6 ms·

I have a concern. DNS over HTTPS feels to me like we're edging towards end-to-end encryption for DNS. This seems like a good thing, but even though it will pro

by throwaway191020 7y ago

I have a concern. DNS over HTTPS feels to me like we're edging towards end-to-end encryption for DNS. This seems like a good thing, but even though it will protect against ISP and state level observations of DNS, will it not reduce ones control over DNS locally? My threat model remains web site operators and the malware and tracking inserted at that point. Additionally devices on the network that may observe locally and communicate externally like TV boxes and games consoles. To manage those threats I use Pi-Hole. But once we start end-to-end encrypting, and especially when we start verifying those ends, how do I locally intercept and manage DNS for my privacy and security? Is this a genuine concern about DNS over HTTPS? Or is the plan to enable systems like Pi-Hole to be a trusted and configurable resolver too so that consumers retain the ability to control their own systems like this?

canofbars 7y ago
You just have to make your Pi Hole a proxy. You configure your OS/Firefox to connect to the pi for dns and the pi makes the request for the dns record.
- xg15 7y ago
  All this assumes though that the devices can be configured to do that. While that's likely for browsers, it's less likely for smart TVs or other IoT devices, especially if you don't trust the devices in the first place. (Edit: removed bit about root CA certs because I misunderstood)
  - ytch 7y ago
    how about setup iptables to forward all DNS traffic to self-hosted Pi-hole?
    - arpa 7y ago
      if the certificates are pinned, you're screwed. Even if they aren't, it's a matter of luck if your smart$thing accepts self-signed certificates for $thingsdomain.
      - canofbars 7y ago
        This is why you don't buy proprietary spyware hardware.
  - KozmoNau7 7y ago
    The Chromecast in particular defaults to 8.8.8.8, ignoring your DHCP-assigned DNS servers. I've completely blocked any outbound traffic to 8.8.8.8 and 8.8.4.4 from my network.
qwertox 7y ago
Make Pi-Hole use DoH in its upstream resolving, and your local devices normal DNS with Pi-Hole as their resolver.
- alacombe 7y ago
  It will be unavailable if Chrome uses its own DoH resolvers, bypassing system resolvers.
  - shawnz 7y ago
    Which is what they already do with plain DNS anyway (on the Chromecast)
imhoguy 7y ago
> it will protect against ISP and state level observations of DNS It won't if it defaults to centralized on-profit business like Cloudflare. They can tap for govts or sell aggregated data to ISPs someday. They aready own a lot of unencrypted traffic from TLS-termination. Wouldn't it be better to use public/private key signing and onion-like infrastructure for DNS resolving and still keep it distributed?
- alacombe 7y ago
  No regulatory bodies (ie. governments or LE agencies) has any interest in a distributed / censor-proof system.
alacombe 7y ago
Don't forget that with Manifest v3 & DNS over https, Google paves the way to prevent any form of ad-blocking.
- pixl97 7y ago
  Maybe instead of not using DoH, we shouldn't use Google.
JoshTriplett 7y ago
> will it not reduce ones control over DNS locally No. Run your own DoH server, point your DoH client to your own DoH server, and your DoH server can then provide any responses you want. (And it in turn can use DoH or do standard recursive resolution.) End-to-end encryption means that malicious parties can't MITM your traffic or otherwise make you talk to the wrong destination server. That doesn't prevent you from intentionally running your own local servers and pointing clients to them. If you have a client device on your network that you don't trust and can't change the configuration of, it has far more secure methods for protecting itself from you than just using DoH.
- arpa 7y ago
  I think the last line is the major concern for the OP. It's fine and dandy if your browser _lets_ you use different DOH server with it's own self-signed cert. If you're locked down... well, it's game over.
  - mtgx 7y ago
    How is that different than the OS "letting you" change the DNS servers? It's much easier to change browsers than operating systems.
  - JoshTriplett 7y ago
    > with it's own self-signed cert No reason you can't get a real certificate, to ensure that your device talks to the server it intends to. > If you're locked down... well, it's game over. Devices today can already use pinned certificates and other similar measures to ensure that they only talk to the server they want to talk to. DoH doesn't make that any more or less effective, just simpler to get right.
    - d00bianista 7y ago
      A trusted certificate is nice and all but if you have to rely on DNS to find the CNAME-record that translates to an A-record and so forth, it becomes complicated and simpler for malicious parties to MITM you. A self signed certificate is actually better in that sense that nothing trusts it and with the assumption that you can add permanent exceptions and pinning, you'll know immediately if something is wrong.
deleted 7y ago
[deleted]
oskapt 7y ago
