6 ms·

UK Politicians Disapprove of DNS over HTTPS (DoH)

78 points by edward 7y ago

d2mw 7y ago
They can fight it on the basis of censorship, and I'll support them on the basis of a decentralized Internet that does not rely on some folk who leaked private data all over the Internet a few years ago. Fuck DoH. It's political and technical centralization under the tired old banner of "freedom!" when reality is absolutely the opposite. It'll be abused in a heartbeat the moment it has majority share, assuming folk like CloudFlare don't already have people working full time on how to profit from the data, or formulating policies on which sites they shut down that they never hosted in the first place If you're new to this game, it always progresses the same tired old way: - it's optional, you don't need it, but if you use it your life will become 1000% better and starving orphans in China will learn about democracy - we're using it for just this one particular service you might need it for but it's fine because that particular service is totally optional and you have a "choice" between 3 vendors who all accidentally depend on this new thing, because they're all playing the same game - we rolled out a new feature but it's only available to newer clients, you probably genuinely do need this feature, and the choice to avoid the new service seems to be less and less appealing - we don't have people working full time on the older product any more, and it's full of bugs, and we're struggling to support it - we've made some commercial agreement you weren't expecting that interacts somehow with our adjusted position thanks to the new service. somehow you've become the product without any warning, but you're so far down the river it's much less effort to stay put than try to undo becoming the product - we've encountered a bug and made a huge negative PR fuss around the old service. it's officially insecure and you will catch cancer if you continue using it - [3 months later] we're deprecating the old service - [1 year later] captivity achieved
- deleted 7y ago
  [deleted]
- dnsiz 7y ago
  I hate CloudFlare as much as the next guy but you can change the DoH server, can't you? I hope Firefox will expose the option in the interface and not in about:config. But we all know how Mozilla are...
  - d2mw 7y ago
    you appear to have jumped to step 2 in the masterplan, and completely skipped step 1. It's not even mandatory yet, but when it is, the choice will be between N<10 providers, most of them almost certainly American companies
    - ancarda 7y ago
      Why would DoH become mandatory?
      - d2mw 7y ago
        I can't see into the future, unfortunately, but you're welcome to bookmark the parent comment and set a calendar entry to compare it with reality about once every 6 months. It's possible to speculate, though. Google have been engaged in open war against ISPs for most of the past 10 years, it is in their every interest to commoditize the pipe between the consumer and the datacentre as far as possible. Removing DNS from the link is eliminating another source of risk For Mozilla, I'm not sure, but they often follow Google's lead, and there is a strong case for Google to go that route In any case if it ever starts defaulting to on in any browser, it's very likely the others will follow suit, as it's easy to imagine quite a lot of PR around the security benefits of the brave new world
- ripdog 7y ago
  There are FOSS DoH servers, and you're welcome to run your own, with a free cert from Let's Encrypt. You could easily run a logging-free DoH server for anyone to use, also. There's no lock-in here, and I can't see any way that lock-in could be introduced later, either.
  - d2mw 7y ago
    Society is only one Android release away from most consumer traffic metadata being tunnelled by default through a new instrument of political policy, thanks to a company who not so long ago wouldn't even let you select which _search engine_ you used. Do you really suppose the same company will start adding URL input boxes to their initial setup screen? If they even put such a text box in the settings, what percentage of users would actually customize it? So the effect is not just the local mobile telco's DNS would be subverted, but every mobile telco's DNS, and if you tried to explain what's happening to the typical person it impacted, they'd give you a puzzled look before promptly switching the topic to last night's football game. Thankfully this is a completely fabricated scenario and there is no possibility whatsoever it could even remotely play out. Given this one scenario, what value or weight does a single bearded guy's raspberry pi stashed in a closet have when it comes to worldwide DNS policy? I wonder how resilient a site like The Pirate Bay would be given an environment where DNS filtering is suddenly under the majority control of a tiny handful of companies all under American or western ownership. But DoH of course is about freedom, not about censorship. It's about preventing censorship, right! (Apologies for the style of reply -- these are obviously not genuine questions) edit: these unexplained downvotes are fascinating
