6 ms·

Using someone's resolver other than your own is sensible: it serves to hide from authoritative servers the IP addresses of each query's requestor, both because

Using someone's resolver other than your own is sensible: it serves to hide from authoritative servers the IP addresses of each query's requestor, both because the resolver aggregates many clients' lookups, and because of caching. But whoever runs the resolver you use gets to see what domainnames you're resolving. Your resolver's operator will be sorely tempted to monetize that metadata. Your only choice is which resolver operator you'll allow to monetize your metadata. So you lose no matter what, unless you have a contract with the operator, and then you'd better be giving them something of value if you want to be able to enforce the contract's confidentiality requirements. ISPs mostly don't even support DoH/DoT, which is a reason to not want to use their resolvers. But using public resolvers helps centralize the DNS, which is not good.

tptacek 7y ago
Yes. If you're concerned that your third-party resolver is monetizing or otherwise monitoring your DNS, you can run your own DoH recursor, semi-anonymously, from a public cloud account. In the long run, presumably trustworthy organizations will stand up DoH resolvers that people can trust. I preemptively agree that Cloud Flare is not one of those organizations. It is unclear to me why any home user would deliberately opt for DoT. DoH and DoT solve the exact same problem, and DoH is by design harder to filter.
- cryptonector 7y ago
  We all should be worried about loss of privacy, but we can't all run our own resolvers on the cloud. The choice of DoT vs DoH will mostly be about what is supported by one's choice of resolver. Of course, choosing DoH first will narrow the choice of resolvers. Then there's captive portal situations.
  - tptacek 7y ago
    This is a false controversy. The people that "can't" run their own resolvers are, overwhelmingly, using their ISP's resolvers. At least in the US, all of those ISPs are actively attacking their users. Users are better off using practically any other mainstream centralized DNS provider than their ISP default. But this isn't a stable equilibrium; as I said, it seems clear that privacy-minded organizations will eventually stand up their own trustworthy DoH resolvers. DoH makes things somewhat better today for all users, and much better for power users. In the long term, it's easy to see how DoH makes things much better for everybody.
    - cryptonector 7y ago
      Running one's own recursor using DNSSEC via an ISP's resolver (for the privacy benefit relative to authoritatives) would take care of active attacks by ISPs on their users. Windows and Linux could do this you know, but security would be enhanced only relative to sites that use DNSSEC. But I don't disagree that DoH is better. I do hope that in the long run ISPs become less toxic.
      - tptacek 7y ago
        Running one's own resolver with DNSSEC would do absolutely nothing about the ISP threat, since DNSSEC is a cleartext signing-only protocol. Since the overwhelming majority of zones aren't signed, it won't even protect you from the garish NXDOMAIN landing page attack.
        cryptonector 7y ago
        I was referring to active attacks. I don't consider an ISP or a public resolver operator to be particularly different w.r.t. passive attacks: both get to do it, and both do do it.
- psanford 7y ago
  Do you think quad9[0] is a trustworthy organization? [0]: https://www.quad9.net https://www.quad9.net
  - bwoodcock 7y ago
