6 ms·

I like Chrome's approach to DoH. If the local DNS server is capable of DoH, then, and only then, Chrome switches to DoH. It is the safest choice to make, since

by Ayesh 7y ago

I like Chrome's approach to DoH. If the local DNS server is capable of DoH, then, and only then, Chrome switches to DoH. It is the safest choice to make, since if you are querying that name server, they have your data anyway, so you might as well encrypt it in transit.

the8472 7y ago
How would chrome know whether getaddrinfo() uses DoH to resolve a host?
- icebraining 7y ago
  Anyone can link to their own getaddrinfo(), including an internal function, they don't have to use one from whichever libc happens to be laying around on the system. In theirs, they read the DNS servers from the OS (like the original), and then if it's part of a list of known DoH providers, they try to connect over DoH before falling back to regular DNS queries.
  - mlyle 7y ago
    First, I know nothing about DoH, so take this with a grain of salt. They should look up a canary domain that doesn't resolve from the roots, but local sites can configure to provide the address of a DoH resolver. Then you don't need to have a list of known DoH providers-- any site can install a DoH resolver and then add the canary domain to allow clients to upgrade. It'd still be vulnerable to MITM attacks on initial connect, but at least the window for them is closed after the first resolution with this approach (better than normal DNS).
  - judge2020 7y ago
    For reference, the code that does the protocol upgrade: https://github.com/chromium/chromium/blob/711b1ba2735f8af4bd6359c6292e1875412df74f/net/dns/dns_util.cc#L146-L217 https://github.com/chromium/chromium/blob/711b1ba2735f8af4bd...
  - the8472 7y ago
    That would mean bypassing OS configuration, including other naming sources then DNS.
    - icebraining 7y ago
      Yes, and if you search for "Chrome DNS client", people have reported problems related to that.
techslave 7y ago
i am very avidly opposes to DoH because it doesn’t solve the problem people think it does. and it further entrenches cloudflare, who imho are vile but that aside the concentration isn’t a good thing. however, your statement is wrong. i won’t go further into detail because my comments on this subject universally attract all the downvotes so there’s no point. but in general the problem is you need to qualify “safest”. safest for what and for whom, and in what scenarios? you’ve left too much unsaid, so what you say is not generally true.
- icebraining 7y ago
  This comment says very little; you don't explain what problem people think DoH solves, won't go into detail on why the statement is wrong, nor why not qualifying "safest" makes it not generally true. At least a comment that attracts downvotes may be useful to someone.
fanf2 7y ago
Chrome has a short list of known DoH servers that it will use, and they are all public cloud DNS providers so it will not use your local DoH server. https://www.chromium.org/developers/dns-over-https https://www.chromium.org/developers/dns-over-https

by Ayesh 7y ago

the8472 7y ago

How would chrome know whether getaddrinfo() uses DoH to resolve a host?

icebraining 7y ago
Anyone can link to their own getaddrinfo(), including an internal function, they don't have to use one from whichever libc happens to be laying around on the system. In theirs, they read the DNS servers from the OS (like the original), and then if it's part of a list of known DoH providers, they try to connect over DoH before falling back to regular DNS queries.
- mlyle 7y ago
  First, I know nothing about DoH, so take this with a grain of salt. They should look up a canary domain that doesn't resolve from the roots, but local sites can configure to provide the address of a DoH resolver. Then you don't need to have a list of known DoH providers-- any site can install a DoH resolver and then add the canary domain to allow clients to upgrade. It'd still be vulnerable to MITM attacks on initial connect, but at least the window for them is closed after the first resolution with this approach (better than normal DNS).
- judge2020 7y ago
  For reference, the code that does the protocol upgrade: https://github.com/chromium/chromium/blob/711b1ba2735f8af4bd6359c6292e1875412df74f/net/dns/dns_util.cc#L146-L217 https://github.com/chromium/chromium/blob/711b1ba2735f8af4bd...
- the8472 7y ago
  That would mean bypassing OS configuration, including other naming sources then DNS.
  - icebraining 7y ago
    Yes, and if you search for "Chrome DNS client", people have reported problems related to that.

techslave 7y ago

i am very avidly opposes to DoH because it doesn’t solve the problem people think it does. and it further entrenches cloudflare, who imho are vile but that aside the concentration isn’t a good thing. however, your statement is wrong. i won’t go further into detail because my comments on this subject universally attract all the downvotes so there’s no point. but in general the problem is you need to qualify “safest”. safest for what and for whom, and in what scenarios? you’ve left too much unsaid, so what you say is not generally true.

icebraining 7y ago
This comment says very little; you don't explain what problem people think DoH solves, won't go into detail on why the statement is wrong, nor why not qualifying "safest" makes it not generally true. At least a comment that attracts downvotes may be useful to someone.

fanf2 7y ago

Chrome has a short list of known DoH servers that it will use, and they are all public cloud DNS providers so it will not use your local DoH server. https://www.chromium.org/developers/dns-over-https https://www.chromium.org/developers/dns-over-https