    - shkkmo 7y ago
      I suspect there is support for what you are trying to say. However your communication style is unclear (especially the over use of sarcasm and rhetorical questions) and you don't actually try to support any of the points you do make. I don't see it as a positive contribution to the conversation so I down voted you.
- userbinator 7y ago
  "An enemy of an enemy is a friend." As someone who uses HOSTS files and DNS-level blocking/MiTM proxy on my network to control what gets to my endpoints, I like how you think.
  - deleted 7y ago
    [deleted]
binarymax 7y ago
Ah, the good ole “Think of the Children!” propaganda. What a lazy excuse. It’s like they didn’t even try.
- kd3 7y ago
  Exactly
- sneak 7y ago
  The beauty of this plan is its simplicity and effectiveness. You see it time and time again for the simple reason that it is tremendously effective; normal, reasonable people will throw a lot of logical reasoning straight the fuck out the window when it comes to the safety and well-being of their offspring. This is normal and common, and we must learn to effectively counter it, not simply dismiss it, if we are to work against this sort of (again, normal and common and natural) response.
nvahalik 7y ago
There are many technologies which are double-edged swords. Encryption can keep things which need to be kept secret safe. They can also keep things which ought to be made open safe. Anything can and will be abused by people who want to use it to hide what they are doing. That includes criminals. But if every history-changing invention could have been stopped because of the potential of abuse, we'd not be where we are today.
- brokenmachine 7y ago
  The premise that needs to be fought is the suggestion that there can be no such thing as a private conversation.
kd3 7y ago
While DNS over HTTPS has benefits, we should really be looking into distributed or p2p DNS.
- flarex 7y ago
  Ethereum Name Service
- betterunix2 7y ago
  DNS is already distributed...
  - yjftsjthsd-h 7y ago
    Revolvers as used in practice, particularly DoH as in this context, are fairly centralized.
- zzzcpan 7y ago
  While DoH has benefits, the way Mozilla, Cloudflare propose to get it deployed is mostly detrimental to privacy, merely leaking and centralizing everyone's data to another party. Seems like decentralized overlay p2p networks is becoming the only way to ever get privacy on the internet.
pmoriarty 7y ago
If we as people who are actually knowledgeable about technology and who care about privacy are sick of ignorant and scare-mongering politicians turning the world in to a version of 1984, we really have to become more active in politics ourselves.. and by doing more than just voting. You can run for local government, organize, or volunteer, for instance. That will make much greater difference than simply voting or voicing one's displeasure on the internet (though doing both of those can help some too, especially if enough people do so).
TazeTSchnitzel 7y ago
> The deployment of the new encryption system […] could[.[…] expos[e] millions of people to the worst imagery Not really. It is difficult to accidentally encounter these kinds of images because they are so illegal, and for those who are trying, rudimentary ISP DNS blocking is not going to stop them when Tor exists.
dansimau 7y ago
For those who disagree with the position taken in the article: Out of curiosity, what would you do to deal with online child pornography instead?
- smcl 7y ago
  That’s an insane argument that will just be continuously abused to erode privacy until everything you do is under surveillance by the government. Oh you’re against DNS over HTTPS? Oh so you want our children to be abused? You’re for encryption? Sounds like someone doesn’t care about child porn. Oh you won’t share your Password with the government? Hiding something?
- deleted 7y ago
  [deleted]
- zokier 7y ago
  Stop routing traffic to/from ASes that host child pornography. I mean, this is not about some deep darknet stuff or tor hidden services (where DNS filtering would not be effective anyways), so my question is why isn't government able to shut these sites down? And if the sites are hosted on uncooperative ISP then I think dropping the traffic is appropriate response.
- Mountain_Skies 7y ago
  First step would be to stop creating an environment where discussion of the issue can't even happen. Blocking content featuring the sexualization of children from spreading is a good goal but a better goal is to prevent it from being produced in the first place. We need better ways of making that happen, including providing ways for those who are mentally ill and want help overcoming it to get it. It's not an easy problem to combat and there probably will never be a perfect solution but instantly losing all semblance of rational though at the mere mention of the subject isn't helping much.
