7 ms·
Completely untrue. Those services just need to serve their own DoH endpoint and the user can add it in Firefox preferences. No harder than and arguably easier t
by morpheuskafka 7y ago
Completely untrue. Those services just need to serve their own DoH endpoint and the user can add it in Firefox preferences. No harder than and arguably easier than the complicated procedure for changing system DNS, and it allows you to block things in your browser that you may not want blocked at the system level for all users.
- tptacek 7y agoIf your PiHole servers a DoH endpoint, you're probably back to exposing plaintext DNS to your ISP. The whole point of DoH is to tunnel DNS out of your untrusted ISP network to anywhere else in the world where it can be trusted more. What is the case, however, is that you could set up a DoH endpoint on some other network and route your DNS there.
- cyphar 7y agoWhy can't the PiHole create it's own DoH connection upstream? Y'know, the most classic way of doing a MitM on encrypted traffic?
- tptacek 7y agoOh, it totally can, and there's nothing wrong with that. I would just hate for someone to terminate DoH on their home network and expose direct-to-the-roots DNS to their ISP, which is, if anything, marginally more attributable than normal ISP DNS. I'm definitely not talking down the idea of doing a PiHole setup.
- eikenberry 7y agoI don't get why you'd think direct to the root DNS servers would be worse than using your ISPs servers. Using the root servers means you get DNSSEC which would prevent the greatest threats, hijacking and injection.
- tptacek 7y agoThere is virtually no DNSSEC deployed on any major sites on the Internet and, because DNSSEC is a terrible protocol, it's unlikely there ever will be. I'm a broken record on this; you can just search "author:tptacek DNSSEC" in the bar below to get lots of different reasons why. The most important thing for this thread though is that DNSSEC provides zero privacy and, in ordinary deployments (where you talk to a nameserver rather than directly running on on your computer) no protection against injection between you and your nameserver.
- mindslight 7y agoI don't think DNSSEC itself is likely to ever win. But it does have an additional dimension that makes it a better foundation for privacy than DoH. DoH is strictly transport layer security, meaning it still relies on a trusted third party (Mozilla or Google or whomever) to not vacuum your requests. Whereas if records are signed, they can be sent laterally between mutually untrusting peers, including bulk broadcasts, etc.
- tptacek 7y agoA better foundation for privacy? No. DNSSEC provides literally no privacy. It doesn't encrypt, it only signs. DNSSEC is passively observable by design.
- mindslight 7y agoFor privacy, getting records signed is ultimately more long-term important than getting queries encrypted immediately. As DoH shows, bolting on transport layer security is trivial. For example, you'd never want to set your DoH resolver to an arbitrary TOR hidden service. But there would be no problem querying DNSSEC through TOR (assuming the setup wrapped the server-server protocol in something that allowed such forwarding).
- tptacek 7y ago
- Unklejoe 7y ago> No harder than and arguably easier than the complicated procedure for changing system DNS It sounds harder than my simple “redirect all outgoing DNS requests to my PiHole” rule that I have set up in my router. No messing with any DNS settings required.