4 ms·

"everything else over DoH" I have local DNS servers set to resolve both our intranet and all external queries. Some external queries are blocked for various r

"everything else over DoH" I have local DNS servers set to resolve both our intranet and all external queries. Some external queries are blocked for various reason. Either a browser uses the local network settings or it gets banned from the network. This is not a discussion because the real world intrudes on what browser vendors think is best.

zamadatix 8y ago
Implicit proxying and inspection has always been a farce when it comes to "locking down clients". If you want to control traffic to clients you operate you should do it as an explicit proxy. If you want to control traffic to clients you don't operate it's not actually possible to both respect the client and inspect the traffic enough to meet security goals. This tradeoff has always been true but everyone settled on the "good enough" that means security isn't actually strong, clients aren't actually treated as internal or external, and protocols are ossified because the FW expects wxyz to implement the above two failures.
- protomyth 8y ago
  We don't want Google or Mozilla to have a running list of our users DNS requests. We don't want Google or Mozilla to have a list of our internal servers. They are browsers and can use the same network stack as any other program. I have other types of filtering, but the whole idea of a browser ignoring internal services is going to get it banned.
  - dagenix 8y ago
    It sounds like you will have to ban all browsers on whatever network you manage.
    - protomyth 8y ago
      Why would I have to ban all browsers? Why would anyone accept Google or Mozilla knowing all the sites they visit?
  - zamadatix 8y ago
    This set of concerns has little to do with DoH, Chrome has been doing a hell of a lot more user tracking than which DNS lookups were made for longer than DoH has been around.
    - protomyth 8y ago
      Just because they do other user tracking, doesn't mean I want DoH to add to the list.
- xg15 8y ago
  Ok, so suppose I have a non-rooted Android phone or iPhone. Also suppose, they go all-in with DoH, without any override option. The user doesn't control the client, because it's locked down. The admin doesn't control the client, because DoH is tamper-resistant. Who exactly does control it?
  - zamadatix 8y ago
    If it's your devices: You. Get an MDM, stop letting users install apps that ignore the device proxy settings (or install their own apps in general). If it's not your device: Them. It's their device, you aren't (and shouldn't be able to) control their traffic.
    - xg15 8y ago
      Yeah, but the owners of those devices can't control the traffic either.
      - zamadatix 8y ago
        I'm not sure what exactly you mean here, why can't a user control their own traffic and what does it have to do with DoH or it's impact on existing security implementations in businesses?
        xg15 8y ago
        Because, if they use a non-rooted phone or device, a part of traffic will come from system apps or the OS itself that the user has no control over. Before, this traffic could be blocked by intercepting DNS - now, there wouldn't be a way to do it at all.
        zamadatix 8y ago
        Firstly you still can, add a root certificate and continue using VPN/explicit proxy. Secondly, again none of this has anything to do with DoH. Users still set the system DoH/DoT DNS server the same as they always set the system DNS server and assumed system apps/installed apps weren't using custom sockets/transports/encoding to get around it. Users still control the browser feature enablement and can change destination server. Finally back to the original point - "malicious use doesn't follow the rulebook". System apps have always had the right to make an HTTPS connection to an IP address. Users have always had the right to make an HTTPS connection to an IP address. JavaScript from an ad has always had the right to make an HTTPS connection to an IP address. The user never had any control of this unless they were using an explicit proxy or intercepting traffic with a cert structure. The only thing users/enterprises following the "let me look at udp 53" mantra have had is the illusion of security and control. DoH changes none of this and is irrelevant to it, DoH is just a standard serialization of something anyone has been able to do for decades now. What DoH DOES do is prevent every random node inbetween a device and the DNS server from inspecting/modifying the traffic unless the end station is explicitly configured to allow it.
pmoriarty 8y ago
"Either a browser uses the local network settings or it gets banned from the network." How would you detect that a browser isn't using the local network settings?
- protomyth 8y ago
  In this case, when we are testing the initial setup before we create our images, we would see a bunch of traffic we didn't expect or we read articles that tell us our preferred browser is doing something we find unacceptable. Its not like most enterprise / educational institutions don't test their staff setups.
- dsl 8y ago
  You require all Internet access to traverse a proxy server, the hostname of which only resolves internally.

