11 ms·

A cartoon intro to DNS over HTTPS (2018)

rishav_sharan 7y ago
Why is there no Google container extension? Sometimes it feels that Mozilla is just paying token lip service to the idea of privacy.
- ForHackernews 7y ago
  https://addons.mozilla.org/en-US/firefox/addon/google-container/ https://addons.mozilla.org/en-US/firefox/addon/google-contai...
- tasogare 7y ago
  With 90% of their money coming from Google for decades they can’t bite the hand that feed them. The question is why Google is keeping them afloat? My guess is that a few millions here and there to create the illusion of competition is way cheaper than having a monopoly investigation.
sdan 7y ago
This is why I love Cloudflare. Makes everything secure and faster... for free (not to mention how easy it is to make records and go into developer mode to purge caching for a bit)
- quickthrower2 7y ago
  I found running the bash script to set up Let's Encrypt on a Digital Ocean box honestly easier than navigating through Cloudflare's admin web UI.
  - sdan 7y ago
    I think it was certbot that was recommended by DO to use; I used certbot and it was super easy to setup, but at the moment I feel that Cloudflare's security, fast delivery, and analytics will keep me onboard until I can self host/do myself when I have a good amount of time.
- avian 7y ago
  Have you asked yourself how they can make everything free? What are their incentives? When they successfully centralized majority of DNS resolving, what could they do with that power? Keep in mind that even if their motives are pure at the moment, management and ownership of companies can change. Look a few years back and you’ll find similar enthusiastic comments about Google: they make everything better and for free. Everyone should use their search, everyone should move to GMail, etc.
  - sdan 7y ago
    Good points. As others have said, I'll probably move off later on, but for now I intend to stay with them (similarly I've been with Gmail for a while and now moved off to stuff like Fastmail, hosting my own "dropbox", etc.). Primarily because for beginners it's a bit easier to setup everything without much hassle.
- alacombe 7y ago
  ...as long as the target isn't getting too much negative exposure, and when this will happen (it will), they will happily block that resource.
  - sdan 7y ago
    Good point. I think they crossed a line when they shut down controversial sites, which they shouldn't have, but at the same time it's easier for beginners to start out with everything.
- pnako 7y ago
  Well, it's not really free, government is funded using our tax money, but I get your point.
throwaway191020 7y ago
I have a concern. DNS over HTTPS feels to me like we're edging towards end-to-end encryption for DNS. This seems like a good thing, but even though it will protect against ISP and state level observations of DNS, will it not reduce ones control over DNS locally? My threat model remains web site operators and the malware and tracking inserted at that point. Additionally devices on the network that may observe locally and communicate externally like TV boxes and games consoles. To manage those threats I use Pi-Hole. But once we start end-to-end encrypting, and especially when we start verifying those ends, how do I locally intercept and manage DNS for my privacy and security? Is this a genuine concern about DNS over HTTPS? Or is the plan to enable systems like Pi-Hole to be a trusted and configurable resolver too so that consumers retain the ability to control their own systems like this?
- canofbars 7y ago
  You just have to make your Pi Hole a proxy. You configure your OS/Firefox to connect to the pi for dns and the pi makes the request for the dns record.
  - xg15 7y ago
    All this assumes though that the devices can be configured to do that. While that's likely for browsers, it's less likely for smart TVs or other IoT devices, especially if you don't trust the devices in the first place. (Edit: removed bit about root CA certs because I misunderstood)
    - ytch 7y ago
      how about setup iptables to forward all DNS traffic to self-hosted Pi-hole?
      - arpa 7y ago
        if the certificates are pinned, you're screwed. Even if they aren't, it's a matter of luck if your smart$thing accepts self-signed certificates for $thingsdomain.
colllectorof 7y ago
Firefox could make a long-need replacement for DNS, but they chose to spend all this effort on adding more ducktape to the current system, while also contributing to its centralization (more control to Cloduflare, yay). DNS was a passable solution in the 80s, but right now it's absolute shit.
zaro 7y ago
I don't really understand what kind of improvement is the DNS over HTTPS. Yes some middle parties won't be able to tamper with my DNS queries. At what price? Total control for the people providing the DOH endpoints. So chrome for sure will be using Google DNS for this, and with their efforts to remove ad blocking this fits nicely that you won't be able to use simply DNS based blocker.
- marksomnian 7y ago
