7 ms·

Experimenting with same-provider DNS-over-HTTPS upgrade

22 points by migueldemoura 7y ago

Lio 7y ago
I'd be interested to know if this will affect the ability of things like Pi Hole to block advertising and user tracking via DNS?
- londons_explore 7y ago
  DoH won't become required for many years yet.
- icebraining 7y ago
  I'm sure Pi Hole will have DoH support, so it should be fine as long as you can still change the server (in the browser and/or OS). The only snag might be mobile apps, in case they hardcode a DNS/DoH server instead of using the system config; that may be hard to change without rooting the device.
  - throw0101a 7y ago
    > I'm sure Pi Hole will have DoH support ... We'll see. Pi Hole uses DNSmasq as its DNS (and DHCP) server, and the few DNSmasq mailing list threads I've seen on the topic seem to indicate that the DNSmasq developers are not interested in either DoT or DoH. One said that it would be difficult to implement because of architectural issues IIRC. It may be necessary to use a front-end proxy: * https://dnsdist.org/ https://dnsdist.org/
    - kchamplewski 7y ago
      Pi Hole already has documentation on how to use DoH with it, and it already works: https://docs.pi-hole.net/guides/dns-over-https/ https://docs.pi-hole.net/guides/dns-over-https/ Note: this is using cloudflared but that's just a DoH, it can and happily will query whatever provider you tell it to.
      - icebraining 7y ago
        That's for upstream queries, I think we're talking about the connection from the devices to the PiHole.
    - portmanteaufu 7y ago
      PiHole has already merged a patch[1] to disable DoH via the global canary[2]. [1] https://github.com/pi-hole/pi-hole/pull/2915 https://github.com/pi-hole/pi-hole/pull/2915 [2] https://use-application-dns.net/ https://use-application-dns.net/
    - fulafel 7y ago
      DNSmasq needs to be replaced with something more secure in any event. Hopefully implemented in a memory-safe programming language. https://www.cvedetails.com/vulnerability-list.php?vendor_id=8351&product_id=14557&version_id=0&page=1&hasexp=0&opdos=0&opec=0&opov=0&opcsrf=0&opgpriv=0&opsqli=0&opxss=0&opdirt=0&opmemc=0&ophttprs=0&opbyp=0&opfileinc=0&opginf=0&cvssscoremin=0&cvssscoremax=0&year=0&cweid=0&order=1&trc=15&sha=c1974d4b960eaac58e9ed44d9ad3a1136cbe3411 https://www.cvedetails.com/vulnerability-list.php?vendor_id=...
tptacek 7y ago
Long story short: Chrome will do DoH DNS, but only if your current DNS provider already supports DoH, and, for now, only as an experimental feature. People are upset about Firefox's new default of routing DoH to Cloud Flare, and I understand why. But it's useful to keep the issues distinct: DoH is a good thing (your ISP should not be able to see your DNS queries), even if routing them to Cloud Flare isn't.
- OrwellianChild 7y ago
  What is a good alternative to Cloudflare? What should we change the Firefox default setting to?
  - a-raccoon 7y ago
    A tor client that only passes DNS traffic and nothing more. But does it exist?
- tssva 7y ago
  DoH is a good thing when I configure it on a system level. Each individual app bypassing the system DNS settings to implement DoH within the app is not a good thing.
  - akerl_ 7y ago
    As a thought exercise: why is the OS level the correct level for DNS configuration? Why would the LAN not own this? It seems interesting that the article and many comments here identify the application level as inherently wrong and the OS level as inherently right. What if you were running docker containers on a server?Is it incorrect for the containers to set their own resolver settings?
    - viraptor 7y ago
      > Is it incorrect for the containers to set their own resolver settings? For generic containers, it is. If you build your own very customised app, then sure, you can control what it does. But if you build an app, you don't know where/how I deploy it. It may be without internet access. It may be expected to use private DNS zones. It may be expected to query mdns. The container should not guess or assume those things.
iforgotpassword 7y ago
On this topic: I recently learned about https://support.mozilla.org/en-US/kb/configuring-networks-disable-dns-over-https https://support.mozilla.org/en-US/kb/configuring-networks-di... Is this just a Mozilla one man show or are there plans by anyone else to support this? Maybe make this a standard? Some googling revealed nothing... Now the way Google does it sounds somewhat reasonable but who knows what the future will bring, or what other software will adapt DoH.
- bugmen0t 7y ago
  The text on https://use-application-dns.net/ https://use-application-dns.net/ says that it will be attempted to become a standard through the IETF. But only time will tell.
londons_explore 7y ago
> DoH would prevent other WiFi users from seeing which websites you visit, This is false, and downright dangerous information. A network attacker can still see that you are visiting pornhub.com even with DoH, since you are sending the hostname in cleartext as part of the TLS handshake. Google isn't a snake-oil security solution - they shouldn't be making such false claims.
- growse 7y ago
