4 ms·

Over the year of discussions in regard to DNS over HTTPS I find the best illustration is to look at email. Your email client on the phone or PC send to a email

by belorn 7y ago

Over the year of discussions in regard to DNS over HTTPS I find the best illustration is to look at email. Your email client on the phone or PC send to a email over SMTP to a email server, the server look at the address and contact the recipient server and delivers the request. In email it is client->MTA->server-recipient. In DNS it is client->Resolver->Authoritive-server with the answer traveling back in the chain. A little historical similarity, ISP used to provide a default MTA servers just like they do with resolver. Now days it most people use a email provider of choice. So lets now imagine we solved the plain text problem of email by having the client use a default list of trusted MTA, with thunderbird defaulting to partner with gmail, and just sent it there over HTTPS. Gmail would take the email and forward it in plaintext to the recipient-server. Email security did not follow that path. There we collectively decided to first encrypt communication between the client and the MTA using TLS, addressing the first step in the chain. Then the communication between MTA and recipient server got encrypted. In order to prevent downgrade attacks there is also currently two competing standards, one based on DNS and the other on HTTPS side channel. Looking at email, we are also almost done converting the plain text protocol to encrypted: https://transparencyreport.google.com/safer-email/overview https://transparencyreport.google.com/safer-email/overview The general question is then, why not just copy the success of email? The answer it seem is about money. No company got more users or data when email protocols got encrypted. Cloudflare however will benefit if everyone route their DNS through them as that gives them a comparable performance benefit when people use them as a hosting provider. They also say they won't sell data, but people who move their domain hosting to cloudflare and pay for Pro, Business and Enterprise plan can get access to DNS analytics.

scrollaway 7y ago
Whatever happened to DNSCrypt? I remember setting it up and happily using it for over a year without any issues a few years ago.
- zamadatix 7y ago
  It was never brought forward for standardization and quickly got replaced by protocols that were. While it used UDP or TCP 443 it was a custom protocol so clients had to implement it manually and you couldn't run an HTTPS server on the same port (without modifying the HTTPS server/load balancer). It also relied on a separate certificate infrastructure. Shortly after DoT and DoH came along as standardized proposals with fewer NIH issues and more interoperability. DoH also has the bonus of looking like standard HTTPS traffic to the resolver. Technically e.g. Google could host DoH on google.com/dns-query and it would be hidden in the deluge of HTTPS that already goes to google.com.
- jedisct1 7y ago
  Still here, still what most public secure DNS run, still secure and reliable, still being constantly improved, and new implementations keep being written. https://dnscrypt.info https://dnscrypt.info The protocol was recently extended with Anonymized DNS, a mechanism that hides client IP addresses from resolvers by using relays dedicated to secure DNS forwarding. A new network of DNS relays is currently being deployed. https://www.reddit.com/r/dnscrypt/comments/dhoxah/anonymized_dns_is_here/ https://www.reddit.com/r/dnscrypt/comments/dhoxah/anonymized... dnscrypt-proxy, the reference client implementation, is at version 2.0.29.beta3, released yesterday. There is a new, easy to use and deploy implementation in Rust to add DNSCrypt support server-side, Encrypted DNS Server: https://github.com/jedisct1/encrypted-dns-server https://github.com/jedisct1/encrypted-dns-server DoH, DNSCrypt and DNS relaying can happily share the same TCP port 443. A complete protocol description has been available for years, but turning it into an IETF document is time consuming. It will eventually happen, but as an independent project, writing software has been prioritized over marketing.
  - scrollaway 7y ago
    Thanks for the information. Are you involved with the project?
    - jedisct1 7y ago
      A little bit. I run some public DNS servers.
avian 7y ago
I wouldn't really call what happened to email a success. In reality, email these days looks much like your first scenario. Email is GMail and a few other large sites. Everybody else is a rounding error in statistics. For all intents and purposes these guys decide who can use email. Yes, they don't use a simple trusted list, but some secret Algorithm. The effect is the same (or maybe it's worse, since if the Algorithm doesn't like you, there's no one to ask to add you to the list). The security improvements you mention were more or less pushed onto others by Google and everybody was forced to implement them since if you can't talk to GMail you might as well as not exist in the SMTP world. > No company got more users or data when email protocols got encrypted This is speculation, but it's easy to see how these changes could have benefited big players: they already have the data. By forcing encryption on everyone they deny this information to others (like ISPs who might sniff the traffic). Also these security improvements increase the burden of maintenance of small mail servers, which again pushes more users towards big players. I'm not saying encrypting SMTP traffic didn't benefit the users, but reasons for forcing it on everyone might not have been completely altruistic.
- belorn 7y ago
  Gmail is when I look around for market statitics around 30-40%. Second largest is Microsoft. Third Yahoo at something blow 15% with "other" trailing a few % below that. In the corporate space Microsoft is largest with office 365. G suit is common, but as I read it about half the market share of Office. So no, not a rounding error and gmail is definitive not Email nor even 50% of it. Discussing market share also seems to me as very much the wrong question. Why should we not use the same process that email did when the world converted over to using encrypted email between client->MTA->Recipient? Is there a technical argument why converting things to HTTPS and then giving everything to whomever the browsers is partnered with is a better model?