  We already have this situation though - the people who control DNS resolvers already have total control. ISPs have already been known to abuse this power [0]. This proposal doesn't solve this problem. Rather, it solves the problem of e.g. your ISP intercepting, logging and/or modifying your DNS request. The solution will then just be to run your own DoH endpoint / proxy. [0]: https://arstechnica.com/tech-policy/2009/08/comcasts-dns-redirect-service-goes-nationwide/ https://arstechnica.com/tech-policy/2009/08/comcasts-dns-red...
  - zaro 7y ago
    My first question in running my own DOH proxy will be how it works in my home network? Right now I have my own dns configuration on my router, and any device that connects to the router is automatically using this dns. With DOH this doesn't seem to be the case though. I'll need to go and change the settings for each device to use my own DOH proxy. But whether I'll be allowed to do so is quite unclear if you ask me. Becauae what happens when chrome says : "we have you covered, it's best to use only our DNS over HTTPS. If you need something else you can buy enterprise subscription"
    - zamadatix 7y ago
      Are you worried about things like Chrome fucking you over or are you worried about DNS encryption? The former does not require the latter, it's just one of a million ways to do it. Probably one of the more roundabout ways to be honest.
      - 7y ago
belorn 7y ago
Over the year of discussions in regard to DNS over HTTPS I find the best illustration is to look at email. Your email client on the phone or PC send to a email over SMTP to a email server, the server look at the address and contact the recipient server and delivers the request. In email it is client->MTA->server-recipient. In DNS it is client->Resolver->Authoritive-server with the answer traveling back in the chain. A little historical similarity, ISP used to provide a default MTA servers just like they do with resolver. Now days it most people use a email provider of choice. So lets now imagine we solved the plain text problem of email by having the client use a default list of trusted MTA, with thunderbird defaulting to partner with gmail, and just sent it there over HTTPS. Gmail would take the email and forward it in plaintext to the recipient-server. Email security did not follow that path. There we collectively decided to first encrypt communication between the client and the MTA using TLS, addressing the first step in the chain. Then the communication between MTA and recipient server got encrypted. In order to prevent downgrade attacks there is also currently two competing standards, one based on DNS and the other on HTTPS side channel. Looking at email, we are also almost done converting the plain text protocol to encrypted: https://transparencyreport.google.com/safer-email/overview https://transparencyreport.google.com/safer-email/overview The general question is then, why not just copy the success of email? The answer it seem is about money. No company got more users or data when email protocols got encrypted. Cloudflare however will benefit if everyone route their DNS through them as that gives them a comparable performance benefit when people use them as a hosting provider. They also say they won't sell data, but people who move their domain hosting to cloudflare and pay for Pro, Business and Enterprise plan can get access to DNS analytics.
- scrollaway 7y ago
  Whatever happened to DNSCrypt? I remember setting it up and happily using it for over a year without any issues a few years ago.
  - zamadatix 7y ago
    It was never brought forward for standardization and quickly got replaced by protocols that were. While it used UDP or TCP 443 it was a custom protocol so clients had to implement it manually and you couldn't run an HTTPS server on the same port (without modifying the HTTPS server/load balancer). It also relied on a separate certificate infrastructure. Shortly after DoT and DoH came along as standardized proposals with fewer NIH issues and more interoperability. DoH also has the bonus of looking like standard HTTPS traffic to the resolver. Technically e.g. Google could host DoH on google.com/dns-query and it would be hidden in the deluge of HTTPS that already goes to google.com.
ohazi 7y ago
One of the big concerns here is that this is another instance of "making the internet less decentralized by leaning on Cloudflare." Someone once pointed out that if the NSA wanted to build a front company whose goal was to make hoovering up the internet easier, it would probably look a lot like Cloudflare. I'm generally not much of a conspiracy theorist, but this one has been frustratingly difficult to shrug off.
- oskapt 7y ago
  It can be less conspiratorial than that. It is a legal and diplomatic challenge for the US to get permission or to install infrastructure to monitor traffic in foreign countries. It is much easier for Cloudflare to drop an ingress server there, and they decrypt all TLS traffic that lands on their systems before possibly re-encrypting it and forwarding it over their private network. Cloudflare is a US company and subject to US coercion. It would be trivial for the US to force Cloudflare to give them access to that data, and with Cloudflare currently decrypting ~10% of all Internet traffic, why wouldn't they? How about the fact that Cloudflare-issued certificates are for dozens of domains? If the US wants to snoop on foreign domain X, a US order for US domain Y, also on the same cert, would give them the private key. It's not possible to detect abuse in this system. It requires that we trust the state to not abuse their power, and we've seen them lie about that already. The mere fact that the Cloudflare system _can_ be abused is, in my opinion, enough reason to go nowhere near it for anything.
