4 ms·

Indian here. My ISP does inject ads into plain HTTP traffic, so based on that user-hostile behaviour I assume that they also record my DNS queries and/or sell t

Indian here. My ISP does inject ads into plain HTTP traffic, so based on that user-hostile behaviour I assume that they also record my DNS queries and/or sell them. Also whether or not they do that, they are mandated by govt to keep DNS query records for at least 18 months (last I looked) and then anonymise them. Under the current authoritarian leaning govt, I wouldn't be surprised if rules have been revised mandating indefinite recording.

lucb1e 7y ago
Interesting, thanks for adding that data point. I'm wondering if there is a list of this somewhere, it seems like the kind of thing we'd want to track (similar to e.g. the press freedom map https://rsf.org/en/ranking https://rsf.org/en/ranking )
mtsr 7y ago
But the proper solution for that is DNS-over-TLS and picking or running your own recursive DNS resolver.
- CogitoCogito 7y ago
  Is it not possible to have a recursive DNS resolver with DNS over HTTPS? I.e. are their more differences between DoH and DNS over TLS than just the port number?
  - mercora 7y ago
    i think DoH is DNS wireformat via http over TLS whereas DNS over TLS is the plain wireformat over TLS. EDIT: so for DoH you would need to speak HTTP but for DNS over TLS you only need to wrap TLS around for example by using stunnel or something.
    - CogitoCogito 7y ago
      Sorry if I'm dense, but that would mean that the two protocols _are_ the same except for port number for practical purposes right? I mean there's no reason why the same actions could be taken when running straight wireformat vs over http right? edit: In response to your edit :) So is the main objection to this that it breaks traditional layering then? E.g. here's a post in a thread that I found a bit helpful: https://old.reddit.com/r/privacy/comments/89pr15/dnsoverhttps_vs_dns_overtls_vs_dnscrypt/dwzk7g3/ https://old.reddit.com/r/privacy/comments/89pr15/dnsoverhttp... (The rest of the thread is interesting as well.) I guess one downside with DoH is that now there's a larger incentive to break through your https in general?
      - mercora 7y ago
        i was only responding to your question whether there is any difference between the two beside the port number used which there is, in a significant way. You can not point a DoH client to a DNS over TLS server or vice versa. That said there is no reason a DoH server could not be recursive or consult a traditional (probably recursive) resolver for its response. I think the only benefit of DoH is that is unlikely to be blocked. Otherwise it feels more like a hack and at least i am not concerned about OSI models ;) Actually, i tried to setup a DNS over TLS server some weeks ago but while it worked like intended i had a hard time to get reasonable response times even after somewhat serious fine tuning for the session setup (i used haproxy at server side). But this was mainly caused by the fact that systemd-resolved established a new connection for each and every request and i did not find a stub resolver that did not either.
        CogitoCogito 7y ago
        > i was only responding to your question whether there is any difference between the two beside the port number used which there is, in a significant way. You can not point a DoH client to a DNS over TLS server or vice versa. That said there is no reason a DoH server could not be recursive or consult a traditional (probably recursive) resolver for its response. > I think the only benefit of DoH is that is unlikely to be blocked. Otherwise it feels more like a hack and at least i am not concerned about OSI models ;) Thanks for the response, but I'm still a little confused. If you live in the DoH stack you must stay there sure, but the same apparently applies to the DNS over TLS. What to you exactly is hacky about the DoH method if you don't care about the layering violations?

lucb1e 7y ago

Interesting, thanks for adding that data point. I'm wondering if there is a list of this somewhere, it seems like the kind of thing we'd want to track (similar to e.g. the press freedom map https://rsf.org/en/ranking https://rsf.org/en/ranking )

mtsr 7y ago

But the proper solution for that is DNS-over-TLS and picking or running your own recursive DNS resolver.

CogitoCogito 7y ago
Is it not possible to have a recursive DNS resolver with DNS over HTTPS? I.e. are their more differences between DoH and DNS over TLS than just the port number?
- mercora 7y ago
  i think DoH is DNS wireformat via http over TLS whereas DNS over TLS is the plain wireformat over TLS. EDIT: so for DoH you would need to speak HTTP but for DNS over TLS you only need to wrap TLS around for example by using stunnel or something.
  - CogitoCogito 7y ago
    Sorry if I'm dense, but that would mean that the two protocols _are_ the same except for port number for practical purposes right? I mean there's no reason why the same actions could be taken when running straight wireformat vs over http right? edit: In response to your edit :) So is the main objection to this that it breaks traditional layering then? E.g. here's a post in a thread that I found a bit helpful: https://old.reddit.com/r/privacy/comments/89pr15/dnsoverhttps_vs_dns_overtls_vs_dnscrypt/dwzk7g3/ https://old.reddit.com/r/privacy/comments/89pr15/dnsoverhttp... (The rest of the thread is interesting as well.) I guess one downside with DoH is that now there's a larger incentive to break through your https in general?
    - mercora 7y ago
      i was only responding to your question whether there is any difference between the two beside the port number used which there is, in a significant way. You can not point a DoH client to a DNS over TLS server or vice versa. That said there is no reason a DoH server could not be recursive or consult a traditional (probably recursive) resolver for its response. I think the only benefit of DoH is that is unlikely to be blocked. Otherwise it feels more like a hack and at least i am not concerned about OSI models ;) Actually, i tried to setup a DNS over TLS server some weeks ago but while it worked like intended i had a hard time to get reasonable response times even after somewhat serious fine tuning for the session setup (i used haproxy at server side). But this was mainly caused by the fact that systemd-resolved established a new connection for each and every request and i did not find a stub resolver that did not either.
      - CogitoCogito 7y ago
        > i was only responding to your question whether there is any difference between the two beside the port number used which there is, in a significant way. You can not point a DoH client to a DNS over TLS server or vice versa. That said there is no reason a DoH server could not be recursive or consult a traditional (probably recursive) resolver for its response. > I think the only benefit of DoH is that is unlikely to be blocked. Otherwise it feels more like a hack and at least i am not concerned about OSI models ;) Thanks for the response, but I'm still a little confused. If you live in the DoH stack you must stay there sure, but the same apparently applies to the DNS over TLS. What to you exactly is hacky about the DoH method if you don't care about the layering violations?