  > This is false, and downright dangerous information. A network attacker can still see that you are visiting pornhub.com This won't be true as soon as ESNI gets implemented. (Chrome: https://bugs.chromium.org/p/chromium/issues/detail?id=908132 https://bugs.chromium.org/p/chromium/issues/detail?id=908132 and Firefox nightlies have it already). However, ESNI is pretty meaningless if you're making plain-text DNS requests, so DoH is a pretty important part of the puzzle.
  - icebraining 7y ago
    Browser support for ESNI is just half of the equation, you also need servers and middleboxes to support it. For example, as of December 2017, over 10% of the traffic seen by Cloudflare was still TLSv1.0: https://blog.cloudflare.com/why-tls-1-3-isnt-in-browsers-yet/ https://blog.cloudflare.com/why-tls-1-3-isnt-in-browsers-yet...
    - zzzcpan 7y ago
      And eSNI is not even a solution to anything, it merely pushes a bit of cleartext identification data from one protocol to another, while assuming that lots of websites share a single IP address and that it's not possible to correlate what website on the IP is used by simply observing what kind of packets are sent from a machine, which is actually pretty easy (as each website comes with connections to multiple other IPs with specific sizes of data transfer generating a unique traffic pattern).
      - growse 7y ago
throwawaynihil 7y ago
The only thing DoH gives anybody .. is even more of your private data to a centralized provider with questionable ethics, and the only company more ethically questionable than Google is Palantir. Run your own local resolver and move on with your life.
- growse 7y ago
  > ... private data to a centralized provider with questionable ethics What, like your ISP?
  - deleted 7y ago
    [deleted]
  - ndidi 7y ago
    Not everybody lives in the US. I trust my ISP. They are cool, and their handling of my data is regulated under the GDPR and other laws. CloudFlare? Not so much.
    - growse 7y ago
      I am also not in the US. However, everywhere I look I see large ISPs with questionable ethics who are centralized providers of DNS. I'm struggling to see why DoH means "is even more of your private data to a centralized provider with questionable ethics", which is what the OP said.
    - magashna 7y ago
      Mozilla is rolling this out in the US, where there are few ISPs across the nation.
  - throwawaynihil 7y ago
    Rather than putting real effort into this, I'm just going to say that Paul Vixie, the creator of DNS, advocates for using a local resolver (not your ISP's resolver), and DNSSEC. The internet is supposed to be decentralized, not centralized. Cloudflare, Google, and all of these other centralized dns/ntp services are hazardous to our health. I'm sure you're very knowledgable, but if Paul gives DNS advice, listen to him.
jwilk 7y ago
Archived copy that can be read without JS enabled: https://archive.is/59JCD https://archive.is/59JCD
nickcw 7y ago
Google make this point which I haven't seen in any of the arguments so far: > In particular, we are aware of how DNS can play an important role in ISP-provided family-safe content filtering. Lots of families with children use their ISP's safe browsing facilities which is usually implemented via alternative DNS servers. Yes it is not terribly difficult to defeat, but it is cheap and effective for small and non technical children. This does at least seem like a more sensible experiment than Mozilla's which will break the above scheme for every Firefox user.
- GrayShade 7y ago
  They address it in https://blog.mozilla.org/futurereleases/2019/07/31/dns-over-https-doh-update-detecting-managed-networks-and-user-choice/ https://blog.mozilla.org/futurereleases/2019/07/31/dns-over-....
nimrody 7y ago
They say it will be enabled only for providers supporting this. Do they mean DNS servers supporting DoH? If a network DHCP server publishes a local DNS server that is not on the list, DNS traffic will not bt encrypted? So a network operator wishing to continue spying on its users just needs a local DNS proxy?
- throw0101a 7y ago
  > They say it will be enabled only for providers supporting this. Do they mean DNS servers supporting DoH? No, they say providers, and mean providers. They are starting their experiment with a whitelist: * https://www.chromium.org/developers/dns-over-https https://www.chromium.org/developers/dns-over-https If you're already using one of those then Chrome/ium will change from "plain DNS" over to DoH. If you are not using one of them already, then nothing will change.
_Codemonkeyism 7y ago
Does anyone know how much money Mozilla gets from Cloudflare? Do they get any? I've tried to find something in Mozilla financial declarations but haven't found anything.
- ndidi 7y ago
  Might sound like a conspiracy, but yes, I think they are getting money. They are definitely not sending the entire browsing history of users (DoH) and even the contents (VPN[]) to CloudFlare and getting nothing in return... right? [] https://news.ycombinator.com/item?id=20927832 https://news.ycombinator.com/item?id=20927832
  - _Codemonkeyism 7y ago
    I'm not in the business of data, so I don't know what the browsing habit of millions of people are worth.