- AdrianB1 7y ago
  First step: stop using a nuclear warhead to kill a wolf. The only worst thing to do would be to destroy humanity, so child pornography will be permanently dealt with.
johnnyapol 7y ago
The only valid argument I've heard against DNS over HTTPS is that it makes it harder for institutions / companies to block other DNS servers than their own internal ones because they simply can't just drop port 53 traffic anymore. This was brought up to me in the context that many universities enforce their own DNS servers to help block malware from being able to phone home or filter access to malicious IPs in general. I guess in theory, this could still be accomplished by filtering based on IP - a whole other cat and mouse game. Although, it's not like it wasn't a cat-and-mouse game before - you could bypass these blocks by running DNS on non-standard ports unless some form of DPI was being performed.
- teddyh 7y ago
  There are plenty of valid arguments against DoH. If DoH becomes common, it most likely will resemble the situation with DNS resolvers we have today. Meaning, there would be the eternal problems inherent to centralization. I.e. both that the centralizing powers would have enormous power to disappear something off the internet, but also that the central servers would recieve huge amounts of constant real-time data of what everybody was doing.
  - zrm 7y ago
    We need something to encrypt and authenticate DNS, but that exists in DNSCurve. The problem with it is that it doesn't try to hide what it is, so an adversarial middlebox can detect and block it to try to force you to use their own DNS. DoH is an evolutionary response to that, because it looks like HTTPS to Cloudflare, which is difficult to reject. And that's terrible for a lot of reasons (inefficiency, complexity, centralization), but it solves the local interference problem. Which means that's what we're unfortunately going to end up with unless we can solve the interference problem another way, i.e. make intermediaries understand that they're going to lose anyway and it's better to allow unmolested UDP DNS/DNSCurve to the endpoint's choice of recursive resolvers than to have everything using DoH to Cloudflare.
    - teddyh 7y ago
      There are two available courses of action. Option one: We embrace something like DoH in order to avoid any possibility of blocking and detection. But you then have no simple way to back out from centralization if/when centralization (almost certainly, IMHO) slowly becomes a problem. Monopolies and oligopolies are hard to break once formed, and absolute power corrupts absolutely. Option two: We use DNS like always to avoid problems with centralization, and adopt a secure DNS protocol to avoid spoofing and unauthorized monitoring. If we do this latter thing, and detection and blocking does become a problem (and it might), we can always add some additional layer of security, like HTTPS tunneling, on top, which avoids it. We could even, if it became absolutely necessary, centralize after the fact; but this way, we can avoid it until it would become necessary. I would prefer not to centralize things in advance, just in case a certain problem develops. I would instead prefer to keep it de-centralized as long as possible, and solve individual problems as they actually occur. I would also prefer DNSSEC and DoT over DNSCurve, and I would suggest IPsec with opportunistic encryption to be a more pure goal than to tunnel everything over HTTPS, but my preferences in protocols are not important to any of these points, and we don’t need to argue about that.
2T1Qka0rEiPr 7y ago
I'm guessing that almost every user of HN believes the opinion stated in the article is ignorant / stupid / misguided. I also believe that it's ignorant on so many levels, and whilst I particularly take issue with the "think of the children" angle of the article, I find it nevertheless interesting that people do think this way. I've spoken with friends and family members on numerous occasions about basic privacy topics, and they're often met with complete apathy. The "this endangers our children" rhetoric - though misleading - arguably does have some logical foundations. A Government who is able to watch over its citizens could in theory protect them better. It reminds me of the WhatsApp E2E encryption debates in the UK of a few years ago, shortly after the attacks in London. I guess its incumbent on us as technologists, to not merely laugh and scorn at these comments, but to acknowledge that these things have consequences, positive and negative. We need to present the under-represented positives - and at times I find this particularly hard without feeling / coming across as tin-hatted. Edit: Just on that last point - I'd love advice if anyone can provide some :)
