4 ms·

So they start with talking about ESNI and then kinda completely gloss over it afterwards. Yeah you can reuse the TLS session if several sites are using the same

So they start with talking about ESNI and then kinda completely gloss over it afterwards. Yeah you can reuse the TLS session if several sites are using the same CDN, however, this is again relying on centralization for privacy. The cool thing about DNS architecture is the fact that it is decentralized. Mozilla's plan with DoH tries to fix missing features in DNS by getting rid of arguably the biggest killer feature DNS has. Furthermore, several governments use DNS right now to block websites deemed illegal in their country. Not just authoritarian states that attempt to censor material critical to the regime, but also western countries (copyright infringement, child porn, gambling, etc). Does Mozilla and Cloudflare seriously think they will just go "oh ok, I guess everything is unblocked again now". No, they will either force Cloudflare to do the same or force local ISPs to implement even stronger filtering controls.

JoshTriplett 7y ago
There's a huge additional authoritarian step required to push MITM of all traffic. You cannot do that without people at the endpoints noticing. DNS-based "filtering" can pass unnoticed by many people; full MITM of all traffic cannot. When a regime does something that only a small subset of people notice, it's easier to suppress that small subset of people, with a combination of PR and just ignoring them. When a regime does something that everyone notices, it has to be prepared to be visibly acting against a large fraction of its people. DoH won't stop a sufficiently determined regime from attempting to control the Internet, but it will stop less determined regimes from doing so quietly and getting away with it with minimal resistance, and not every regime is prepared for the implications and backlash of implementing country-wide MITM. And on a more local scale, DoH also increases friction towards smaller entities trying to quietly control access to the Internet, such as ISPs or random wifi hotspots.
tialaramex 7y ago
> Does Mozilla and Cloudflare seriously think they will just go "oh ok, I guess everything is unblocked again now". No, they will either force Cloudflare to do the same or force local ISPs to implement even stronger filtering controls. We have an actual worked example to look at: The British government decided that all pornography in the whole world should require proof of age so that British kids couldn't see it. They got all the legislation done, they got civil servants to write them a "White Paper" explaining how this would work, they selected a censor to manage the inevitable rulings saying that this or that pornographer didn't obey the rules and enforce DNS censorship. And then, just weeks ago after much "delay" and "reconsideration", they U-turned. Because the part where you enforce the rules by "just" censoring DNS isn't practical under DPRIVE. You say they'll just "force" local ISPs to implement "even stronger filtering controls" but the only "stronger" option is to proxy all of HTTPS. How were the IPSs going to pay for this? Mandatory price increases? Or are the government going to do the work and just raise taxes to pay for it? "Vote Conservative: Higher prices, worse service, more taxes, more censorship. Corruption and incompetence are our watchwords" ? This works fine in China. The government wants to spend your money on a "Great Firewall"? Nothing you can do about it. Not so much in a country with anything resembling democracy left.
zamadatix 7y ago
Aside: I've never understood how DNS is decentralized. The internet: I get a number (from a central authority), I plug into other numbers, a path to my number appears. Sounds pretty decentralized once I have a number it's up to peering. DNS: I get a name (from some authority) under a hierarchy. To look names up in this hierarchy you start with sanctioned root servers (from a central authority) which point you to TLD lookup servers (sanctioned by the same authority) which are the authority for that level and so on until you get to your name. Doesn't sound very decentralized, the only portion that's decentralized is the cache. Anyways to your original point: I disagree losing a layer or two of distributed cache servers (depending on the deployment" is "the biggest killer feature DNS has" and I think encrypted randomization and stepping towards end to end integrity are better "killer features" that haven't been able to take off with traditional DNS. > Furthermore, several governments use DNS right now to block websites... So it has to be air tight in standing up to the worlds governments to provide value over being unauthenticated plain text? Even in the cases of governments you'd be surprised how far making it more difficult goes in the volume of collection or how it makes governments have to explicitly admit they are monitoring particular traffic due to the way the technologies work.
- throw0101a 7y ago
  > Aside: I've never understood how DNS is decentralized. I use my ISP's recursive DNS resolvers (or not); you use your ISP's recursive DNS resolvers (or not). Anyone that wants to track "everyone's" browsing has to track a whole bunch of ISPs (and 3rd party DNS operators) if they want to keep a database of activity. There is no central facility that has everyone's DNS requests, unlike (e.g.) MSN Messenger back in the day where all traffic was transferred through the central system. Further, because of caching, it is impossible to get exact numbers on people querying DNS. So while the records for www.youtube.com are in a central place, the exact number of people sitting on their couches at home asking for the A record is masked by people's home routers doing caching and also their ISP DNS servers (which the home routers talk to) doing caching. So there is no "central DNS" server that does hostname-to-IP mapping: there are (tens of) thousands--millions if you count people's home Linksys/Dlink/Asus routers running dnsmasq (or whatever).

