10 ms·

I hadn't been paying much attention to DNS-over-HTTPS, but I recently listened to a talk that Dr. Paul Vixie (of BIND fame) gave that where DNS-over-HTTPS was d

I hadn't been paying much attention to DNS-over-HTTPS, but I recently listened to a talk that Dr. Paul Vixie (of BIND fame) gave that where DNS-over-HTTPS was discussed: https://youtu.be/OxFFTxJv1L4?t=2799 https://youtu.be/OxFFTxJv1L4?t=2799 After hearing Dr. Vixie discuss DNS-over-HTTPS from a network operator perspective I'm a lot more wary of the protocol.

josteink 8y ago
After seeing every implementation of DoH giving a flying fuck about your actual network settings, I’ve decided it’s a technology I want nothing to do with. I’ve actually actively blocked DoH for the major providers on my router, by writing some custom iptables rules. Hopefully there will be a simple to use OpenWrt-package which you can install to do this automatically in the future.
- mike-cardwell 8y ago
  Could you share those iptables rules please?
  - topranks 8y ago
    The real difficulty as time goes on is to update the list.
  - josteink 8y ago
    I'll have to correct myself. It seems I gave up on the iptables-approach due to having some correctness errors. Instead I ended up with these lines in /etc/config/firewall: config rule option target 'ACCEPT' option name 'Allow router to perform DNS' option family 'ipv4' option src_ip '192.168.1.1' option dest_port '53' option src '*' option dest '*' config rule option src 'lan' option name 'Disallow Google DNS from LAN' option family 'ipv4' option dest_ip '8.8.8.8' option target 'REJECT' option dest 'wan' config rule option src 'lan' option name 'Disallow Google DNS from LAN (2)' option dest 'wan' option family 'ipv4' option dest_ip '8.8.4.4' option target 'REJECT' config rule option src 'lan' option name 'Disallow Cloudflare DOH from LAN' option dest_ip '1.1.1.1' option dest_port '443' option target 'REJECT' option proto 'tcp' option family 'ipv4' option dest 'wan' config rule option src 'lan' option name 'Disallow Cloudflare DOH from LAN (2)' option proto 'tcp' option dest 'wan' option dest_ip '1.0.0.1' option dest_port '443' option family 'ipv4' option target 'REJECT' config rule option src 'lan' option name 'Disallow Cloudflare DOH from LAN (3)' option dest_ip '104.16.249.249' option family 'ipv4' option dest 'wan' option target 'REJECT' Pretty much as basic as you'd think. Router itself acts as a DNS-server via dnsmasq, and is allowed to do anything I decide I want. On my network I have a pi-hole instance which then forwards queries to the router, so it also intercepts/looks up local LAN names correctly. All clients on the network are provided the pi-hole as the canonical DNS-server to use via DHCP options. Works for me.
flarex 8y ago
His main argument seems to be that the network operator should have control over DNS requests for safety reasons. Control and monitoring. This is the antithesis of privacy and encryption. I wouldn't be surprised if he was pro http over https either.
- DaniloDias 8y ago
  If an iot device in your home network is exfiltraring data about you, it becomes much harder to identify with dns over https. Dns over https creates more problems than it solves for 99% of end users.
  - flarex 8y ago
    The argument that because encryption can be used for nefarious purposes it should not be offered by DNS providers at all does not add up. ISPs can block, redirect and sell DNS traffic and many are already doing some or all of these.
    - JohnFen 8y ago
      I don't think anybody is arguing that DNS lookups shouldn't be encrypted. The issue is doing DNS lookups via HTTPS.
      - DaniloDias 8y ago
        I’m specifically arguing that dns lookups should not be encrypted. Dns can be descriptive: ntp.example.com sounds like an Ntp server. Oh- this pcap shows an ntp flow afterwards. Probably synchronizing time. Oh- adnetwork.example.com. Probably serving up ads. Oh Agrrvxdrgkndzzzvbbhydsxxjjj.net.org.com. Probably botnet related. Vs I need to look at every protocol flow and sort by IP? Who in their right mind blindly trusts all computers like this? If you ever want to troubleshoot your network, your job becomes way more tedious if dns requests are encrypted.
- cremp 8y ago