- betterunix2 7y ago
  A classic problem with end-to-end encryption backdoors is that most of the time there is no benefit to users or software vendors to offset the cost and risks they must take on to provide law enforcement access. I can think of just one exception, which is identity based encryption, which allows e.g. email addresses to be used as public keys. IBE requires a master secret key that is used to generate the private keys associated with each user's ID, and therefore has an inherent backdoor, but at least the users can benefit from the reduced complexity of key management. For the most part backdoors require some kind of central coordination, so there are situations where it is basically impossible to support one. HTTPS is a good example: anyone can run a web server and there is no permission or coordination needed to do so, and so HTTPS backdoors would be difficult to create (otherwise I cannot run my web server without coordinating with whatever authority controls the backdoor, or I cannot run a secure web server without such coordination). That is what the conversation is really about: whether or not we are willing to sacrifice the most useful and valuable aspects of the Internet's design (distributed, loosely coordinated, no-permission-needed), or do without security and hope for the best, for the sake of a law enforcement backdoor.
- 7y ago
madaxe_again 7y ago
Their own letter undermines the very point they’re trying to make. They say “there 144,000 internet users [ed: from where in the world?] on some of the worst dark-web child sexual abuse sites”. Dark web. Tor. Not impacted by DNS over HTTPS whatsoever.
mnd999 7y ago
That’s sort of a reason to like it, even if the general everything-is-http approach to these problems annoys me.
einarfd 7y ago
It's hard to be worried about any new legislation coming out of a parliament that has been hard at work the last few years, showing that they wouldn't even be able to organise a piss up in a brewery.
exabrial 7y ago
dnscurve never made an impact unfortunately :(
karmakaze 7y ago
This is wrong on so many ways: - DoH is impacts a lot more than one area: child protection - what exactly would be lost? - is the filtering effective? No, anyone so inclined can just use a VPN - is there another way to achieve this even with DoH? Yes: resolve the URL filter hostnames, filter the IPs - faulty logic: we do X *with the intention* to stop bad Y, so don't do Z that hinders X The issue here isn't really about DoH--it's whether the government can unilaterally decide that freedom of communicating privately is not a right. Now let's see what's right(?) about this? - good political move to back something emotional people can agree with vs. something technical that most don't put in effort to understand privacy+tech - government seen as governing: good - sensational news, increases positive awareness/brand I think the last point is key, technology has come up fast and most governments are not up to the task of understanding and making good decisions. The best they can do is try to look like they're doing good and try to maintain some some control in the hopes that it will result in the ability to stay in power. It would be like if a non-technical CEO of a corporation was in charge of all the security policies for their products. Whenever these types of issues come up in the media, there's two concurrent discussions: one who understand the tech and implications and the rest of the population that reacts by proxy signals. Somehow these groups need to be connected without a distortion of the message.
esotericn 7y ago
Well, that's alright. UK disapprove of UK Politicians. Need a source? Course you don't[1]. [1] https://www.ipsos.com/ipsos-mori/en-uk/politicians-remain-least-trusted-profession-britain https://www.ipsos.com/ipsos-mori/en-uk/politicians-remain-le... They can't even bloody solve basic stuff like building houses or you know, that EU thing. DNS over HTTPS is probably down there with encouraging uptake of Klingon.
Jerry888 7y ago
—-------—------------- (~~) !! /\ Rofl politicians are not very well informed the gov already can see all traffic generated in DoH due to a built in flaw that is waiting to be fixed which i have no doubt will be "fixed" with open access built in as normal
lazylizard 7y ago
1. Now if someone says something is broken i look at nsswitch. I dig. 2. If they build this into the browser i hope there's a button for endusers to beg mozilla foundation for help when some web page doesn't load. 3. Personally I'm fine with it. Clourdflared is an acceptable way to roll this together with the rest of name resolution.
- lazylizard 7y ago
  But actually now already people can hide behind socks5. Dns n all. Just that people usually dont use it. Whatever....

