5 ms·

I’ve begun to think that differences of opinion on the benefits and/or negatives of DoH come from two different perspectives on what DNS is for. What I perceiv

I’ve begun to think that differences of opinion on the benefits and/or negatives of DoH come from two different perspectives on what DNS is for. What I perceive from the debate is generally that people who dislike DoH tend to perceive it as a network plane protocol, one that is designed for network operations and nothing more (layer 3/4 if you will). Whereas people who tend to want privacy and the other features of DoH, perceive it as an application level concern (layer 7). In this context connectivity and discoverability of services is the aim, and knowing that the information for establishing connections to those services is correct is important to the foundations and guarantees of applications being built to utilize DNS. In the application and services context, you may not even want a single set of recursive resolves or authorities for the system. And the reasons are to help ensure the data is focused on what you need in different contexts. I believe that the network level concerns over DoH are a little disingenuous, and this is because there are many ways to circumvent DNS, DoH isn’t necessary, you don’t even need DNS to establish layer3/4 connections. Fighting over DoH for security that can’t truly be enforced in DNS, seems misguided.

tlrobinson 8y ago
I can think of 3 main use-cases for DNS blocking on a network level: 1. content policies: blocking porn, censorship, etc (already easily circumvented by changing DNS or using a VPN) 2. preventing malware command and control: blocking domains that malware phones home to (already easily circumvented by including their own resolver, etc) 3. preventing malware infection: blocking domains serving malware (you might lump "ads" in this category too, e.x. Pi-hole) IMHO the 3rd is the only use-case worth trying to solve with DNS blocking, because the user isn't actively trying to circumvent it. Applications using their own resolvers do make that difficult to do. It seems like it would be best if operating systems implemented DoH at the system level, including DHCP support, so devices could use the network's DoH resolver which might do malware blocking. Applications like Firefox could fall back to their own DoH resolver if they had a way to detect the system was not using DoH. This would also encourage network operators to support DoH.
- bluejekyll 8y ago
  3 is reasonable. I think you stated that well, "the user isn't actively trying to circumvent it", though I might expand that to include the application isn't actively trying to circumvent it. For passive mitigation of standard browsing as a means of helping protect yourself, yes, but even there, it won't take long for systems to figure out a way to circumvent that.
- josteink 8y ago
  > It seems like it would be best if operating systems implemented DoH at the system level, including DHCP support, so devices could use the network's DoH resolver which might do malware blocking. They already do that. It’s called DNS.
  - tlrobinson 8y ago
    Of course, but it's not encrypted.
- EvanAnderson 8y ago
  Using and embedded resolver or switching to a third-party DNS server, at least within many corporate networks, isn't viable because outbound DNS traffic is allowed only from the "blessed" stub resolvers. That doesn't change scenario 1, however scenarios 2 and 3 are rendered moot.
the8472 8y ago
I want privacy and consider DNS an operational issue. I run my own stub and recursive resolvers in my networks to avoid relying on centralized entities on the system level and don't want random applications to bypass it and funnel even more information to google or cloudflare than they already get anyway. Today it's firefox, tomorrow it's shady phone apps that want to bypass content filters and ping their trackers. DoH gains me nothing since I already tunnel the traffic to my resolver. What I really want is something like dnscurve.
- bluejekyll 8y ago
  What advantages do you see DNSCurve as having over DoT or DoH? (or DNS-over-Quic as that starts rolling out)
  - the8472 8y ago
    Securely contacting the authoritative servers from a recursive resolver under my control instead of relying on some big corporation. Currently DoH or DoT are only used and designed with the goal[0] to secure stub resolver <-> recursive resolver traffic. Someone has to operate that recursive resolver and you have to trust them. So you only shift the problem from having to trust your ISP to having to trust cloudflare/google/etc. Dnscurve is intended to secure the recursive resolver <-> authoritative traffic, which means you don't have to rely on another party to secure your traffic. I guess dns over dtls could in principle fill the same role, albeit with more overhead. [0] https://tools.ietf.org/html/rfc8484#section-1 https://tools.ietf.org/html/rfc8484#section-1
    - bluejekyll 8y ago
      Maybe I'm misunderstanding something, but aren't you talking about running a stub/recursive resolver with DNSCurve? You could do the same with DoT, or DoH. It sounds like DNSCurve might be easier to configure and setup from your perspective?
      - the8472 8y ago
JohnFen 8y ago
> I believe that the network level concerns over DoH are a little disingenuous I disagree. The problem with DoH is that it masquerades DNS lookups as web traffic. Other means of doing DNS lookups, encrypted or not, can be easily determined to be DNS lookups and handled according to the network policies. By disguising the lookups as web traffic, it means that I can no longer leave web traffic alone. I have to MITM HTTPS now. If they were happening on their own ports, I would have less invasive methods available, such as running my own resolver.
- bluejekyll 8y ago
  Can you describe the threat model your trying to account for? The reason I made that statement has to do with the means by which DNS can easily be circumvented and direct encrypted connections used instead. This means using DNS introspection as a means for security doesn't buy you much, DoH just makes that more apparent.
  - JohnFen 8y ago
    The threat model is anything that is trying to phone home without approval. This includes calling command-and-control servers, trackers for ads, data exfiltrators, etc. All of these use domain names to set up the communications, for obvious reasons, so being able to thwart those lookups is of great value. You're right, that all by itself is insufficient, but it's still very important.