  Because they should! Think a corporate network. If I as a sysadmin set our DHCP options to give out our own resolvers, I expect that every machine on the domain to use ours. DoH breaks that completely; and hence the network operator should have the final say. As a sysadmin myself, if browsers are overriding the basic model of top down, and it hurts me, because when something is wrong, I cant just look on my machine, I have to check which browser they use... that is the antithesis of the problem, because when DoH doesn't work but normal DNS does, then I'm flat out of options. This is why I choose not to use Firefox or any of the DoH mainline providers (Cloudflare,) and I go out of my way to make sure users cant do it.
move-on-by 8y ago
Without a doubt, DNS-over-HTTPS introduces some major concerns from a network operator and security perspective. But I'm also very privacy focused, and am conflicted on the issue. >[Mozilla] believe that they need to build technology that will accommodate a hostile network operator who is going to replace your DNS with things pointing to their advertising servers or is going to monitor what you do and send it off to some human rights violation team somewhere and so rather than tell you to use VPNs or tell you to use tor they decided to build DNS into the web Requiring the average Joe to use a VPN service just so they can have some reasonable attempt at privacy isn't really an option, as we have seen. Privacy shouldn't be a luxury reserved only for those who can afford it. What I would really like to see is our lawmakers step up and make modern privacy laws with respect to technology and the data that results of it, but that clearly isn't happening. Unfortunately, DNS-over-HTTPS will very likely be used against the consumer in the long-run. Instead of using a pi-hole with port 53 blocked, I can see many devices will start using DNS-over-HTTPS to bypass those restrictions. Chromecast, rokus, and other devices already have hard-coded DNS addresses built-in, it won't be a very large step for them to switch to DNS-over-HTTPS to bypass my own network policies.
- roca 8y ago
  The thing is, those devices are going to do that even if Mozilla drops DoH, the RFCs are burned and everyone responsible shot. So the options are: * Make DoH illegal somehow * Take advantage of it as best we can
majke 8y ago
(full disclosure: I'm affiliated to Cloudflare, but opinions here are my own of course) Thanks for posting this. I knew Paul is against DoH, but never understood his specific arguments. He has great comment about DoT (dns over TLS) couple of minutes before the linked youtube (I agree with him on that). Personally I'm not an "owner" of the networks I'm connecting to. My home router is managed by my ISP, I don't run pi-hole. Network at work is managed by yet-someone-else. I often use my mobile carrier (LTE tethering), and often use WiFi at coffee shops. For all of these cases I would prefer to not expose my DNS traffic. Heck, I'm 100% sure that my dns traffic today is being re-sold! I have couple of unique domain names that I have open in my browser which have unique and non-guessable DNS names, which are crawled by some bots today. Even though I never shared them in any way with anyone! The only way they could be exposed for crawling is by my DNS provider leaking the DNS traffic to some shady third-party. Many DNS people are opposed DoH, but I think this train has passed. As a user of the internet I really do want encrypt everything these days. https://tools.ietf.org/html/rfc8404 https://tools.ietf.org/html/rfc8404 If my corporate boss, or my ISP can mine less data about the malware I'm running - so be it. For me this is an acceptable cost of measurably improved privacy.
- zzzcpan 8y ago
  Your ISP doesn't really need DNS traffic to know things about you, IP addresses alone leak a lot of information, add to that SNI, response sizes, active probing, clear text traffic, etc. and you should realize that the only thing DoH does is letting one extra party to know what you are doing in addition to your ISP. DoH is net negative for privacy. You need at least a VPN to get to net positive, so that your ISP can't get that much data.
  - wbl 8y ago
    How is DoH a net negative? ESNI is coming soon. Also ISPs do all sorts of other badness with DNS like NXDOMAIN interception.
    - zzzcpan 8y ago
      If you can't trust your ISP, leaking all of your DNS traffic to another party still doesn't let you trust your ISP, but now you have to trust that other party too, hence net negative. To avoid trusting your ISP you need at least a VPN.