There are instructions[1] for pointing your Pi-Hole directly to Cloudflare to forward DNS requests over DoH. You can use the same software to point at any other DoH resolver, and you can disable (or alter the endpoint for) the DoH resolvers in Firefox and Chrome. In July of this year my ISP (Entel Chile) started blocking all ICMP and DNS to non-Entel resolvers. They will not respond to tickets requesting an explanation or confirmation - DNS and ICMP just went dark. In response, I set up DoH on my Pi-Hole with the instructions above. I don't trust Cloudflare, so a couple weeks ago I started modifying the tools from doh-proxy [2] to run in a container [3]. I have this running in three locations under my control, in networks that I trust (or at least that I trust more than Cloudflare), and in one location I run a proxy that uses Nginx to load-balance requests across the multiple locations. I made two videos that show how you can set this up, first about the proxy [4] and how to run a stub DNS-to-DoH forwarder in Docker on your local machine if you don't control the network DNS server, and then about how to set up your own private DoH resolvers in Kubernetes (using a $5 VPS and running k3s) [5]. These solutions, while more technical than what my mom can put together, will not only use systems that you control, but depending on how you set it up, will encrypt all DNS traffic from your machine. Encrypting browser traffic is good for the masses, but it only solves a small part of the problem. Even if you only use the proxy, you can forward to public DoH resolvers that include parental filters, adblocking, and other benefits. If you don't have a Pi-Hole or can't run one, you can get the same benefits with a service like NextDNS [6], who have a generous free tier. The next step is to configure the resolver to support auth, so that it's not all just hanging out on the Internet like it is at the moment. For those who are asking about malware and if DoH makes it easier - consider that this is an HTTPS request. All any malware has to do (and already does) is bypass your system's DNS configuration and make the HTTPS request for DNS resolution of C2 systems directly. Whether or not you have DoH active on your system for other requests is irrelevant. [1]: https://docs.pi-hole.net/guides/dns-over-https/ https://docs.pi-hole.net/guides/dns-over-https/ [2]: https://github.com/facebookexperimental/doh-proxy https://github.com/facebookexperimental/doh-proxy [3]: https://hub.docker.com/r/monachus/doh-tools https://hub.docker.com/r/monachus/doh-tools [4]: https://youtu.be/1RTHCieZqls https://youtu.be/1RTHCieZqls [5]: https://youtu.be/Z-_SpFWloQo https://youtu.be/Z-_SpFWloQo [6]: https://nextdns.io https://nextdns.io Edit: Link formatting
EvanAnderson 7y ago
Device manufacturers will absolutely use DoH (with a pinned certificate) as an architecture of control. You won't be able to filter network access for such devices. They'll just fail to work if you attempt to intercept their traffic. DoH is a gift for device manufacturers who want to ensure forced obsolescence, make sure their ads get displayed, etc. Devices already use pinned certificates, but DoH gives the device manufacturer a convenient and unblockabke way to resolve names against a trusted server. Device manufacturers could be jerks already, but I'd argue that DoH lowers the barrier-to-entry for being a jerk. Consumers don't, by and large, give a damn about whether they actually own their devices or not. This is yet another reason why those of us who care about ownership and control of our own networks can't have the cool new "toys". We're back to feudalism.
- atomi 7y ago
  Chromecast for example forces it's device to bypass local resolution and use Google's DNS. Bad Google, but that would still be an issue even without DoH. With DoH you just won't be able to port block ":53" which no one really does anyway. If you want device manufacturers to behave you're going to have to do it through regulation.
  - user927272 7y ago
    Yes but today one need to build and sell a device to take control of DNS. With DoH any app can do that
  - xg15 7y ago
    > Bad Google, but that would still be an issue even without DoH. Well, with regular DNS, you can force-route 8.8.8.8 to pi-hole and regain control relatively easily. That's not possible with DoH due to TLS.
    - atomi 7y ago
      > force-route 8.8.8.8 Yeah static IP routing is an option - for both nameservers and nefarious servers. That is, we may just have to resort to using IP blocks.
deleted 7y ago
[deleted]
user927272 7y ago
> it will protect against ISP and state level observations of DNS DNS yes but IP will be observed and censored eventually. DoH is not effective against gov censuring that's just propaganda. So why push DoH so hard? Because it moves DNS control to developers
zeta0134 7y ago
As a counterpoint, it feels like you're complaining about losing the ability to control a device you don't normally have the ability to control by exploiting some facet of it's operation. Isn't the real problem that you don't control the device in the first place? Perhaps the better solution is to only run devices and software that you can actually trust, if the security of those devices is important to you, or if you care about the device's behavior.