zamadatix 8y ago

Implicit proxying and inspection has always been a farce when it comes to "locking down clients". If you want to control traffic to clients you operate you should do it as an explicit proxy. If you want to control traffic to clients you don't operate it's not actually possible to both respect the client and inspect the traffic enough to meet security goals. This tradeoff has always been true but everyone settled on the "good enough" that means security isn't actually strong, clients aren't actually treated as internal or external, and protocols are ossified because the FW expects wxyz to implement the above two failures.

protomyth 8y ago
We don't want Google or Mozilla to have a running list of our users DNS requests. We don't want Google or Mozilla to have a list of our internal servers. They are browsers and can use the same network stack as any other program. I have other types of filtering, but the whole idea of a browser ignoring internal services is going to get it banned.
- dagenix 8y ago
  It sounds like you will have to ban all browsers on whatever network you manage.
  - protomyth 8y ago
    Why would I have to ban all browsers? Why would anyone accept Google or Mozilla knowing all the sites they visit?
- zamadatix 8y ago
  This set of concerns has little to do with DoH, Chrome has been doing a hell of a lot more user tracking than which DNS lookups were made for longer than DoH has been around.
  - protomyth 8y ago
    Just because they do other user tracking, doesn't mean I want DoH to add to the list.
xg15 8y ago
Ok, so suppose I have a non-rooted Android phone or iPhone. Also suppose, they go all-in with DoH, without any override option. The user doesn't control the client, because it's locked down. The admin doesn't control the client, because DoH is tamper-resistant. Who exactly does control it?
- zamadatix 8y ago
  If it's your devices: You. Get an MDM, stop letting users install apps that ignore the device proxy settings (or install their own apps in general). If it's not your device: Them. It's their device, you aren't (and shouldn't be able to) control their traffic.
  - xg15 8y ago
    Yeah, but the owners of those devices can't control the traffic either.
    - zamadatix 8y ago
      I'm not sure what exactly you mean here, why can't a user control their own traffic and what does it have to do with DoH or it's impact on existing security implementations in businesses?
      - xg15 8y ago
        Because, if they use a non-rooted phone or device, a part of traffic will come from system apps or the OS itself that the user has no control over. Before, this traffic could be blocked by intercepting DNS - now, there wouldn't be a way to do it at all.
        zamadatix 8y ago
        Firstly you still can, add a root certificate and continue using VPN/explicit proxy. Secondly, again none of this has anything to do with DoH. Users still set the system DoH/DoT DNS server the same as they always set the system DNS server and assumed system apps/installed apps weren't using custom sockets/transports/encoding to get around it. Users still control the browser feature enablement and can change destination server. Finally back to the original point - "malicious use doesn't follow the rulebook". System apps have always had the right to make an HTTPS connection to an IP address. Users have always had the right to make an HTTPS connection to an IP address. JavaScript from an ad has always had the right to make an HTTPS connection to an IP address. The user never had any control of this unless they were using an explicit proxy or intercepting traffic with a cert structure. The only thing users/enterprises following the "let me look at udp 53" mantra have had is the illusion of security and control. DoH changes none of this and is irrelevant to it, DoH is just a standard serialization of something anyone has been able to do for decades now. What DoH DOES do is prevent every random node inbetween a device and the DNS server from inspecting/modifying the traffic unless the end station is explicitly configured to allow it.

pmoriarty 8y ago

"Either a browser uses the local network settings or it gets banned from the network." How would you detect that a browser isn't using the local network settings?

protomyth 8y ago
In this case, when we are testing the initial setup before we create our images, we would see a bunch of traffic we didn't expect or we read articles that tell us our preferred browser is doing something we find unacceptable. Its not like most enterprise / educational institutions don't test their staff setups.
dsl 8y ago
You require all Internet access to traverse a proxy server, the hostname of which only resolves internally.