  - judge2020 7y ago
    Valid concern, just addressing this: > How about the fact that Cloudflare-issued certificates are for dozens of domains? If the US wants to snoop on foreign domain X, a US order for US domain Y, also on the same cert, would give them the private key. Caveat 1 is that they've started to issue 1 cert per domain (I believe only for ECDSA certificates, aka ones that use their own CA), and caveat 2 is that you don't get the actual browser-trusted private key (of course the NSA could demand they turn it over).
    - oskapt 7y ago
peanut-walrus 7y ago
So they start with talking about ESNI and then kinda completely gloss over it afterwards. Yeah you can reuse the TLS session if several sites are using the same CDN, however, this is again relying on centralization for privacy. The cool thing about DNS architecture is the fact that it is decentralized. Mozilla's plan with DoH tries to fix missing features in DNS by getting rid of arguably the biggest killer feature DNS has. Furthermore, several governments use DNS right now to block websites deemed illegal in their country. Not just authoritarian states that attempt to censor material critical to the regime, but also western countries (copyright infringement, child porn, gambling, etc). Does Mozilla and Cloudflare seriously think they will just go "oh ok, I guess everything is unblocked again now". No, they will either force Cloudflare to do the same or force local ISPs to implement even stronger filtering controls.
- JoshTriplett 7y ago
  There's a huge additional authoritarian step required to push MITM of all traffic. You cannot do that without people at the endpoints noticing. DNS-based "filtering" can pass unnoticed by many people; full MITM of all traffic cannot. When a regime does something that only a small subset of people notice, it's easier to suppress that small subset of people, with a combination of PR and just ignoring them. When a regime does something that everyone notices, it has to be prepared to be visibly acting against a large fraction of its people. DoH won't stop a sufficiently determined regime from attempting to control the Internet, but it will stop less determined regimes from doing so quietly and getting away with it with minimal resistance, and not every regime is prepared for the implications and backlash of implementing country-wide MITM. And on a more local scale, DoH also increases friction towards smaller entities trying to quietly control access to the Internet, such as ISPs or random wifi hotspots.
- tialaramex 7y ago
  > Does Mozilla and Cloudflare seriously think they will just go "oh ok, I guess everything is unblocked again now". No, they will either force Cloudflare to do the same or force local ISPs to implement even stronger filtering controls. We have an actual worked example to look at: The British government decided that all pornography in the whole world should require proof of age so that British kids couldn't see it. They got all the legislation done, they got civil servants to write them a "White Paper" explaining how this would work, they selected a censor to manage the inevitable rulings saying that this or that pornographer didn't obey the rules and enforce DNS censorship. And then, just weeks ago after much "delay" and "reconsideration", they U-turned. Because the part where you enforce the rules by "just" censoring DNS isn't practical under DPRIVE. You say they'll just "force" local ISPs to implement "even stronger filtering controls" but the only "stronger" option is to proxy all of HTTPS. How were the IPSs going to pay for this? Mandatory price increases? Or are the government going to do the work and just raise taxes to pay for it? "Vote Conservative: Higher prices, worse service, more taxes, more censorship. Corruption and incompetence are our watchwords" ? This works fine in China. The government wants to spend your money on a "Great Firewall"? Nothing you can do about it. Not so much in a country with anything resembling democracy left.
ga-vu 7y ago
My problem is that this is highly overhyped by the Mozilla/Cloudflare PR teams, and both companies stand to make money out of it. A better solution would be DoT+DNSSEC: https://twitter.com/jschauma/status/1184483451111727106 https://twitter.com/jschauma/status/1184483451111727106 I don't trust Mozilla anymore, especially after becoming a VPN vendor and partnering with Cloudflare. They now have commercial interests in pushing standards down on everybody, similar to Google.
- oskapt 7y ago
  My ISP (Entel Chile) started blocking DNS requests to non-Entel servers in July. DoT would not give me a way around this, because they can still see that it is DNS traffic by the port. DoH mixes DNS traffic in with the noise of HTTPS traffic, allowing me to run my own DoH resolvers and bypass their restrictions.
  - teddyh 7y ago