canofbars 7y ago

You just have to make your Pi Hole a proxy. You configure your OS/Firefox to connect to the pi for dns and the pi makes the request for the dns record.

xg15 7y ago
All this assumes though that the devices can be configured to do that. While that's likely for browsers, it's less likely for smart TVs or other IoT devices, especially if you don't trust the devices in the first place. (Edit: removed bit about root CA certs because I misunderstood)
- ytch 7y ago
  how about setup iptables to forward all DNS traffic to self-hosted Pi-hole?
  - arpa 7y ago
    if the certificates are pinned, you're screwed. Even if they aren't, it's a matter of luck if your smart$thing accepts self-signed certificates for $thingsdomain.
    - canofbars 7y ago
      This is why you don't buy proprietary spyware hardware.
- KozmoNau7 7y ago
  The Chromecast in particular defaults to 8.8.8.8, ignoring your DHCP-assigned DNS servers. I've completely blocked any outbound traffic to 8.8.8.8 and 8.8.4.4 from my network.

qwertox 7y ago

Make Pi-Hole use DoH in its upstream resolving, and your local devices normal DNS with Pi-Hole as their resolver.

alacombe 7y ago
It will be unavailable if Chrome uses its own DoH resolvers, bypassing system resolvers.
- shawnz 7y ago
  Which is what they already do with plain DNS anyway (on the Chromecast)

imhoguy 7y ago

> it will protect against ISP and state level observations of DNS It won't if it defaults to centralized on-profit business like Cloudflare. They can tap for govts or sell aggregated data to ISPs someday. They aready own a lot of unencrypted traffic from TLS-termination. Wouldn't it be better to use public/private key signing and onion-like infrastructure for DNS resolving and still keep it distributed?

alacombe 7y ago
No regulatory bodies (ie. governments or LE agencies) has any interest in a distributed / censor-proof system.

alacombe 7y ago

Don't forget that with Manifest v3 & DNS over https, Google paves the way to prevent any form of ad-blocking.

pixl97 7y ago
Maybe instead of not using DoH, we shouldn't use Google.

JoshTriplett 7y ago

> will it not reduce ones control over DNS locally No. Run your own DoH server, point your DoH client to your own DoH server, and your DoH server can then provide any responses you want. (And it in turn can use DoH or do standard recursive resolution.) End-to-end encryption means that malicious parties can't MITM your traffic or otherwise make you talk to the wrong destination server. That doesn't prevent you from intentionally running your own local servers and pointing clients to them. If you have a client device on your network that you don't trust and can't change the configuration of, it has far more secure methods for protecting itself from you than just using DoH.

arpa 7y ago
I think the last line is the major concern for the OP. It's fine and dandy if your browser _lets_ you use different DOH server with it's own self-signed cert. If you're locked down... well, it's game over.
- mtgx 7y ago
  How is that different than the OS "letting you" change the DNS servers? It's much easier to change browsers than operating systems.
- JoshTriplett 7y ago
  > with it's own self-signed cert No reason you can't get a real certificate, to ensure that your device talks to the server it intends to. > If you're locked down... well, it's game over. Devices today can already use pinned certificates and other similar measures to ensure that they only talk to the server they want to talk to. DoH doesn't make that any more or less effective, just simpler to get right.
  - d00bianista 7y ago
    A trusted certificate is nice and all but if you have to rely on DNS to find the CNAME-record that translates to an A-record and so forth, it becomes complicated and simpler for malicious parties to MITM you. A self signed certificate is actually better in that sense that nothing trusts it and with the assumption that you can add permanent exceptions and pinning, you'll know immediately if something is wrong.