78 points by edward 7y ago

d2mw 7y ago

They can fight it on the basis of censorship, and I'll support them on the basis of a decentralized Internet that does not rely on some folk who leaked private data all over the Internet a few years ago. Fuck DoH. It's political and technical centralization under the tired old banner of "freedom!" when reality is absolutely the opposite. It'll be abused in a heartbeat the moment it has majority share, assuming folk like CloudFlare don't already have people working full time on how to profit from the data, or formulating policies on which sites they shut down that they never hosted in the first place If you're new to this game, it always progresses the same tired old way: - it's optional, you don't need it, but if you use it your life will become 1000% better and starving orphans in China will learn about democracy - we're using it for just this one particular service you might need it for but it's fine because that particular service is totally optional and you have a "choice" between 3 vendors who all accidentally depend on this new thing, because they're all playing the same game - we rolled out a new feature but it's only available to newer clients, you probably genuinely do need this feature, and the choice to avoid the new service seems to be less and less appealing - we don't have people working full time on the older product any more, and it's full of bugs, and we're struggling to support it - we've made some commercial agreement you weren't expecting that interacts somehow with our adjusted position thanks to the new service. somehow you've become the product without any warning, but you're so far down the river it's much less effort to stay put than try to undo becoming the product - we've encountered a bug and made a huge negative PR fuss around the old service. it's officially insecure and you will catch cancer if you continue using it - [3 months later] we're deprecating the old service - [1 year later] captivity achieved

deleted 7y ago
[deleted]
dnsiz 7y ago
I hate CloudFlare as much as the next guy but you can change the DoH server, can't you? I hope Firefox will expose the option in the interface and not in about:config. But we all know how Mozilla are...
- d2mw 7y ago
  you appear to have jumped to step 2 in the masterplan, and completely skipped step 1. It's not even mandatory yet, but when it is, the choice will be between N<10 providers, most of them almost certainly American companies
  - ancarda 7y ago
    Why would DoH become mandatory?
    - d2mw 7y ago
      I can't see into the future, unfortunately, but you're welcome to bookmark the parent comment and set a calendar entry to compare it with reality about once every 6 months. It's possible to speculate, though. Google have been engaged in open war against ISPs for most of the past 10 years, it is in their every interest to commoditize the pipe between the consumer and the datacentre as far as possible. Removing DNS from the link is eliminating another source of risk For Mozilla, I'm not sure, but they often follow Google's lead, and there is a strong case for Google to go that route In any case if it ever starts defaulting to on in any browser, it's very likely the others will follow suit, as it's easy to imagine quite a lot of PR around the security benefits of the brave new world
ripdog 7y ago
There are FOSS DoH servers, and you're welcome to run your own, with a free cert from Let's Encrypt. You could easily run a logging-free DoH server for anyone to use, also. There's no lock-in here, and I can't see any way that lock-in could be introduced later, either.
- d2mw 7y ago
  Society is only one Android release away from most consumer traffic metadata being tunnelled by default through a new instrument of political policy, thanks to a company who not so long ago wouldn't even let you select which _search engine_ you used. Do you really suppose the same company will start adding URL input boxes to their initial setup screen? If they even put such a text box in the settings, what percentage of users would actually customize it? So the effect is not just the local mobile telco's DNS would be subverted, but every mobile telco's DNS, and if you tried to explain what's happening to the typical person it impacted, they'd give you a puzzled look before promptly switching the topic to last night's football game. Thankfully this is a completely fabricated scenario and there is no possibility whatsoever it could even remotely play out. Given this one scenario, what value or weight does a single bearded guy's raspberry pi stashed in a closet have when it comes to worldwide DNS policy? I wonder how resilient a site like The Pirate Bay would be given an environment where DNS filtering is suddenly under the majority control of a tiny handful of companies all under American or western ownership. But DoH of course is about freedom, not about censorship. It's about preventing censorship, right! (Apologies for the style of reply -- these are obviously not genuine questions) edit: these unexplained downvotes are fascinating
  - shkkmo 7y ago
    I suspect there is support for what you are trying to say. However your communication style is unclear (especially the over use of sarcasm and rhetorical questions) and you don't actually try to support any of the points you do make. I don't see it as a positive contribution to the conversation so I down voted you.
userbinator 7y ago
"An enemy of an enemy is a friend." As someone who uses HOSTS files and DNS-level blocking/MiTM proxy on my network to control what gets to my endpoints, I like how you think.
- deleted 7y ago
  [deleted]