    Once your ISP starts mucking with and blocking your traffic, what you need is a VPN and/or Tor – DoH is a very partial solution at best. What DoH gives you is merely a correct answer to a DNS lookup of an IP address. But if your ISP blocks traffic to that IP address, which they could, you’re still blocked; DoH did not help you.
    - judge2020 7y ago
      The ISP is trying to block other DNS traffic, they're not necessarily trying to block certain websites (or if they are, they wouldn't want to block [for example] all of Cloudflare or the GCP load balancers to block porn hosted on either of those services). DoH solves that problem as directly as possible without going to solutions that have other side-effects.
      - teddyh 7y ago
        The ISP do most certainly want to block web sites. The currently most common method is to block DNS, but they could, and will, switch to IP blocking in a heartbeat if they have to. > they wouldn't want to block [for example] all of Cloudflare or the GCP load balancers If your only defense against blocking by your ISP is to centralize web server hosting, then you’re just moving the problem to there instead. Cloudflare also blocks, or “deplatforms”, those they deem unseemly. And once someone is taken off the centralized web server hosts, they can be blocked by your ISP again. You’re not solving the problem in the long term. DoH is fighting yesterday’s war.
user827272 7y ago
> So how do we fix these? > Avoid untrustworthy resolvers by using Trusted Recursive Resolver. If it's to trust a resolver just 1.1.1.1 (or whatever) > Protect against on-path eavesdropping and tampering using DNS over HTTPS. This is the only real change but it is useless for everything outside a CDN Whit is basically everything that matters for users > Transmit as little data as possible to protect users from deanonymization. QNAME minimization can be done already, it is not a DoH thing
xg15 7y ago
As another post on HN argued a few weeks ago and as is stated in this article again: > After you do the DNS lookup to find the IP address, you still need to connect to the web server at that address. To do this, you send an initial request. This request includes a server name indication, which says which site on the server you want to connect to. And this request is unencrypted. Note that, until encrypted SNI is in place, DoH does not actually increase your privacy. Your ISP can still track all domains you connect to by analyzing the SNI header. The only thing they cannot do anymore is block or redirect any of the domains.
jwilk 7y ago
Previous discussion: https://news.ycombinator.com/item?id=17196415 https://news.ycombinator.com/item?id=17196415
judge2020 7y ago
I'll say what has been said time and time again in the past: CF should not be the default server. There shouldn't be a default server. Have an onboarding flow that says "choose DNS server" and allow the user to choose between clearly-unencrypted endpoints (ISP/router, Google, quad9, etc) and encrypted endpoints that use DoH. And again, Google's DoH solution is infinitely less controversial: an upgrade list[0] so that, if your computer/router advertises 1^4, it uses Cloudflare's DoH. If it advertises 8^4, it uses https://dns.google https://dns.google. It even works for a provider known as clean browsing[1] that filters DNS. 0: https://blog.chromium.org/2019/09/experimenting-with-same-provider-dns.html https://blog.chromium.org/2019/09/experimenting-with-same-pr... 1: https://github.com/chromium/chromium/blob/711b1ba2735f8af4bd6359c6292e1875412df74f/net/dns/dns_util.cc#L146-L217 https://github.com/chromium/chromium/blob/711b1ba2735f8af4bd...
- mcnichol 7y ago
  Having a default vs needing to understand all of this? Do you believe you are selecting the path of least resistance? How many defaults in systems do you use today so you aren't configuring the dials and knobs of a spaceship everytime you power on. Using Cloudflare as a default vs the ISP's defaults. If you care you can learn and change them the same way we operate today. The browser is a product, UX wins. How do I make my product easy to use while still maintaining a security forward stance? Defaults.
  - mcnichol 7y ago
    > However, we’ve spent time studying these risks… and we have negotiating power. We worked hard to find a company to work with us to protect users’ DNS data. And we found one: Cloudflare. > Cloudflare is providing a recursive resolution service with a pro-user privacy policy. They have committed to throwing away all personally identifiable data after 24 hours, and to never pass that data along to third-parties. And there will be regular audits to ensure that data is being cleared as expected. I think this is a fair and reasonable reason to land on Cloudflare if they are willing to cooperate in interest of the user and make their organization open to audits aligned to that. I don't understand the hyped up hate on picking a default who is appearing to be going over the top as an ally for end users privacy, users aren't forced into staying with, and would be an arguably more transparent starting point than what people have today.
davidjnelson 7y ago
This is really exciting for security. Lin, you are so talented!!! Great work explaining this, wow!