22 points by migueldemoura 7y ago

Lio 7y ago

I'd be interested to know if this will affect the ability of things like Pi Hole to block advertising and user tracking via DNS?

londons_explore 7y ago
DoH won't become required for many years yet.
icebraining 7y ago
I'm sure Pi Hole will have DoH support, so it should be fine as long as you can still change the server (in the browser and/or OS). The only snag might be mobile apps, in case they hardcode a DNS/DoH server instead of using the system config; that may be hard to change without rooting the device.
- throw0101a 7y ago
  > I'm sure Pi Hole will have DoH support ... We'll see. Pi Hole uses DNSmasq as its DNS (and DHCP) server, and the few DNSmasq mailing list threads I've seen on the topic seem to indicate that the DNSmasq developers are not interested in either DoT or DoH. One said that it would be difficult to implement because of architectural issues IIRC. It may be necessary to use a front-end proxy: * https://dnsdist.org/ https://dnsdist.org/
  - kchamplewski 7y ago
    Pi Hole already has documentation on how to use DoH with it, and it already works: https://docs.pi-hole.net/guides/dns-over-https/ https://docs.pi-hole.net/guides/dns-over-https/ Note: this is using cloudflared but that's just a DoH, it can and happily will query whatever provider you tell it to.
    - icebraining 7y ago
      That's for upstream queries, I think we're talking about the connection from the devices to the PiHole.
  - portmanteaufu 7y ago
    PiHole has already merged a patch[1] to disable DoH via the global canary[2]. [1] https://github.com/pi-hole/pi-hole/pull/2915 https://github.com/pi-hole/pi-hole/pull/2915 [2] https://use-application-dns.net/ https://use-application-dns.net/
  - fulafel 7y ago
    DNSmasq needs to be replaced with something more secure in any event. Hopefully implemented in a memory-safe programming language. https://www.cvedetails.com/vulnerability-list.php?vendor_id=8351&product_id=14557&version_id=0&page=1&hasexp=0&opdos=0&opec=0&opov=0&opcsrf=0&opgpriv=0&opsqli=0&opxss=0&opdirt=0&opmemc=0&ophttprs=0&opbyp=0&opfileinc=0&opginf=0&cvssscoremin=0&cvssscoremax=0&year=0&cweid=0&order=1&trc=15&sha=c1974d4b960eaac58e9ed44d9ad3a1136cbe3411 https://www.cvedetails.com/vulnerability-list.php?vendor_id=...

tptacek 7y ago

Long story short: Chrome will do DoH DNS, but only if your current DNS provider already supports DoH, and, for now, only as an experimental feature. People are upset about Firefox's new default of routing DoH to Cloud Flare, and I understand why. But it's useful to keep the issues distinct: DoH is a good thing (your ISP should not be able to see your DNS queries), even if routing them to Cloud Flare isn't.

OrwellianChild 7y ago
What is a good alternative to Cloudflare? What should we change the Firefox default setting to?
- a-raccoon 7y ago
  A tor client that only passes DNS traffic and nothing more. But does it exist?
tssva 7y ago
DoH is a good thing when I configure it on a system level. Each individual app bypassing the system DNS settings to implement DoH within the app is not a good thing.
- akerl_ 7y ago
  As a thought exercise: why is the OS level the correct level for DNS configuration? Why would the LAN not own this? It seems interesting that the article and many comments here identify the application level as inherently wrong and the OS level as inherently right. What if you were running docker containers on a server?Is it incorrect for the containers to set their own resolver settings?
  - viraptor 7y ago
    > Is it incorrect for the containers to set their own resolver settings? For generic containers, it is. If you build your own very customised app, then sure, you can control what it does. But if you build an app, you don't know where/how I deploy it. It may be without internet access. It may be expected to use private DNS zones. It may be expected to query mdns. The container should not guess or assume those things.

iforgotpassword 7y ago

On this topic: I recently learned about https://support.mozilla.org/en-US/kb/configuring-networks-disable-dns-over-https https://support.mozilla.org/en-US/kb/configuring-networks-di... Is this just a Mozilla one man show or are there plans by anyone else to support this? Maybe make this a standard? Some googling revealed nothing... Now the way Google does it sounds somewhat reasonable but who knows what the future will bring, or what other software will adapt DoH.

bugmen0t 7y ago
The text on https://use-application-dns.net/ https://use-application-dns.net/ says that it will be attempted to become a standard through the IETF. But only time will tell.

londons_explore 7y ago

> DoH would prevent other WiFi users from seeing which websites you visit, This is false, and downright dangerous information. A network attacker can still see that you are visiting pornhub.com even with DoH, since you are sending the hostname in cleartext as part of the TLS handshake. Google isn't a snake-oil security solution - they shouldn't be making such false claims.