binarymax 7y ago

Ah, the good ole “Think of the Children!” propaganda. What a lazy excuse. It’s like they didn’t even try.

kd3 7y ago
Exactly
sneak 7y ago
The beauty of this plan is its simplicity and effectiveness. You see it time and time again for the simple reason that it is tremendously effective; normal, reasonable people will throw a lot of logical reasoning straight the fuck out the window when it comes to the safety and well-being of their offspring. This is normal and common, and we must learn to effectively counter it, not simply dismiss it, if we are to work against this sort of (again, normal and common and natural) response.

nvahalik 7y ago

There are many technologies which are double-edged swords. Encryption can keep things which need to be kept secret safe. They can also keep things which ought to be made open safe. Anything can and will be abused by people who want to use it to hide what they are doing. That includes criminals. But if every history-changing invention could have been stopped because of the potential of abuse, we'd not be where we are today.

brokenmachine 7y ago
The premise that needs to be fought is the suggestion that there can be no such thing as a private conversation.

kd3 7y ago

While DNS over HTTPS has benefits, we should really be looking into distributed or p2p DNS.

flarex 7y ago
Ethereum Name Service
betterunix2 7y ago
DNS is already distributed...
- yjftsjthsd-h 7y ago
  Revolvers as used in practice, particularly DoH as in this context, are fairly centralized.
zzzcpan 7y ago
While DoH has benefits, the way Mozilla, Cloudflare propose to get it deployed is mostly detrimental to privacy, merely leaking and centralizing everyone's data to another party. Seems like decentralized overlay p2p networks is becoming the only way to ever get privacy on the internet.

pmoriarty 7y ago

If we as people who are actually knowledgeable about technology and who care about privacy are sick of ignorant and scare-mongering politicians turning the world in to a version of 1984, we really have to become more active in politics ourselves.. and by doing more than just voting. You can run for local government, organize, or volunteer, for instance. That will make much greater difference than simply voting or voicing one's displeasure on the internet (though doing both of those can help some too, especially if enough people do so).

TazeTSchnitzel 7y ago

> The deployment of the new encryption system […] could[.[…] expos[e] millions of people to the worst imagery Not really. It is difficult to accidentally encounter these kinds of images because they are so illegal, and for those who are trying, rudimentary ISP DNS blocking is not going to stop them when Tor exists.

dansimau 7y ago

For those who disagree with the position taken in the article: Out of curiosity, what would you do to deal with online child pornography instead?

smcl 7y ago
That’s an insane argument that will just be continuously abused to erode privacy until everything you do is under surveillance by the government. Oh you’re against DNS over HTTPS? Oh so you want our children to be abused? You’re for encryption? Sounds like someone doesn’t care about child porn. Oh you won’t share your Password with the government? Hiding something?
deleted 7y ago
[deleted]
zokier 7y ago
Stop routing traffic to/from ASes that host child pornography. I mean, this is not about some deep darknet stuff or tor hidden services (where DNS filtering would not be effective anyways), so my question is why isn't government able to shut these sites down? And if the sites are hosted on uncooperative ISP then I think dropping the traffic is appropriate response.
Mountain_Skies 7y ago
First step would be to stop creating an environment where discussion of the issue can't even happen. Blocking content featuring the sexualization of children from spreading is a good goal but a better goal is to prevent it from being produced in the first place. We need better ways of making that happen, including providing ways for those who are mentally ill and want help overcoming it to get it. It's not an easy problem to combat and there probably will never be a perfect solution but instantly losing all semblance of rational though at the mere mention of the subject isn't helping much.
AdrianB1 7y ago
First step: stop using a nuclear warhead to kill a wolf. The only worst thing to do would be to destroy humanity, so child pornography will be permanently dealt with.

