4 ms·

Expect more of this once “DNS over HTTPS” takes hold. Nothing Google makes will ever respect your DHCP-server or local network settings ever again.

silon42 8y ago
I guess we'll have to block protocols where DPI doesn't work.
JohnFen 8y ago
> Expect more of this once “DNS over HTTPS” takes hold. I do. DNS-over-HTTPS is why I've modified my network so I can MITM all HTTPS connections.
- josteink 8y ago
  Sounds interesting. Do you have a write up about creating such a setup?
  - JohnFen 8y ago
    No, I don't, but it's conceptually pretty easy (the devil is always in the details). I'm sure you could find something on the net describing this better. What I've done is, first, to block the HTTPS port from going anywhere except to my proxy. If you want to use HTTPS in my network, you have to install my cert. That cert is used to negotiate the HTTPS connection to the proxy. The proxy then has access to the plain-text data stream. If that data stream is a DNS request, then it's diverted to a DNS-over-HTTPS server that I run (which uses my local DNS server to resolve the request). Otherwise, the proxy just transfers the data to and from the destination site using an HTTPS connection from the proxy to the destination.
    - b1r6 8y ago
      This is giving me some good ideas for my homelab... Thank you!
    - LeoPanthera 8y ago
      How do you cope with devices that do not allow the installation of a new CA root? I suspect the answer is "I don't use them", but that's going to be a blocker for mostly everyone.
    - tucif 8y ago
      does this work with apps using certificate pinning?
      - nofunsir 8y ago
        This does break all sorts of apps/workflows, and it's a pain having to let each and every tool (pip/curl/firefox/java/etc...) know about the cert you want it to know about.
    - dragonwriter 8y ago
      > What I've done is, first, to block the HTTPS port from going anywhere except to my proxy. If you want to use HTTPS in my network, you have to install my cert. But there are a very large number of potential HTTPS ports (a reasonably well behaved system could, as well as 443, use anything that isn't well-known or registered, or which was registered for the particular use, even if the underlying protocol was HTTPS.)
- chaz6 8y ago
  (Un)fortunately, TLS 1.3 will prevent MITM from working unless you are able to install a trusted root ca cert on the device, which I doubt is possible on Chromecast devices.
  - userbinator 8y ago
    TLS and SSL before it has always prevented MITM from working without configuring your own certificates --- that's the whole point of the security it provides, after all. AFAIK TLS 1.3 doesn't change that.

silon42 8y ago

I guess we'll have to block protocols where DPI doesn't work.

JohnFen 8y ago

> Expect more of this once “DNS over HTTPS” takes hold. I do. DNS-over-HTTPS is why I've modified my network so I can MITM all HTTPS connections.

josteink 8y ago
Sounds interesting. Do you have a write up about creating such a setup?
- JohnFen 8y ago
  No, I don't, but it's conceptually pretty easy (the devil is always in the details). I'm sure you could find something on the net describing this better. What I've done is, first, to block the HTTPS port from going anywhere except to my proxy. If you want to use HTTPS in my network, you have to install my cert. That cert is used to negotiate the HTTPS connection to the proxy. The proxy then has access to the plain-text data stream. If that data stream is a DNS request, then it's diverted to a DNS-over-HTTPS server that I run (which uses my local DNS server to resolve the request). Otherwise, the proxy just transfers the data to and from the destination site using an HTTPS connection from the proxy to the destination.
  - b1r6 8y ago
    This is giving me some good ideas for my homelab... Thank you!
  - LeoPanthera 8y ago
    How do you cope with devices that do not allow the installation of a new CA root? I suspect the answer is "I don't use them", but that's going to be a blocker for mostly everyone.
  - tucif 8y ago
    does this work with apps using certificate pinning?
    - nofunsir 8y ago
      This does break all sorts of apps/workflows, and it's a pain having to let each and every tool (pip/curl/firefox/java/etc...) know about the cert you want it to know about.
  - dragonwriter 8y ago
    > What I've done is, first, to block the HTTPS port from going anywhere except to my proxy. If you want to use HTTPS in my network, you have to install my cert. But there are a very large number of potential HTTPS ports (a reasonably well behaved system could, as well as 443, use anything that isn't well-known or registered, or which was registered for the particular use, even if the underlying protocol was HTTPS.)
chaz6 8y ago
(Un)fortunately, TLS 1.3 will prevent MITM from working unless you are able to install a trusted root ca cert on the device, which I doubt is possible on Chromecast devices.
- userbinator 8y ago
  TLS and SSL before it has always prevented MITM from working without configuring your own certificates --- that's the whole point of the security it provides, after all. AFAIK TLS 1.3 doesn't change that.