Why is there no Google container extension? Sometimes it feels that Mozilla is just paying token lip service to the idea of privacy.

ForHackernews 7y ago
https://addons.mozilla.org/en-US/firefox/addon/google-container/ https://addons.mozilla.org/en-US/firefox/addon/google-contai...
tasogare 7y ago
With 90% of their money coming from Google for decades they can’t bite the hand that feed them. The question is why Google is keeping them afloat? My guess is that a few millions here and there to create the illusion of competition is way cheaper than having a monopoly investigation.

sdan 7y ago

This is why I love Cloudflare. Makes everything secure and faster... for free (not to mention how easy it is to make records and go into developer mode to purge caching for a bit)

quickthrower2 7y ago
I found running the bash script to set up Let's Encrypt on a Digital Ocean box honestly easier than navigating through Cloudflare's admin web UI.
- sdan 7y ago
  I think it was certbot that was recommended by DO to use; I used certbot and it was super easy to setup, but at the moment I feel that Cloudflare's security, fast delivery, and analytics will keep me onboard until I can self host/do myself when I have a good amount of time.
avian 7y ago
Have you asked yourself how they can make everything free? What are their incentives? When they successfully centralized majority of DNS resolving, what could they do with that power? Keep in mind that even if their motives are pure at the moment, management and ownership of companies can change. Look a few years back and you’ll find similar enthusiastic comments about Google: they make everything better and for free. Everyone should use their search, everyone should move to GMail, etc.
- sdan 7y ago
  Good points. As others have said, I'll probably move off later on, but for now I intend to stay with them (similarly I've been with Gmail for a while and now moved off to stuff like Fastmail, hosting my own "dropbox", etc.). Primarily because for beginners it's a bit easier to setup everything without much hassle.
alacombe 7y ago
...as long as the target isn't getting too much negative exposure, and when this will happen (it will), they will happily block that resource.
- sdan 7y ago
  Good point. I think they crossed a line when they shut down controversial sites, which they shouldn't have, but at the same time it's easier for beginners to start out with everything.
pnako 7y ago
Well, it's not really free, government is funded using our tax money, but I get your point.

throwaway191020 7y ago

I have a concern. DNS over HTTPS feels to me like we're edging towards end-to-end encryption for DNS. This seems like a good thing, but even though it will protect against ISP and state level observations of DNS, will it not reduce ones control over DNS locally? My threat model remains web site operators and the malware and tracking inserted at that point. Additionally devices on the network that may observe locally and communicate externally like TV boxes and games consoles. To manage those threats I use Pi-Hole. But once we start end-to-end encrypting, and especially when we start verifying those ends, how do I locally intercept and manage DNS for my privacy and security? Is this a genuine concern about DNS over HTTPS? Or is the plan to enable systems like Pi-Hole to be a trusted and configurable resolver too so that consumers retain the ability to control their own systems like this?

canofbars 7y ago
You just have to make your Pi Hole a proxy. You configure your OS/Firefox to connect to the pi for dns and the pi makes the request for the dns record.
- xg15 7y ago
  All this assumes though that the devices can be configured to do that. While that's likely for browsers, it's less likely for smart TVs or other IoT devices, especially if you don't trust the devices in the first place. (Edit: removed bit about root CA certs because I misunderstood)
  - ytch 7y ago
    how about setup iptables to forward all DNS traffic to self-hosted Pi-hole?
    - arpa 7y ago
      if the certificates are pinned, you're screwed. Even if they aren't, it's a matter of luck if your smart$thing accepts self-signed certificates for $thingsdomain.

colllectorof 7y ago

Firefox could make a long-need replacement for DNS, but they chose to spend all this effort on adding more ducktape to the current system, while also contributing to its centralization (more control to Cloduflare, yay). DNS was a passable solution in the 80s, but right now it's absolute shit.

zaro 7y ago

I don't really understand what kind of improvement is the DNS over HTTPS. Yes some middle parties won't be able to tamper with my DNS queries. At what price? Total control for the people providing the DOH endpoints. So chrome for sure will be using Google DNS for this, and with their efforts to remove ad blocking this fits nicely that you won't be able to use simply DNS based blocker.

