate, or HTTPS using publicly trusted certs from the Web PKI. If you choose either of the latter two options, bad guys can't MITM you, the middle option has the benefit that they can't even MITM you by subverting a public CA (since only CloudFlare's own certs are trusted) the latter option has the benefit that you can "just" switch off CloudFlare and your site now works as an ordinary HTTPS site with no changes, if you ever want to do that.
        auslander 8y ago
        In all those options, CF still terminates (strips) SSL from user traffic to plaintext, on their platform, hence MITM by Cloudflare.
        detaro 8y ago
        And other large parts of the internet are "MITMed" by AWS, Heroku, Microsoft Azure or other hosting companies then. For some reason people don't make the same argument in every thread about AWS though.
        gsich 8y ago
        Is Cloudflare a hosting company?
nykolasz 8y ago
DNS hijacking is real and very annoying. The main benefit of these protocols is in the integrity of the DNS resolution data. It allows you to use any DNS server you want, without having your ISP modifying their responses. Here is my story why I tried dnscrypt: https://medium.com/@nykolas.z/ending-dns-hijacking-with-dnscrypt-1679e78b2c92 https://medium.com/@nykolas.z/ending-dns-hijacking-with-dnsc...

What's the point of confidentiality for DNS? Can't an attacker pretty easily get IP-to-DNS mappings to discover who you're talking to? I guess not in the case of VPNs/TOR?

kromem 8y ago

Not in the case of Tor, but also not in the case of almost all/most cloud hosted services. For example, consider that Cloudflare proxies about 10% of the Internet. Well, if you request a site they proxy, and DNS is in the clear, it's obvious who you are connecting to. But if you request a site and the DNS is encrypted, you could be visiting any one of 10% of the sites out there. Similarly, if hosting on AWS or Google Cloud platform, there's a LOT of other services hosted in those IP blocks, and IPs change frequently, so there's a significant degree of ambiguity. This is all in addition to fixing the threat of DNS leakage for VPN/Tor connections.

dagenix 8y ago
... except that SNI isn't encrypted.
- kromem 8y ago
  Good point - I totally forgot about that. So yeah - it mostly only matters for VPN/Tor traffic.
- deleted 8y ago
  [deleted]
- computerfriend 8y ago
  Not yet, but encrypted SNI is on the way.
auslander 8y ago
> Cloudflare proxies about 10% of the Internet ... and strips SSL off on their side, so 10% of internet is, in fact, MITMed.
- ownagefool 8y ago
  Be fair, this is configurable. So only 9.9% of the internet is probably MITMable. (:
  - auslander 8y ago
    What is configurable, apart from not using CF?
    - tialaramex 8y ago
      CloudFlare's customers can choose whether the backhaul, between CloudFlare and their own web servers, is HTTP, HTTPS with a CloudFlare issued private certicate, or HTTPS using publicly trusted certs from the Web PKI. If you choose either of the latter two options, bad guys can't MITM you, the middle option has the benefit that they can't even MITM you by subverting a public CA (since only CloudFlare's own certs are trusted) the latter option has the benefit that you can "just" switch off CloudFlare and your site now works as an ordinary HTTPS site with no changes, if you ever want to do that.
      - auslander 8y ago
        In all those options, CF still terminates (strips) SSL from user traffic to plaintext, on their platform, hence MITM by Cloudflare.
        detaro 8y ago
        And other large parts of the internet are "MITMed" by AWS, Heroku, Microsoft Azure or other hosting companies then. For some reason people don't make the same argument in every thread about AWS though.
        gsich 8y ago
        Is Cloudflare a hosting company?

nykolasz 8y ago

DNS hijacking is real and very annoying. The main benefit of these protocols is in the integrity of the DNS resolution data. It allows you to use any DNS server you want, without having your ISP modifying their responses. Here is my story why I tried dnscrypt: https://medium.com/@nykolas.z/ending-dns-hijacking-with-dnscrypt-1679e78b2c92 https://medium.com/@nykolas.z/ending-dns-hijacking-with-dnsc...