tlrobinson 8y ago

I can think of 3 main use-cases for DNS blocking on a network level: 1. content policies: blocking porn, censorship, etc (already easily circumvented by changing DNS or using a VPN) 2. preventing malware command and control: blocking domains that malware phones home to (already easily circumvented by including their own resolver, etc) 3. preventing malware infection: blocking domains serving malware (you might lump "ads" in this category too, e.x. Pi-hole) IMHO the 3rd is the only use-case worth trying to solve with DNS blocking, because the user isn't actively trying to circumvent it. Applications using their own resolvers do make that difficult to do. It seems like it would be best if operating systems implemented DoH at the system level, including DHCP support, so devices could use the network's DoH resolver which might do malware blocking. Applications like Firefox could fall back to their own DoH resolver if they had a way to detect the system was not using DoH. This would also encourage network operators to support DoH.

bluejekyll 8y ago
3 is reasonable. I think you stated that well, "the user isn't actively trying to circumvent it", though I might expand that to include the application isn't actively trying to circumvent it. For passive mitigation of standard browsing as a means of helping protect yourself, yes, but even there, it won't take long for systems to figure out a way to circumvent that.
josteink 8y ago
> It seems like it would be best if operating systems implemented DoH at the system level, including DHCP support, so devices could use the network's DoH resolver which might do malware blocking. They already do that. It’s called DNS.
- tlrobinson 8y ago
  Of course, but it's not encrypted.
EvanAnderson 8y ago
Using and embedded resolver or switching to a third-party DNS server, at least within many corporate networks, isn't viable because outbound DNS traffic is allowed only from the "blessed" stub resolvers. That doesn't change scenario 1, however scenarios 2 and 3 are rendered moot.

the8472 8y ago

I want privacy and consider DNS an operational issue. I run my own stub and recursive resolvers in my networks to avoid relying on centralized entities on the system level and don't want random applications to bypass it and funnel even more information to google or cloudflare than they already get anyway. Today it's firefox, tomorrow it's shady phone apps that want to bypass content filters and ping their trackers. DoH gains me nothing since I already tunnel the traffic to my resolver. What I really want is something like dnscurve.

bluejekyll 8y ago
What advantages do you see DNSCurve as having over DoT or DoH? (or DNS-over-Quic as that starts rolling out)
- the8472 8y ago
  Securely contacting the authoritative servers from a recursive resolver under my control instead of relying on some big corporation. Currently DoH or DoT are only used and designed with the goal[0] to secure stub resolver <-> recursive resolver traffic. Someone has to operate that recursive resolver and you have to trust them. So you only shift the problem from having to trust your ISP to having to trust cloudflare/google/etc. Dnscurve is intended to secure the recursive resolver <-> authoritative traffic, which means you don't have to rely on another party to secure your traffic. I guess dns over dtls could in principle fill the same role, albeit with more overhead. [0] https://tools.ietf.org/html/rfc8484#section-1 https://tools.ietf.org/html/rfc8484#section-1
  - bluejekyll 8y ago
    Maybe I'm misunderstanding something, but aren't you talking about running a stub/recursive resolver with DNSCurve? You could do the same with DoT, or DoH. It sounds like DNSCurve might be easier to configure and setup from your perspective?
    - the8472 8y ago

JohnFen 8y ago

> I believe that the network level concerns over DoH are a little disingenuous I disagree. The problem with DoH is that it masquerades DNS lookups as web traffic. Other means of doing DNS lookups, encrypted or not, can be easily determined to be DNS lookups and handled according to the network policies. By disguising the lookups as web traffic, it means that I can no longer leave web traffic alone. I have to MITM HTTPS now. If they were happening on their own ports, I would have less invasive methods available, such as running my own resolver.

bluejekyll 8y ago
Can you describe the threat model your trying to account for? The reason I made that statement has to do with the means by which DNS can easily be circumvented and direct encrypted connections used instead. This means using DNS introspection as a means for security doesn't buy you much, DoH just makes that more apparent.
- JohnFen 8y ago
  The threat model is anything that is trying to phone home without approval. This includes calling command-and-control servers, trackers for ads, data exfiltrators, etc. All of these use domain names to set up the communications, for obvious reasons, so being able to thwart those lookups is of great value. You're right, that all by itself is insufficient, but it's still very important.