josteink 8y ago

After seeing every implementation of DoH giving a flying fuck about your actual network settings, I’ve decided it’s a technology I want nothing to do with. I’ve actually actively blocked DoH for the major providers on my router, by writing some custom iptables rules. Hopefully there will be a simple to use OpenWrt-package which you can install to do this automatically in the future.

mike-cardwell 8y ago
Could you share those iptables rules please?
- topranks 8y ago
  The real difficulty as time goes on is to update the list.
- josteink 8y ago
  I'll have to correct myself. It seems I gave up on the iptables-approach due to having some correctness errors. Instead I ended up with these lines in /etc/config/firewall: config rule option target 'ACCEPT' option name 'Allow router to perform DNS' option family 'ipv4' option src_ip '192.168.1.1' option dest_port '53' option src '*' option dest '*' config rule option src 'lan' option name 'Disallow Google DNS from LAN' option family 'ipv4' option dest_ip '8.8.8.8' option target 'REJECT' option dest 'wan' config rule option src 'lan' option name 'Disallow Google DNS from LAN (2)' option dest 'wan' option family 'ipv4' option dest_ip '8.8.4.4' option target 'REJECT' config rule option src 'lan' option name 'Disallow Cloudflare DOH from LAN' option dest_ip '1.1.1.1' option dest_port '443' option target 'REJECT' option proto 'tcp' option family 'ipv4' option dest 'wan' config rule option src 'lan' option name 'Disallow Cloudflare DOH from LAN (2)' option proto 'tcp' option dest 'wan' option dest_ip '1.0.0.1' option dest_port '443' option family 'ipv4' option target 'REJECT' config rule option src 'lan' option name 'Disallow Cloudflare DOH from LAN (3)' option dest_ip '104.16.249.249' option family 'ipv4' option dest 'wan' option target 'REJECT' Pretty much as basic as you'd think. Router itself acts as a DNS-server via dnsmasq, and is allowed to do anything I decide I want. On my network I have a pi-hole instance which then forwards queries to the router, so it also intercepts/looks up local LAN names correctly. All clients on the network are provided the pi-hole as the canonical DNS-server to use via DHCP options. Works for me.

flarex 8y ago

His main argument seems to be that the network operator should have control over DNS requests for safety reasons. Control and monitoring. This is the antithesis of privacy and encryption. I wouldn't be surprised if he was pro http over https either.

DaniloDias 8y ago
If an iot device in your home network is exfiltraring data about you, it becomes much harder to identify with dns over https. Dns over https creates more problems than it solves for 99% of end users.
- flarex 8y ago
  The argument that because encryption can be used for nefarious purposes it should not be offered by DNS providers at all does not add up. ISPs can block, redirect and sell DNS traffic and many are already doing some or all of these.
  - JohnFen 8y ago
    I don't think anybody is arguing that DNS lookups shouldn't be encrypted. The issue is doing DNS lookups via HTTPS.
    - DaniloDias 8y ago
      I’m specifically arguing that dns lookups should not be encrypted. Dns can be descriptive: ntp.example.com sounds like an Ntp server. Oh- this pcap shows an ntp flow afterwards. Probably synchronizing time. Oh- adnetwork.example.com. Probably serving up ads. Oh Agrrvxdrgkndzzzvbbhydsxxjjj.net.org.com. Probably botnet related. Vs I need to look at every protocol flow and sort by IP? Who in their right mind blindly trusts all computers like this? If you ever want to troubleshoot your network, your job becomes way more tedious if dns requests are encrypted.
cremp 8y ago
Because they should! Think a corporate network. If I as a sysadmin set our DHCP options to give out our own resolvers, I expect that every machine on the domain to use ours. DoH breaks that completely; and hence the network operator should have the final say. As a sysadmin myself, if browsers are overriding the basic model of top down, and it hurts me, because when something is wrong, I cant just look on my machine, I have to check which browser they use... that is the antithesis of the problem, because when DoH doesn't work but normal DNS does, then I'm flat out of options. This is why I choose not to use Firefox or any of the DoH mainline providers (Cloudflare,) and I go out of my way to make sure users cant do it.