by belorn 7y ago

scrollaway 7y ago

Whatever happened to DNSCrypt? I remember setting it up and happily using it for over a year without any issues a few years ago.

zamadatix 7y ago
It was never brought forward for standardization and quickly got replaced by protocols that were. While it used UDP or TCP 443 it was a custom protocol so clients had to implement it manually and you couldn't run an HTTPS server on the same port (without modifying the HTTPS server/load balancer). It also relied on a separate certificate infrastructure. Shortly after DoT and DoH came along as standardized proposals with fewer NIH issues and more interoperability. DoH also has the bonus of looking like standard HTTPS traffic to the resolver. Technically e.g. Google could host DoH on google.com/dns-query and it would be hidden in the deluge of HTTPS that already goes to google.com.
jedisct1 7y ago
Still here, still what most public secure DNS run, still secure and reliable, still being constantly improved, and new implementations keep being written. https://dnscrypt.info https://dnscrypt.info The protocol was recently extended with Anonymized DNS, a mechanism that hides client IP addresses from resolvers by using relays dedicated to secure DNS forwarding. A new network of DNS relays is currently being deployed. https://www.reddit.com/r/dnscrypt/comments/dhoxah/anonymized_dns_is_here/ https://www.reddit.com/r/dnscrypt/comments/dhoxah/anonymized... dnscrypt-proxy, the reference client implementation, is at version 2.0.29.beta3, released yesterday. There is a new, easy to use and deploy implementation in Rust to add DNSCrypt support server-side, Encrypted DNS Server: https://github.com/jedisct1/encrypted-dns-server https://github.com/jedisct1/encrypted-dns-server DoH, DNSCrypt and DNS relaying can happily share the same TCP port 443. A complete protocol description has been available for years, but turning it into an IETF document is time consuming. It will eventually happen, but as an independent project, writing software has been prioritized over marketing.
- scrollaway 7y ago
  Thanks for the information. Are you involved with the project?
  - jedisct1 7y ago
    A little bit. I run some public DNS servers.

avian 7y ago

I wouldn't really call what happened to email a success. In reality, email these days looks much like your first scenario. Email is GMail and a few other large sites. Everybody else is a rounding error in statistics. For all intents and purposes these guys decide who can use email. Yes, they don't use a simple trusted list, but some secret Algorithm. The effect is the same (or maybe it's worse, since if the Algorithm doesn't like you, there's no one to ask to add you to the list). The security improvements you mention were more or less pushed onto others by Google and everybody was forced to implement them since if you can't talk to GMail you might as well as not exist in the SMTP world. > No company got more users or data when email protocols got encrypted This is speculation, but it's easy to see how these changes could have benefited big players: they already have the data. By forcing encryption on everyone they deny this information to others (like ISPs who might sniff the traffic). Also these security improvements increase the burden of maintenance of small mail servers, which again pushes more users towards big players. I'm not saying encrypting SMTP traffic didn't benefit the users, but reasons for forcing it on everyone might not have been completely altruistic.

belorn 7y ago
Gmail is when I look around for market statitics around 30-40%. Second largest is Microsoft. Third Yahoo at something blow 15% with "other" trailing a few % below that. In the corporate space Microsoft is largest with office 365. G suit is common, but as I read it about half the market share of Office. So no, not a rounding error and gmail is definitive not Email nor even 50% of it. Discussing market share also seems to me as very much the wrong question. Why should we not use the same process that email did when the world converted over to using encrypted email between client->MTA->Recipient? Is there a technical argument why converting things to HTTPS and then giving everything to whomever the browsers is partnered with is a better model?