marksomnian 7y ago
We already have this situation though - the people who control DNS resolvers already have total control. ISPs have already been known to abuse this power [0]. This proposal doesn't solve this problem. Rather, it solves the problem of e.g. your ISP intercepting, logging and/or modifying your DNS request. The solution will then just be to run your own DoH endpoint / proxy. [0]: https://arstechnica.com/tech-policy/2009/08/comcasts-dns-redirect-service-goes-nationwide/ https://arstechnica.com/tech-policy/2009/08/comcasts-dns-red...
- zaro 7y ago
  My first question in running my own DOH proxy will be how it works in my home network? Right now I have my own dns configuration on my router, and any device that connects to the router is automatically using this dns. With DOH this doesn't seem to be the case though. I'll need to go and change the settings for each device to use my own DOH proxy. But whether I'll be allowed to do so is quite unclear if you ask me. Becauae what happens when chrome says : "we have you covered, it's best to use only our DNS over HTTPS. If you need something else you can buy enterprise subscription"
  - zamadatix 7y ago
    Are you worried about things like Chrome fucking you over or are you worried about DNS encryption? The former does not require the latter, it's just one of a million ways to do it. Probably one of the more roundabout ways to be honest.
    - 7y ago

belorn 7y ago

Over the year of discussions in regard to DNS over HTTPS I find the best illustration is to look at email. Your email client on the phone or PC send to a email over SMTP to a email server, the server look at the address and contact the recipient server and delivers the request. In email it is client->MTA->server-recipient. In DNS it is client->Resolver->Authoritive-server with the answer traveling back in the chain. A little historical similarity, ISP used to provide a default MTA servers just like they do with resolver. Now days it most people use a email provider of choice. So lets now imagine we solved the plain text problem of email by having the client use a default list of trusted MTA, with thunderbird defaulting to partner with gmail, and just sent it there over HTTPS. Gmail would take the email and forward it in plaintext to the recipient-server. Email security did not follow that path. There we collectively decided to first encrypt communication between the client and the MTA using TLS, addressing the first step in the chain. Then the communication between MTA and recipient server got encrypted. In order to prevent downgrade attacks there is also currently two competing standards, one based on DNS and the other on HTTPS side channel. Looking at email, we are also almost done converting the plain text protocol to encrypted: https://transparencyreport.google.com/safer-email/overview https://transparencyreport.google.com/safer-email/overview The general question is then, why not just copy the success of email? The answer it seem is about money. No company got more users or data when email protocols got encrypted. Cloudflare however will benefit if everyone route their DNS through them as that gives them a comparable performance benefit when people use them as a hosting provider. They also say they won't sell data, but people who move their domain hosting to cloudflare and pay for Pro, Business and Enterprise plan can get access to DNS analytics.

scrollaway 7y ago
Whatever happened to DNSCrypt? I remember setting it up and happily using it for over a year without any issues a few years ago.
- zamadatix 7y ago
  It was never brought forward for standardization and quickly got replaced by protocols that were. While it used UDP or TCP 443 it was a custom protocol so clients had to implement it manually and you couldn't run an HTTPS server on the same port (without modifying the HTTPS server/load balancer). It also relied on a separate certificate infrastructure. Shortly after DoT and DoH came along as standardized proposals with fewer NIH issues and more interoperability. DoH also has the bonus of looking like standard HTTPS traffic to the resolver. Technically e.g. Google could host DoH on google.com/dns-query and it would be hidden in the deluge of HTTPS that already goes to google.com.

ohazi 7y ago

One of the big concerns here is that this is another instance of "making the internet less decentralized by leaning on Cloudflare." Someone once pointed out that if the NSA wanted to build a front company whose goal was to make hoovering up the internet easier, it would probably look a lot like Cloudflare. I'm generally not much of a conspiracy theorist, but this one has been frustratingly difficult to shrug off.