    Tricky question. I'm the chairman of Quad9's board of directors. So _I_ trust the organization. But I'd urge everyone else not to trust _any_ organization, but instead to do as much to protect yourself as possible, using an external recursive resolver only when you need to. That means running your own caching resolver, with a local copy of the root zone and QNAME minimization enabled, and then using DNS-over-TLS to forward the minimum necessary query onward. The next question then becomes whether to perform recursion yourself (by talking directly with authoritative nameservers) or to have Quad9 or another recursive server perform the recursion for you. Authoritative nameservers don't yet support transport encryption, though we're working very hard to support it on the 500 TLDs PCH is authoritative for, and Verisign is working very hard to support it on .COM and .NET. So that means that your traffic is subject to interception, and essentially all authoritative servers either log queries or have people logging queries off the wire in front of them. And if you're handling your own recursion, everything you don't have cached crosses the wire, and none of it is blended together with anyone else's traffic. To make the decision as to whether it's better to trust a recursive or send queries directly, knowing something about the practices and purpose of the recursive is necessary. Quad9 is the only major recursive that's a public-benefit not-for-profit. There are other small ones which are not-for-profits (like the Taiwanese 101.101.101.101, operated by TWNIC), but all of the others that come near Quad9's scale or traffic are for-profit, operated by companies that monetize data. Quad9 and Cisco's commercial Umbrella service are the only two which are GDPR-compliant and thus legal to provide to European citizens. Quad9 exists solely so that bad choices won't be the only choices. -Bill Woodcock Chairman of the Board of Directors Quad9
- throw0101a 7y ago
  > It is unclear to me why any home user would deliberately opt for DoT. DoH and DoT solve the exact same problem, and DoH is by design harder to filter. Perhaps a parent wants something that's easier to filter. Paul Vixie has said a lot on this topic.
  - tptacek 7y ago
    Yes; Paul Vixie is to DoH what I am to DNSSEC, and his consistent case is "DoH is bad because it's hard for network operators to turn it off for users". To me, that's a ringing endorsement.
    - throw0101a 7y ago
      > To me, that's a ringing endorsement. And to me, who works in IT, it's a bloody annoying. We've already implemented the use-application-dns.net NXDOMAIN canary at work because after some testing Firefox breaks a bunch of apps because of split-horizon DNS. There's already (at least) two malware that's using DoH to get around network monitoring: * https://www.zdnet.com/article/first-ever-malware-strain-spotted-abusing-new-doh-dns-over-https-protocol/ https://www.zdnet.com/article/first-ever-malware-strain-spot... * https://www.zdnet.com/article/psixbot-malware-upgraded-with-google-dns-over-https-sexploitation-kit/ https://www.zdnet.com/article/psixbot-malware-upgraded-with-... If the host is compromised we can no longer trust end-point monitoring, and with DoH/ESNI we lose network monitoring. Awesome. Great work.
      - deleted 7y ago
        [deleted]
      - tptacek 7y ago
        I absolutely understand why it's bloody annoying for network operators. What I don't understand is why any home user should trade even the tiniest iota of their privacy to make your life any easier. You get paid to deal with these problems.
        7y ago
- nominated1 7y ago
  > I preemptively agree that Cloud Flare is not one of those organizations. Would you please elaborate on your distrust of Cloudflare? I’m not looking to call you out. Quite the opposite, I appreciate your candor. I just feel like I’m missing some context.
  - tptacek 7y ago
    I'm not comfortable getting into it here. Just suffice it to say that my support for DoH has absolutely nothing to do with Cloud Flare's support for it.