growse 7y ago
> This is false, and downright dangerous information. A network attacker can still see that you are visiting pornhub.com This won't be true as soon as ESNI gets implemented. (Chrome: https://bugs.chromium.org/p/chromium/issues/detail?id=908132 https://bugs.chromium.org/p/chromium/issues/detail?id=908132 and Firefox nightlies have it already). However, ESNI is pretty meaningless if you're making plain-text DNS requests, so DoH is a pretty important part of the puzzle.
- icebraining 7y ago
  Browser support for ESNI is just half of the equation, you also need servers and middleboxes to support it. For example, as of December 2017, over 10% of the traffic seen by Cloudflare was still TLSv1.0: https://blog.cloudflare.com/why-tls-1-3-isnt-in-browsers-yet/ https://blog.cloudflare.com/why-tls-1-3-isnt-in-browsers-yet...
  - zzzcpan 7y ago
    And eSNI is not even a solution to anything, it merely pushes a bit of cleartext identification data from one protocol to another, while assuming that lots of websites share a single IP address and that it's not possible to correlate what website on the IP is used by simply observing what kind of packets are sent from a machine, which is actually pretty easy (as each website comes with connections to multiple other IPs with specific sizes of data transfer generating a unique traffic pattern).
    - growse 7y ago

throwawaynihil 7y ago

The only thing DoH gives anybody .. is even more of your private data to a centralized provider with questionable ethics, and the only company more ethically questionable than Google is Palantir. Run your own local resolver and move on with your life.

growse 7y ago
> ... private data to a centralized provider with questionable ethics What, like your ISP?
- deleted 7y ago
  [deleted]
- ndidi 7y ago
  Not everybody lives in the US. I trust my ISP. They are cool, and their handling of my data is regulated under the GDPR and other laws. CloudFlare? Not so much.
  - growse 7y ago
    I am also not in the US. However, everywhere I look I see large ISPs with questionable ethics who are centralized providers of DNS. I'm struggling to see why DoH means "is even more of your private data to a centralized provider with questionable ethics", which is what the OP said.
  - magashna 7y ago
    Mozilla is rolling this out in the US, where there are few ISPs across the nation.
- throwawaynihil 7y ago
  Rather than putting real effort into this, I'm just going to say that Paul Vixie, the creator of DNS, advocates for using a local resolver (not your ISP's resolver), and DNSSEC. The internet is supposed to be decentralized, not centralized. Cloudflare, Google, and all of these other centralized dns/ntp services are hazardous to our health. I'm sure you're very knowledgable, but if Paul gives DNS advice, listen to him.

jwilk 7y ago

Archived copy that can be read without JS enabled: https://archive.is/59JCD https://archive.is/59JCD

nickcw 7y ago

Google make this point which I haven't seen in any of the arguments so far: > In particular, we are aware of how DNS can play an important role in ISP-provided family-safe content filtering. Lots of families with children use their ISP's safe browsing facilities which is usually implemented via alternative DNS servers. Yes it is not terribly difficult to defeat, but it is cheap and effective for small and non technical children. This does at least seem like a more sensible experiment than Mozilla's which will break the above scheme for every Firefox user.

GrayShade 7y ago
They address it in https://blog.mozilla.org/futurereleases/2019/07/31/dns-over-https-doh-update-detecting-managed-networks-and-user-choice/ https://blog.mozilla.org/futurereleases/2019/07/31/dns-over-....

nimrody 7y ago

They say it will be enabled only for providers supporting this. Do they mean DNS servers supporting DoH? If a network DHCP server publishes a local DNS server that is not on the list, DNS traffic will not bt encrypted? So a network operator wishing to continue spying on its users just needs a local DNS proxy?

throw0101a 7y ago
> They say it will be enabled only for providers supporting this. Do they mean DNS servers supporting DoH? No, they say providers, and mean providers. They are starting their experiment with a whitelist: * https://www.chromium.org/developers/dns-over-https https://www.chromium.org/developers/dns-over-https If you're already using one of those then Chrome/ium will change from "plain DNS" over to DoH. If you are not using one of them already, then nothing will change.

_Codemonkeyism 7y ago

Does anyone know how much money Mozilla gets from Cloudflare? Do they get any? I've tried to find something in Mozilla financial declarations but haven't found anything.

ndidi 7y ago
Might sound like a conspiracy, but yes, I think they are getting money. They are definitely not sending the entire browsing history of users (DoH) and even the contents (VPN[]) to CloudFlare and getting nothing in return... right? [] https://news.ycombinator.com/item?id=20927832 https://news.ycombinator.com/item?id=20927832
- _Codemonkeyism 7y ago
  I'm not in the business of data, so I don't know what the browsing habit of millions of people are worth.