oskapt 7y ago
It can be less conspiratorial than that. It is a legal and diplomatic challenge for the US to get permission or to install infrastructure to monitor traffic in foreign countries. It is much easier for Cloudflare to drop an ingress server there, and they decrypt all TLS traffic that lands on their systems before possibly re-encrypting it and forwarding it over their private network. Cloudflare is a US company and subject to US coercion. It would be trivial for the US to force Cloudflare to give them access to that data, and with Cloudflare currently decrypting ~10% of all Internet traffic, why wouldn't they? How about the fact that Cloudflare-issued certificates are for dozens of domains? If the US wants to snoop on foreign domain X, a US order for US domain Y, also on the same cert, would give them the private key. It's not possible to detect abuse in this system. It requires that we trust the state to not abuse their power, and we've seen them lie about that already. The mere fact that the Cloudflare system _can_ be abused is, in my opinion, enough reason to go nowhere near it for anything.
- judge2020 7y ago
  Valid concern, just addressing this: > How about the fact that Cloudflare-issued certificates are for dozens of domains? If the US wants to snoop on foreign domain X, a US order for US domain Y, also on the same cert, would give them the private key. Caveat 1 is that they've started to issue 1 cert per domain (I believe only for ECDSA certificates, aka ones that use their own CA), and caveat 2 is that you don't get the actual browser-trusted private key (of course the NSA could demand they turn it over).
  - oskapt 7y ago

peanut-walrus 7y ago

So they start with talking about ESNI and then kinda completely gloss over it afterwards. Yeah you can reuse the TLS session if several sites are using the same CDN, however, this is again relying on centralization for privacy. The cool thing about DNS architecture is the fact that it is decentralized. Mozilla's plan with DoH tries to fix missing features in DNS by getting rid of arguably the biggest killer feature DNS has. Furthermore, several governments use DNS right now to block websites deemed illegal in their country. Not just authoritarian states that attempt to censor material critical to the regime, but also western countries (copyright infringement, child porn, gambling, etc). Does Mozilla and Cloudflare seriously think they will just go "oh ok, I guess everything is unblocked again now". No, they will either force Cloudflare to do the same or force local ISPs to implement even stronger filtering controls.

JoshTriplett 7y ago
There's a huge additional authoritarian step required to push MITM of all traffic. You cannot do that without people at the endpoints noticing. DNS-based "filtering" can pass unnoticed by many people; full MITM of all traffic cannot. When a regime does something that only a small subset of people notice, it's easier to suppress that small subset of people, with a combination of PR and just ignoring them. When a regime does something that everyone notices, it has to be prepared to be visibly acting against a large fraction of its people. DoH won't stop a sufficiently determined regime from attempting to control the Internet, but it will stop less determined regimes from doing so quietly and getting away with it with minimal resistance, and not every regime is prepared for the implications and backlash of implementing country-wide MITM. And on a more local scale, DoH also increases friction towards smaller entities trying to quietly control access to the Internet, such as ISPs or random wifi hotspots.
tialaramex 7y ago
> Does Mozilla and Cloudflare seriously think they will just go "oh ok, I guess everything is unblocked again now". No, they will either force Cloudflare to do the same or force local ISPs to implement even stronger filtering controls. We have an actual worked example to look at: The British government decided that all pornography in the whole world should require proof of age so that British kids couldn't see it. They got all the legislation done, they got civil servants to write them a "White Paper" explaining how this would work, they selected a censor to manage the inevitable rulings saying that this or that pornographer didn't obey the rules and enforce DNS censorship. And then, just weeks ago after much "delay" and "reconsideration", they U-turned. Because the part where you enforce the rules by "just" censoring DNS isn't practical under DPRIVE. You say they'll just "force" local ISPs to implement "even stronger filtering controls" but the only "stronger" option is to proxy all of HTTPS. How were the IPSs going to pay for this? Mandatory price increases? Or are the government going to do the work and just raise taxes to pay for it? "Vote Conservative: Higher prices, worse service, more taxes, more censorship. Corruption and incompetence are our watchwords" ? This works fine in China. The government wants to spend your money on a "Great Firewall"? Nothing you can do about it. Not so much in a country with anything resembling democracy left.

ga-vu 7y ago

My problem is that this is highly overhyped by the Mozilla/Cloudflare PR teams, and both companies stand to make money out of it. A better solution would be DoT+DNSSEC: https://twitter.com/jschauma/status/1184483451111727106 https://twitter.com/jschauma/status/1184483451111727106 I don't trust Mozilla anymore, especially after becoming a VPN vendor and partnering with Cloudflare. They now have commercial interests in pushing standards down on everybody, similar to Google.