johnnyapol 7y ago

The only valid argument I've heard against DNS over HTTPS is that it makes it harder for institutions / companies to block other DNS servers than their own internal ones because they simply can't just drop port 53 traffic anymore. This was brought up to me in the context that many universities enforce their own DNS servers to help block malware from being able to phone home or filter access to malicious IPs in general. I guess in theory, this could still be accomplished by filtering based on IP - a whole other cat and mouse game. Although, it's not like it wasn't a cat-and-mouse game before - you could bypass these blocks by running DNS on non-standard ports unless some form of DPI was being performed.

teddyh 7y ago
There are plenty of valid arguments against DoH. If DoH becomes common, it most likely will resemble the situation with DNS resolvers we have today. Meaning, there would be the eternal problems inherent to centralization. I.e. both that the centralizing powers would have enormous power to disappear something off the internet, but also that the central servers would recieve huge amounts of constant real-time data of what everybody was doing.
- zrm 7y ago
  We need something to encrypt and authenticate DNS, but that exists in DNSCurve. The problem with it is that it doesn't try to hide what it is, so an adversarial middlebox can detect and block it to try to force you to use their own DNS. DoH is an evolutionary response to that, because it looks like HTTPS to Cloudflare, which is difficult to reject. And that's terrible for a lot of reasons (inefficiency, complexity, centralization), but it solves the local interference problem. Which means that's what we're unfortunately going to end up with unless we can solve the interference problem another way, i.e. make intermediaries understand that they're going to lose anyway and it's better to allow unmolested UDP DNS/DNSCurve to the endpoint's choice of recursive resolvers than to have everything using DoH to Cloudflare.
  - teddyh 7y ago
    There are two available courses of action. Option one: We embrace something like DoH in order to avoid any possibility of blocking and detection. But you then have no simple way to back out from centralization if/when centralization (almost certainly, IMHO) slowly becomes a problem. Monopolies and oligopolies are hard to break once formed, and absolute power corrupts absolutely. Option two: We use DNS like always to avoid problems with centralization, and adopt a secure DNS protocol to avoid spoofing and unauthorized monitoring. If we do this latter thing, and detection and blocking does become a problem (and it might), we can always add some additional layer of security, like HTTPS tunneling, on top, which avoids it. We could even, if it became absolutely necessary, centralize after the fact; but this way, we can avoid it until it would become necessary. I would prefer not to centralize things in advance, just in case a certain problem develops. I would instead prefer to keep it de-centralized as long as possible, and solve individual problems as they actually occur. I would also prefer DNSSEC and DoT over DNSCurve, and I would suggest IPsec with opportunistic encryption to be a more pure goal than to tunnel everything over HTTPS, but my preferences in protocols are not important to any of these points, and we don’t need to argue about that.

2T1Qka0rEiPr 7y ago

I'm guessing that almost every user of HN believes the opinion stated in the article is ignorant / stupid / misguided. I also believe that it's ignorant on so many levels, and whilst I particularly take issue with the "think of the children" angle of the article, I find it nevertheless interesting that people do think this way. I've spoken with friends and family members on numerous occasions about basic privacy topics, and they're often met with complete apathy. The "this endangers our children" rhetoric - though misleading - arguably does have some logical foundations. A Government who is able to watch over its citizens could in theory protect them better. It reminds me of the WhatsApp E2E encryption debates in the UK of a few years ago, shortly after the attacks in London. I guess its incumbent on us as technologists, to not merely laugh and scorn at these comments, but to acknowledge that these things have consequences, positive and negative. We need to present the under-represented positives - and at times I find this particularly hard without feeling / coming across as tin-hatted. Edit: Just on that last point - I'd love advice if anyone can provide some :)

