3 ms·

In certain situations, even home users are in the same position as network operators. The processes running on their machines will use exactly these same mechan

In certain situations, even home users are in the same position as network operators. The processes running on their machines will use exactly these same mechanisms to escape the user control. The last few years have shown, that big brand names are not to be trusted, and their interests, as implemented in their software, are not aligned with user interests. In a way, we are getting back full-circle to Stallman. DoH+ESNI will make it even harder.

tptacek 7y ago
I don't understand whether you're saying that DoH+ESNI will make it harder for malicious network operators to compromise user privacy (clearly true) or whether DoH+ESNI will make it harder for home users to run their networks as if they were enterprise networks. It would be a genuinely weird new take to argue that encrypted SNI was somehow harmful to privacy.
- vetinari 7y ago
  What is privacy? The same way the home user can get privacy from the network operator, can malware get its privacy from the home user. This is amplified by moving DNS resolution into applications, Mozilla style. Now even the operating system or local firewall applications (Little Snitch, etc) can't know, where the processes are connecting. Again, the application vendors can have objectives that are not aligned with the users. It is a mistake to conflate the home users with random applications running on their computers.
  - tptacek 7y ago
    This argument doesn't make any sense. TLS SNI hostnames should remain unencrypted to help user privacy?
    - vetinari 7y ago
      No. The argument is, that a random process should not be a world into itself; there should be a way to check on what it is doing. It does not have to be network based, it can be done by another process on the local machine. Things like DNS should be done by the OS, with hooks for the monitoring. It should be not be done by the application, with zero transparency to the owner. The system resolver, on the other hand, can use DoH/DoT/ESNI/whatever. Giving random processes unlimited, uncontrolled and uncontrollable access to Internet is disaster waiting to happen. Quite similar to what happened to applications on Android.
      - tptacek 7y ago
        What does the system resolver have to do with encrypting TLS SNI?
        vetinari 7y ago
        With the privacy. I don't know, whether I'm expressing badly due to English not being my native language, or where is the problem in understanding. I hope that you are not just misunderstanding intentionally. So once again: The combination of ESNI and DNS resolving inside applications (and not OS, not checked by some user agent) provides privacy to application, not users. That application might or might not have its objectives aligned with the users; more often than not, it will focus on interests of its vendor instead. So conflating privacy for application with privacy for user is mistake. By applications using custom DNS+ESNI, the user loses control over who the application communicates with, he just sees that it can send and receive blobs. What it is sending out, to whom, is and will be unknown. That is the negative wrt user's privacy, compared to which the current Android ecosystem is squeaky clean.
- throw0101a 7y ago
  > It would be a genuinely weird new take to argue that encrypted SNI was somehow harmful to privacy. As a 'network operator' at work and home, it is my responsibility to keep my network clean. Both for my own sake and for the sake of the greater Internet (is malware being spread from my network?). End-host security is used to make sure that connected systems are clean. But if the end-host is compromised, then that may now become useless. So a second level of security is network monitoring. However, how can I be responsible network operator if I have no visibility into my own infrastructure? DoH by-passing local DNS, and ESNI cloaking the destinations, make it impossible to see who is doing what. At least with Do53 (and DoT) I can control lookups (possibly to C&C servers).

tptacek 7y ago

I don't understand whether you're saying that DoH+ESNI will make it harder for malicious network operators to compromise user privacy (clearly true) or whether DoH+ESNI will make it harder for home users to run their networks as if they were enterprise networks. It would be a genuinely weird new take to argue that encrypted SNI was somehow harmful to privacy.

vetinari 7y ago
What is privacy? The same way the home user can get privacy from the network operator, can malware get its privacy from the home user. This is amplified by moving DNS resolution into applications, Mozilla style. Now even the operating system or local firewall applications (Little Snitch, etc) can't know, where the processes are connecting. Again, the application vendors can have objectives that are not aligned with the users. It is a mistake to conflate the home users with random applications running on their computers.
- tptacek 7y ago
  This argument doesn't make any sense. TLS SNI hostnames should remain unencrypted to help user privacy?
  - vetinari 7y ago
    No. The argument is, that a random process should not be a world into itself; there should be a way to check on what it is doing. It does not have to be network based, it can be done by another process on the local machine. Things like DNS should be done by the OS, with hooks for the monitoring. It should be not be done by the application, with zero transparency to the owner. The system resolver, on the other hand, can use DoH/DoT/ESNI/whatever. Giving random processes unlimited, uncontrolled and uncontrollable access to Internet is disaster waiting to happen. Quite similar to what happened to applications on Android.
    - tptacek 7y ago
      What does the system resolver have to do with encrypting TLS SNI?
      - vetinari 7y ago
        With the privacy. I don't know, whether I'm expressing badly due to English not being my native language, or where is the problem in understanding. I hope that you are not just misunderstanding intentionally. So once again: The combination of ESNI and DNS resolving inside applications (and not OS, not checked by some user agent) provides privacy to application, not users. That application might or might not have its objectives aligned with the users; more often than not, it will focus on interests of its vendor instead. So conflating privacy for application with privacy for user is mistake. By applications using custom DNS+ESNI, the user loses control over who the application communicates with, he just sees that it can send and receive blobs. What it is sending out, to whom, is and will be unknown. That is the negative wrt user's privacy, compared to which the current Android ecosystem is squeaky clean.
throw0101a 7y ago
> It would be a genuinely weird new take to argue that encrypted SNI was somehow harmful to privacy. As a 'network operator' at work and home, it is my responsibility to keep my network clean. Both for my own sake and for the sake of the greater Internet (is malware being spread from my network?). End-host security is used to make sure that connected systems are clean. But if the end-host is compromised, then that may now become useless. So a second level of security is network monitoring. However, how can I be responsible network operator if I have no visibility into my own infrastructure? DoH by-passing local DNS, and ESNI cloaking the destinations, make it impossible to see who is doing what. At least with Do53 (and DoT) I can control lookups (possibly to C&C servers).