oskapt 7y ago
My ISP (Entel Chile) started blocking DNS requests to non-Entel servers in July. DoT would not give me a way around this, because they can still see that it is DNS traffic by the port. DoH mixes DNS traffic in with the noise of HTTPS traffic, allowing me to run my own DoH resolvers and bypass their restrictions.
- teddyh 7y ago
  Once your ISP starts mucking with and blocking your traffic, what you need is a VPN and/or Tor – DoH is a very partial solution at best. What DoH gives you is merely a correct answer to a DNS lookup of an IP address. But if your ISP blocks traffic to that IP address, which they could, you’re still blocked; DoH did not help you.
  - judge2020 7y ago
    The ISP is trying to block other DNS traffic, they're not necessarily trying to block certain websites (or if they are, they wouldn't want to block [for example] all of Cloudflare or the GCP load balancers to block porn hosted on either of those services). DoH solves that problem as directly as possible without going to solutions that have other side-effects.
    - teddyh 7y ago
      The ISP do most certainly want to block web sites. The currently most common method is to block DNS, but they could, and will, switch to IP blocking in a heartbeat if they have to. > they wouldn't want to block [for example] all of Cloudflare or the GCP load balancers If your only defense against blocking by your ISP is to centralize web server hosting, then you’re just moving the problem to there instead. Cloudflare also blocks, or “deplatforms”, those they deem unseemly. And once someone is taken off the centralized web server hosts, they can be blocked by your ISP again. You’re not solving the problem in the long term. DoH is fighting yesterday’s war.

user827272 7y ago

> So how do we fix these? > Avoid untrustworthy resolvers by using Trusted Recursive Resolver. If it's to trust a resolver just 1.1.1.1 (or whatever) > Protect against on-path eavesdropping and tampering using DNS over HTTPS. This is the only real change but it is useless for everything outside a CDN Whit is basically everything that matters for users > Transmit as little data as possible to protect users from deanonymization. QNAME minimization can be done already, it is not a DoH thing

xg15 7y ago

As another post on HN argued a few weeks ago and as is stated in this article again: > After you do the DNS lookup to find the IP address, you still need to connect to the web server at that address. To do this, you send an initial request. This request includes a server name indication, which says which site on the server you want to connect to. And this request is unencrypted. Note that, until encrypted SNI is in place, DoH does not actually increase your privacy. Your ISP can still track all domains you connect to by analyzing the SNI header. The only thing they cannot do anymore is block or redirect any of the domains.

jwilk 7y ago

Previous discussion: https://news.ycombinator.com/item?id=17196415 https://news.ycombinator.com/item?id=17196415

judge2020 7y ago

I'll say what has been said time and time again in the past: CF should not be the default server. There shouldn't be a default server. Have an onboarding flow that says "choose DNS server" and allow the user to choose between clearly-unencrypted endpoints (ISP/router, Google, quad9, etc) and encrypted endpoints that use DoH. And again, Google's DoH solution is infinitely less controversial: an upgrade list[0] so that, if your computer/router advertises 1^4, it uses Cloudflare's DoH. If it advertises 8^4, it uses https://dns.google https://dns.google. It even works for a provider known as clean browsing[1] that filters DNS. 0: https://blog.chromium.org/2019/09/experimenting-with-same-provider-dns.html https://blog.chromium.org/2019/09/experimenting-with-same-pr... 1: https://github.com/chromium/chromium/blob/711b1ba2735f8af4bd6359c6292e1875412df74f/net/dns/dns_util.cc#L146-L217 https://github.com/chromium/chromium/blob/711b1ba2735f8af4bd...

mcnichol 7y ago
Having a default vs needing to understand all of this? Do you believe you are selecting the path of least resistance? How many defaults in systems do you use today so you aren't configuring the dials and knobs of a spaceship everytime you power on. Using Cloudflare as a default vs the ISP's defaults. If you care you can learn and change them the same way we operate today. The browser is a product, UX wins. How do I make my product easy to use while still maintaining a security forward stance? Defaults.
- mcnichol 7y ago
  > However, we’ve spent time studying these risks… and we have negotiating power. We worked hard to find a company to work with us to protect users’ DNS data. And we found one: Cloudflare. > Cloudflare is providing a recursive resolution service with a pro-user privacy policy. They have committed to throwing away all personally identifiable data after 24 hours, and to never pass that data along to third-parties. And there will be regular audits to ensure that data is being cleared as expected. I think this is a fair and reasonable reason to land on Cloudflare if they are willing to cooperate in interest of the user and make their organization open to audits aligned to that. I don't understand the hyped up hate on picking a default who is appearing to be going over the top as an ally for end users privacy, users aren't forced into staying with, and would be an arguably more transparent starting point than what people have today.

davidjnelson 7y ago

This is really exciting for security. Lin, you are so talented!!! Great work explaining this, wow!