move-on-by 8y ago

Without a doubt, DNS-over-HTTPS introduces some major concerns from a network operator and security perspective. But I'm also very privacy focused, and am conflicted on the issue. >[Mozilla] believe that they need to build technology that will accommodate a hostile network operator who is going to replace your DNS with things pointing to their advertising servers or is going to monitor what you do and send it off to some human rights violation team somewhere and so rather than tell you to use VPNs or tell you to use tor they decided to build DNS into the web Requiring the average Joe to use a VPN service just so they can have some reasonable attempt at privacy isn't really an option, as we have seen. Privacy shouldn't be a luxury reserved only for those who can afford it. What I would really like to see is our lawmakers step up and make modern privacy laws with respect to technology and the data that results of it, but that clearly isn't happening. Unfortunately, DNS-over-HTTPS will very likely be used against the consumer in the long-run. Instead of using a pi-hole with port 53 blocked, I can see many devices will start using DNS-over-HTTPS to bypass those restrictions. Chromecast, rokus, and other devices already have hard-coded DNS addresses built-in, it won't be a very large step for them to switch to DNS-over-HTTPS to bypass my own network policies.

roca 8y ago
The thing is, those devices are going to do that even if Mozilla drops DoH, the RFCs are burned and everyone responsible shot. So the options are: * Make DoH illegal somehow * Take advantage of it as best we can

majke 8y ago

(full disclosure: I'm affiliated to Cloudflare, but opinions here are my own of course) Thanks for posting this. I knew Paul is against DoH, but never understood his specific arguments. He has great comment about DoT (dns over TLS) couple of minutes before the linked youtube (I agree with him on that). Personally I'm not an "owner" of the networks I'm connecting to. My home router is managed by my ISP, I don't run pi-hole. Network at work is managed by yet-someone-else. I often use my mobile carrier (LTE tethering), and often use WiFi at coffee shops. For all of these cases I would prefer to not expose my DNS traffic. Heck, I'm 100% sure that my dns traffic today is being re-sold! I have couple of unique domain names that I have open in my browser which have unique and non-guessable DNS names, which are crawled by some bots today. Even though I never shared them in any way with anyone! The only way they could be exposed for crawling is by my DNS provider leaking the DNS traffic to some shady third-party. Many DNS people are opposed DoH, but I think this train has passed. As a user of the internet I really do want encrypt everything these days. https://tools.ietf.org/html/rfc8404 https://tools.ietf.org/html/rfc8404 If my corporate boss, or my ISP can mine less data about the malware I'm running - so be it. For me this is an acceptable cost of measurably improved privacy.

zzzcpan 8y ago
Your ISP doesn't really need DNS traffic to know things about you, IP addresses alone leak a lot of information, add to that SNI, response sizes, active probing, clear text traffic, etc. and you should realize that the only thing DoH does is letting one extra party to know what you are doing in addition to your ISP. DoH is net negative for privacy. You need at least a VPN to get to net positive, so that your ISP can't get that much data.
- wbl 8y ago
  How is DoH a net negative? ESNI is coming soon. Also ISPs do all sorts of other badness with DNS like NXDOMAIN interception.
  - zzzcpan 8y ago
    If you can't trust your ISP, leaking all of your DNS traffic to another party still doesn't let you trust your ISP, but now you have to trust that other party too, hence net negative. To avoid trusting your ISP you need at least a VPN.