deleted 7y ago

[deleted]

oskapt 7y ago

There are instructions[1] for pointing your Pi-Hole directly to Cloudflare to forward DNS requests over DoH. You can use the same software to point at any other DoH resolver, and you can disable (or alter the endpoint for) the DoH resolvers in Firefox and Chrome. In July of this year my ISP (Entel Chile) started blocking all ICMP and DNS to non-Entel resolvers. They will not respond to tickets requesting an explanation or confirmation - DNS and ICMP just went dark. In response, I set up DoH on my Pi-Hole with the instructions above. I don't trust Cloudflare, so a couple weeks ago I started modifying the tools from doh-proxy [2] to run in a container [3]. I have this running in three locations under my control, in networks that I trust (or at least that I trust more than Cloudflare), and in one location I run a proxy that uses Nginx to load-balance requests across the multiple locations. I made two videos that show how you can set this up, first about the proxy [4] and how to run a stub DNS-to-DoH forwarder in Docker on your local machine if you don't control the network DNS server, and then about how to set up your own private DoH resolvers in Kubernetes (using a $5 VPS and running k3s) [5]. These solutions, while more technical than what my mom can put together, will not only use systems that you control, but depending on how you set it up, will encrypt all DNS traffic from your machine. Encrypting browser traffic is good for the masses, but it only solves a small part of the problem. Even if you only use the proxy, you can forward to public DoH resolvers that include parental filters, adblocking, and other benefits. If you don't have a Pi-Hole or can't run one, you can get the same benefits with a service like NextDNS [6], who have a generous free tier. The next step is to configure the resolver to support auth, so that it's not all just hanging out on the Internet like it is at the moment. For those who are asking about malware and if DoH makes it easier - consider that this is an HTTPS request. All any malware has to do (and already does) is bypass your system's DNS configuration and make the HTTPS request for DNS resolution of C2 systems directly. Whether or not you have DoH active on your system for other requests is irrelevant. [1]: https://docs.pi-hole.net/guides/dns-over-https/ https://docs.pi-hole.net/guides/dns-over-https/ [2]: https://github.com/facebookexperimental/doh-proxy https://github.com/facebookexperimental/doh-proxy [3]: https://hub.docker.com/r/monachus/doh-tools https://hub.docker.com/r/monachus/doh-tools [4]: https://youtu.be/1RTHCieZqls https://youtu.be/1RTHCieZqls [5]: https://youtu.be/Z-_SpFWloQo https://youtu.be/Z-_SpFWloQo [6]: https://nextdns.io https://nextdns.io Edit: Link formatting

EvanAnderson 7y ago

Device manufacturers will absolutely use DoH (with a pinned certificate) as an architecture of control. You won't be able to filter network access for such devices. They'll just fail to work if you attempt to intercept their traffic. DoH is a gift for device manufacturers who want to ensure forced obsolescence, make sure their ads get displayed, etc. Devices already use pinned certificates, but DoH gives the device manufacturer a convenient and unblockabke way to resolve names against a trusted server. Device manufacturers could be jerks already, but I'd argue that DoH lowers the barrier-to-entry for being a jerk. Consumers don't, by and large, give a damn about whether they actually own their devices or not. This is yet another reason why those of us who care about ownership and control of our own networks can't have the cool new "toys". We're back to feudalism.

atomi 7y ago
Chromecast for example forces it's device to bypass local resolution and use Google's DNS. Bad Google, but that would still be an issue even without DoH. With DoH you just won't be able to port block ":53" which no one really does anyway. If you want device manufacturers to behave you're going to have to do it through regulation.
- user927272 7y ago
  Yes but today one need to build and sell a device to take control of DNS. With DoH any app can do that
- xg15 7y ago
  > Bad Google, but that would still be an issue even without DoH. Well, with regular DNS, you can force-route 8.8.8.8 to pi-hole and regain control relatively easily. That's not possible with DoH due to TLS.
  - atomi 7y ago
    > force-route 8.8.8.8 Yeah static IP routing is an option - for both nameservers and nefarious servers. That is, we may just have to resort to using IP blocks.

deleted 7y ago

[deleted]

user927272 7y ago

> it will protect against ISP and state level observations of DNS DNS yes but IP will be observed and censored eventually. DoH is not effective against gov censuring that's just propaganda. So why push DoH so hard? Because it moves DNS control to developers

zeta0134 7y ago

As a counterpoint, it feels like you're complaining about losing the ability to control a device you don't normally have the ability to control by exploiting some facet of it's operation. Isn't the real problem that you don't control the device in the first place? Perhaps the better solution is to only run devices and software that you can actually trust, if the security of those devices is important to you, or if you care about the device's behavior.