betterunix2 7y ago
A classic problem with end-to-end encryption backdoors is that most of the time there is no benefit to users or software vendors to offset the cost and risks they must take on to provide law enforcement access. I can think of just one exception, which is identity based encryption, which allows e.g. email addresses to be used as public keys. IBE requires a master secret key that is used to generate the private keys associated with each user's ID, and therefore has an inherent backdoor, but at least the users can benefit from the reduced complexity of key management. For the most part backdoors require some kind of central coordination, so there are situations where it is basically impossible to support one. HTTPS is a good example: anyone can run a web server and there is no permission or coordination needed to do so, and so HTTPS backdoors would be difficult to create (otherwise I cannot run my web server without coordinating with whatever authority controls the backdoor, or I cannot run a secure web server without such coordination). That is what the conversation is really about: whether or not we are willing to sacrifice the most useful and valuable aspects of the Internet's design (distributed, loosely coordinated, no-permission-needed), or do without security and hope for the best, for the sake of a law enforcement backdoor.
7y ago

madaxe_again 7y ago

Their own letter undermines the very point they’re trying to make. They say “there 144,000 internet users [ed: from where in the world?] on some of the worst dark-web child sexual abuse sites”. Dark web. Tor. Not impacted by DNS over HTTPS whatsoever.

mnd999 7y ago

That’s sort of a reason to like it, even if the general everything-is-http approach to these problems annoys me.

einarfd 7y ago

It's hard to be worried about any new legislation coming out of a parliament that has been hard at work the last few years, showing that they wouldn't even be able to organise a piss up in a brewery.

exabrial 7y ago

dnscurve never made an impact unfortunately :(

karmakaze 7y ago

This is wrong on so many ways: - DoH is impacts a lot more than one area: child protection - what exactly would be lost? - is the filtering effective? No, anyone so inclined can just use a VPN - is there another way to achieve this even with DoH? Yes: resolve the URL filter hostnames, filter the IPs - faulty logic: we do X *with the intention* to stop bad Y, so don't do Z that hinders X The issue here isn't really about DoH--it's whether the government can unilaterally decide that freedom of communicating privately is not a right. Now let's see what's right(?) about this? - good political move to back something emotional people can agree with vs. something technical that most don't put in effort to understand privacy+tech - government seen as governing: good - sensational news, increases positive awareness/brand I think the last point is key, technology has come up fast and most governments are not up to the task of understanding and making good decisions. The best they can do is try to look like they're doing good and try to maintain some some control in the hopes that it will result in the ability to stay in power. It would be like if a non-technical CEO of a corporation was in charge of all the security policies for their products. Whenever these types of issues come up in the media, there's two concurrent discussions: one who understand the tech and implications and the rest of the population that reacts by proxy signals. Somehow these groups need to be connected without a distortion of the message.

esotericn 7y ago

Well, that's alright. UK disapprove of UK Politicians. Need a source? Course you don't[1]. [1] https://www.ipsos.com/ipsos-mori/en-uk/politicians-remain-least-trusted-profession-britain https://www.ipsos.com/ipsos-mori/en-uk/politicians-remain-le... They can't even bloody solve basic stuff like building houses or you know, that EU thing. DNS over HTTPS is probably down there with encouraging uptake of Klingon.

Jerry888 7y ago

—-------—------------- (~~) !! /\ Rofl politicians are not very well informed the gov already can see all traffic generated in DoH due to a built in flaw that is waiting to be fixed which i have no doubt will be "fixed" with open access built in as normal

lazylizard 7y ago

1. Now if someone says something is broken i look at nsswitch. I dig. 2. If they build this into the browser i hope there's a button for endusers to beg mozilla foundation for help when some web page doesn't load. 3. Personally I'm fine with it. Clourdflared is an acceptable way to roll this together with the rest of name resolution.

lazylizard 7y ago
But actually now already people can hide behind socks5. Dns n all. Just that people usually dont use it. Whatever....