tptacek 7y ago

Yes. If you're concerned that your third-party resolver is monetizing or otherwise monitoring your DNS, you can run your own DoH recursor, semi-anonymously, from a public cloud account. In the long run, presumably trustworthy organizations will stand up DoH resolvers that people can trust. I preemptively agree that Cloud Flare is not one of those organizations. It is unclear to me why any home user would deliberately opt for DoT. DoH and DoT solve the exact same problem, and DoH is by design harder to filter.

cryptonector 7y ago
We all should be worried about loss of privacy, but we can't all run our own resolvers on the cloud. The choice of DoT vs DoH will mostly be about what is supported by one's choice of resolver. Of course, choosing DoH first will narrow the choice of resolvers. Then there's captive portal situations.
- tptacek 7y ago
  This is a false controversy. The people that "can't" run their own resolvers are, overwhelmingly, using their ISP's resolvers. At least in the US, all of those ISPs are actively attacking their users. Users are better off using practically any other mainstream centralized DNS provider than their ISP default. But this isn't a stable equilibrium; as I said, it seems clear that privacy-minded organizations will eventually stand up their own trustworthy DoH resolvers. DoH makes things somewhat better today for all users, and much better for power users. In the long term, it's easy to see how DoH makes things much better for everybody.
  - cryptonector 7y ago
    Running one's own recursor using DNSSEC via an ISP's resolver (for the privacy benefit relative to authoritatives) would take care of active attacks by ISPs on their users. Windows and Linux could do this you know, but security would be enhanced only relative to sites that use DNSSEC. But I don't disagree that DoH is better. I do hope that in the long run ISPs become less toxic.
    - tptacek 7y ago
      Running one's own resolver with DNSSEC would do absolutely nothing about the ISP threat, since DNSSEC is a cleartext signing-only protocol. Since the overwhelming majority of zones aren't signed, it won't even protect you from the garish NXDOMAIN landing page attack.
      - cryptonector 7y ago
        I was referring to active attacks. I don't consider an ISP or a public resolver operator to be particularly different w.r.t. passive attacks: both get to do it, and both do do it.
psanford 7y ago
Do you think quad9[0] is a trustworthy organization? [0]: https://www.quad9.net https://www.quad9.net
- bwoodcock 7y ago
  Tricky question. I'm the chairman of Quad9's board of directors. So _I_ trust the organization. But I'd urge everyone else not to trust _any_ organization, but instead to do as much to protect yourself as possible, using an external recursive resolver only when you need to. That means running your own caching resolver, with a local copy of the root zone and QNAME minimization enabled, and then using DNS-over-TLS to forward the minimum necessary query onward. The next question then becomes whether to perform recursion yourself (by talking directly with authoritative nameservers) or to have Quad9 or another recursive server perform the recursion for you. Authoritative nameservers don't yet support transport encryption, though we're working very hard to support it on the 500 TLDs PCH is authoritative for, and Verisign is working very hard to support it on .COM and .NET. So that means that your traffic is subject to interception, and essentially all authoritative servers either log queries or have people logging queries off the wire in front of them. And if you're handling your own recursion, everything you don't have cached crosses the wire, and none of it is blended together with anyone else's traffic. To make the decision as to whether it's better to trust a recursive or send queries directly, knowing something about the practices and purpose of the recursive is necessary. Quad9 is the only major recursive that's a public-benefit not-for-profit. There are other small ones which are not-for-profits (like the Taiwanese 101.101.101.101, operated by TWNIC), but all of the others that come near Quad9's scale or traffic are for-profit, operated by companies that monetize data. Quad9 and Cisco's commercial Umbrella service are the only two which are GDPR-compliant and thus legal to provide to European citizens. Quad9 exists solely so that bad choices won't be the only choices. -Bill Woodcock Chairman of the Board of Directors Quad9
throw0101a 7y ago
> It is unclear to me why any home user would deliberately opt for DoT. DoH and DoT solve the exact same problem, and DoH is by design harder to filter. Perhaps a parent wants something that's easier to filter. Paul Vixie has said a lot on this topic.
- tptacek 7y ago
  Yes; Paul Vixie is to DoH what I am to DNSSEC, and his consistent case is "DoH is bad because it's hard for network operators to turn it off for users". To me, that's a ringing endorsement.
  - throw0101a 7y ago
    > To me, that's a ringing endorsement. And to me, who works in IT, it's a bloody annoying. We've already implemented the use-application-dns.net NXDOMAIN canary at work because after some testing Firefox breaks a bunch of apps because of split-horizon DNS. There's already (at least) two malware that's using DoH to get around network monitoring: * https://www.zdnet.com/article/first-ever-malware-strain-spotted-abusing-new-doh-dns-over-https-protocol/ https://www.zdnet.com/article/first-ever-malware-strain-spot... * https://www.zdnet.com/article/psixbot-malware-upgraded-with-google-dns-over-https-sexploitation-kit/ https://www.zdnet.com/article/psixbot-malware-upgraded-with-... If the host is compromised we can no longer trust end-point monitoring, and with DoH/ESNI we lose network monitoring. Awesome. Great work.
    - deleted 7y ago
      [deleted]
    - tptacek 7y ago
      I absolutely understand why it's bloody annoying for network operators. What I don't understand is why any home user should trade even the tiniest iota of their privacy to make your life any easier. You get paid to deal with these problems.
      - 7y ago
nominated1 7y ago
> I preemptively agree that Cloud Flare is not one of those organizations. Would you please elaborate on your distrust of Cloudflare? I’m not looking to call you out. Quite the opposite, I appreciate your candor. I just feel like I’m missing some context.
- tptacek 7y ago
  I'm not comfortable getting into it here. Just suffice it to say that my support for DoH has absolutely nothing to do with Cloud Flare's support for it.