JoshTriplett 7y ago

There's a huge additional authoritarian step required to push MITM of all traffic. You cannot do that without people at the endpoints noticing. DNS-based "filtering" can pass unnoticed by many people; full MITM of all traffic cannot. When a regime does something that only a small subset of people notice, it's easier to suppress that small subset of people, with a combination of PR and just ignoring them. When a regime does something that everyone notices, it has to be prepared to be visibly acting against a large fraction of its people. DoH won't stop a sufficiently determined regime from attempting to control the Internet, but it will stop less determined regimes from doing so quietly and getting away with it with minimal resistance, and not every regime is prepared for the implications and backlash of implementing country-wide MITM. And on a more local scale, DoH also increases friction towards smaller entities trying to quietly control access to the Internet, such as ISPs or random wifi hotspots.

tialaramex 7y ago

> Does Mozilla and Cloudflare seriously think they will just go "oh ok, I guess everything is unblocked again now". No, they will either force Cloudflare to do the same or force local ISPs to implement even stronger filtering controls. We have an actual worked example to look at: The British government decided that all pornography in the whole world should require proof of age so that British kids couldn't see it. They got all the legislation done, they got civil servants to write them a "White Paper" explaining how this would work, they selected a censor to manage the inevitable rulings saying that this or that pornographer didn't obey the rules and enforce DNS censorship. And then, just weeks ago after much "delay" and "reconsideration", they U-turned. Because the part where you enforce the rules by "just" censoring DNS isn't practical under DPRIVE. You say they'll just "force" local ISPs to implement "even stronger filtering controls" but the only "stronger" option is to proxy all of HTTPS. How were the IPSs going to pay for this? Mandatory price increases? Or are the government going to do the work and just raise taxes to pay for it? "Vote Conservative: Higher prices, worse service, more taxes, more censorship. Corruption and incompetence are our watchwords" ? This works fine in China. The government wants to spend your money on a "Great Firewall"? Nothing you can do about it. Not so much in a country with anything resembling democracy left.

zamadatix 7y ago

Aside: I've never understood how DNS is decentralized. The internet: I get a number (from a central authority), I plug into other numbers, a path to my number appears. Sounds pretty decentralized once I have a number it's up to peering. DNS: I get a name (from some authority) under a hierarchy. To look names up in this hierarchy you start with sanctioned root servers (from a central authority) which point you to TLD lookup servers (sanctioned by the same authority) which are the authority for that level and so on until you get to your name. Doesn't sound very decentralized, the only portion that's decentralized is the cache. Anyways to your original point: I disagree losing a layer or two of distributed cache servers (depending on the deployment" is "the biggest killer feature DNS has" and I think encrypted randomization and stepping towards end to end integrity are better "killer features" that haven't been able to take off with traditional DNS. > Furthermore, several governments use DNS right now to block websites... So it has to be air tight in standing up to the worlds governments to provide value over being unauthenticated plain text? Even in the cases of governments you'd be surprised how far making it more difficult goes in the volume of collection or how it makes governments have to explicitly admit they are monitoring particular traffic due to the way the technologies work.

throw0101a 7y ago
> Aside: I've never understood how DNS is decentralized. I use my ISP's recursive DNS resolvers (or not); you use your ISP's recursive DNS resolvers (or not). Anyone that wants to track "everyone's" browsing has to track a whole bunch of ISPs (and 3rd party DNS operators) if they want to keep a database of activity. There is no central facility that has everyone's DNS requests, unlike (e.g.) MSN Messenger back in the day where all traffic was transferred through the central system. Further, because of caching, it is impossible to get exact numbers on people querying DNS. So while the records for www.youtube.com are in a central place, the exact number of people sitting on their couches at home asking for the A record is masked by people's home routers doing caching and also their ISP DNS servers (which the home routers talk to) doing caching. So there is no "central DNS" server that does hostname-to-IP mapping: there are (tens of) thousands--millions if you count people's home Linksys/Dlink/Asus routers running dnsmasq (or whatever).