3 ms·

Same story as always with Google "innovations": "hey, we're preventing DNS queries to go to your ISP who is selling it" (to go to our service instead so we can

Same story as always with Google "innovations": "hey, we're preventing DNS queries to go to your ISP who is selling it" (to go to our service instead so we can profit from it). It's scary that Moz sides with monopolies like Google and Cloudflare on this one.

LUmBULtERA 7y ago
In my Firefox settings I can choose any DoH provider I want, not just Cloudflare. Naturally something has to be set up as a default so it works. Why is adding DoH in the browser a bad thing?
- josteink 7y ago
  Because if we’re replacing classic DNS with something new, it needs to be part of the OS. Not reimplemented (and configured) per application. The user and OS should control the application, not the other way around.
  - Faark 7y ago
    Is any OS vendor working on something like that? Or do you expect Moz to jump into OS dev as well? I'd expect them to import settings from OS as soon as a major OS provides this for DoH.
- tannhaeuser 7y ago
  The DNS has grown into a regulated service, with TLD authorities and protocols to follow for registrators, transparency for domain holders, many registrators to choose, etc. Do you want to replace it by a centralized system run by very few monopolies that track resolution queries by IP?
jedisct1 7y ago
At the end, you still need to trust the resolver. There is a proposal to improve this. Resolves won't know client IPs any more: https://github.com/DNSCrypt/dnscrypt-protocol/blob/master/ANONYMIZED-DNSCRYPT.txt https://github.com/DNSCrypt/dnscrypt-protocol/blob/master/AN... Reference client and server implementations should be ready in the next few days.
- vavrusa 7y ago
  This is interesting as a lighter alternative to DNS over Tor. Where is the padding going to be? Basic clients won't add EDNS padding by default, but intuitively there has to be padding somewhere. It reminds me of https://odns.cs.princeton.edu https://odns.cs.princeton.edu (I haven't seen a working implementation of that one yet). The most difficult challenge is how to present the ultimate choice - use the relay and maybe get slower Internet, or don't use the relay and maybe get tracked. What hasn't been much explored yet is using resolvers just to obtain the delegation (nobody needs to know who the client is for that), but that itself is not without problems.
  - jedisct1 7y ago
    The underlying DNSCrypt protocol does the padding already: https://dnscrypt.info/protocol https://dnscrypt.info/protocol DNS queries and responses are wrapped, they are never modified. EDNS padding is a horrible hack.
    - vavrusa 7y ago
      That's good, I missed that. Thanks for highlighting the project, I'll keep an eye on it!
  - jedisct1 7y ago
    Indeed, we will need to make a choice between minimizing latency or using a relay. But a lot of people use DNS over Tor already. For people concerned about privacy, a bit of extra latency is totally acceptable. Anonymized DNSCrypt is lighter than Tor, has a very clear security model, and relays are less vulnerable to abuse than Tor exit nodes. The server/relay part is going to be implemented in https://github.com/jedisct1/rust-dnscrypt-server https://github.com/jedisct1/rust-dnscrypt-server

LUmBULtERA 7y ago

In my Firefox settings I can choose any DoH provider I want, not just Cloudflare. Naturally something has to be set up as a default so it works. Why is adding DoH in the browser a bad thing?

josteink 7y ago
Because if we’re replacing classic DNS with something new, it needs to be part of the OS. Not reimplemented (and configured) per application. The user and OS should control the application, not the other way around.
- Faark 7y ago
  Is any OS vendor working on something like that? Or do you expect Moz to jump into OS dev as well? I'd expect them to import settings from OS as soon as a major OS provides this for DoH.
tannhaeuser 7y ago
The DNS has grown into a regulated service, with TLD authorities and protocols to follow for registrators, transparency for domain holders, many registrators to choose, etc. Do you want to replace it by a centralized system run by very few monopolies that track resolution queries by IP?

jedisct1 7y ago

At the end, you still need to trust the resolver. There is a proposal to improve this. Resolves won't know client IPs any more: https://github.com/DNSCrypt/dnscrypt-protocol/blob/master/ANONYMIZED-DNSCRYPT.txt https://github.com/DNSCrypt/dnscrypt-protocol/blob/master/AN... Reference client and server implementations should be ready in the next few days.

vavrusa 7y ago
This is interesting as a lighter alternative to DNS over Tor. Where is the padding going to be? Basic clients won't add EDNS padding by default, but intuitively there has to be padding somewhere. It reminds me of https://odns.cs.princeton.edu https://odns.cs.princeton.edu (I haven't seen a working implementation of that one yet). The most difficult challenge is how to present the ultimate choice - use the relay and maybe get slower Internet, or don't use the relay and maybe get tracked. What hasn't been much explored yet is using resolvers just to obtain the delegation (nobody needs to know who the client is for that), but that itself is not without problems.
- jedisct1 7y ago
  The underlying DNSCrypt protocol does the padding already: https://dnscrypt.info/protocol https://dnscrypt.info/protocol DNS queries and responses are wrapped, they are never modified. EDNS padding is a horrible hack.
  - vavrusa 7y ago
    That's good, I missed that. Thanks for highlighting the project, I'll keep an eye on it!
- jedisct1 7y ago
  Indeed, we will need to make a choice between minimizing latency or using a relay. But a lot of people use DNS over Tor already. For people concerned about privacy, a bit of extra latency is totally acceptable. Anonymized DNSCrypt is lighter than Tor, has a very clear security model, and relays are less vulnerable to abuse than Tor exit nodes. The server/relay part is going to be implemented in https://github.com/jedisct1/rust-dnscrypt-server https://github.com/jedisct1/rust-dnscrypt-server