8 ms·

> will it not reduce ones control over DNS locally No. Run your own DoH server, point your DoH client to your own DoH server, and your DoH server can then prov

> will it not reduce ones control over DNS locally No. Run your own DoH server, point your DoH client to your own DoH server, and your DoH server can then provide any responses you want. (And it in turn can use DoH or do standard recursive resolution.) End-to-end encryption means that malicious parties can't MITM your traffic or otherwise make you talk to the wrong destination server. That doesn't prevent you from intentionally running your own local servers and pointing clients to them. If you have a client device on your network that you don't trust and can't change the configuration of, it has far more secure methods for protecting itself from you than just using DoH.

arpa 7y ago
I think the last line is the major concern for the OP. It's fine and dandy if your browser _lets_ you use different DOH server with it's own self-signed cert. If you're locked down... well, it's game over.
- mtgx 7y ago
  How is that different than the OS "letting you" change the DNS servers? It's much easier to change browsers than operating systems.
- JoshTriplett 7y ago
  > with it's own self-signed cert No reason you can't get a real certificate, to ensure that your device talks to the server it intends to. > If you're locked down... well, it's game over. Devices today can already use pinned certificates and other similar measures to ensure that they only talk to the server they want to talk to. DoH doesn't make that any more or less effective, just simpler to get right.
  - d00bianista 7y ago
    A trusted certificate is nice and all but if you have to rely on DNS to find the CNAME-record that translates to an A-record and so forth, it becomes complicated and simpler for malicious parties to MITM you. A self signed certificate is actually better in that sense that nothing trusts it and with the assumption that you can add permanent exceptions and pinning, you'll know immediately if something is wrong.
  - xg15 7y ago
    > No reason you can't get a real certificate, to ensure that your device talks to the server it intends to. You'd have to get a certificate for whatever domain the device wants to talk to - a domain you very likely have no control over. No sane CA will give you a cert for that. The whole point of the PKI is to keep MITMs from pretending to be domains that they actually don't control - which is exactly what we'd be doing here.
    - tialaramex 7y ago
      The intent would be that the device has a setting where you pick which DoH service to use, and if that's a free text input you can put my-doh-server.my-vanity-domain.example If 90% of users leave it as shipped set to (say) Google, 9% switch to their preferred service and only a handful like you actually type in a DNS name, that freedom to do is preserved. If it doesn't check the certificate from the DoH server when you override the configuration, you are immediately exposed to a MITM so it needs to check. However you'll have no trouble getting a cert for your own FQDN, and that's what the poster you replied to is thinking of.
      - xg15 7y ago
        Not all devices have a screen or an easy method to input a TRR URL. So even if a vendor has the best intentions, the effort needed to make DoH configurable could be more than what can be justified for a "niche feature". I believe there are ideas for a network-level autodiscovery of DoH servers, analogous to regular DNS. That would solve the problem, but I can't see how it would get buy-in from the DoH crowd, as it would tie DNS to the network again - and it would still have to be implemented by every single device. Of course all of this is moot if the vendor actively wants to prevent you from intercepting DNS.
EvanAnderson 7y ago
To a device manufacturer the consumer is a malicious party.
user827272 7y ago
And if that client happens to be the only one avalible to access some service or happens to dominate the market you're doomed. And don't forget that you can change the resolver today, as you can install uBO, but what about tomorrow?
throw0101a 7y ago
> No. Run your own DoH server, point your DoH client to your own DoH server ... Except when the client ignores what you tell it. Per Paul Vixie: google, this is bogus as hell. my dhcp server gives you dns servers to use. please don't make me route and answer 8.8.8.8 just to watch youtube. > [71] 2019-02-13 16:39:40.548137 [#68 vtnet0 4095] \ > [24.104.150.186].56915 [8.8.8.8].53 \ > dns QUERY,NOERROR,7357,rd \ > 1 lh3.googleusercontent.com,IN,A 0 0 0 > [71] 2019-02-13 16:39:40.548210 [#69 vtnet0 4095] \ > [24.104.150.186].56915 [8.8.8.8].53 \ > dns QUERY,NOERROR,49247,rd \ > 1 lh3.googleusercontent.com,IN,AAAA 0 0 0 (no, this device i've paid for, will NOT be allowed to send you any information, other than what i personally approve, which will never include DNS traffic. if you don't like that deal, buy it back from me and i'll find some other video appliance that doesn't twist my arm.) * https://news.ycombinator.com/item?id=19170671 https://news.ycombinator.com/item?id=19170671 Of course with DoH you can't just do a UDP redirect. With DoT, which uses tcp/953, you can at least block access. But with DoH, you have just lost control of your network. (Unless block 443 and force everything to go through a (Squid) proxy?)
- josteink 7y ago
  > But with DoH, you have just lost control of your network. (Unless block 443 and force everything to go through a (Squid) proxy?) Expect “enterprise” network equipment using an approach like this to provide a “DOH firewall” in the near future. Net privacy gained: negative.
  - throw0101a 7y ago
    I've been on networks where everything had to go through a proxy, where browsers were told how to act via WPAD/proxy.pac and you set an HTTPS_PROXY env for wget/cURL to work.
  - akerl_ 7y ago
    The goal isn’t adding privacy on enterprise networks. Enterprise networks should already be accounting for the existence of HTTPS, and either allowing, blocking, or proxying employee/device connections based on their threat model. The goal for DoH is to improve privacy for individual humans, and it does that.
josteink 7y ago
> Run your own DoH server, point your DoH client to your own DoH server, and your DoH server can then provide any responses you want. What DOH client would that be? Where would I configure it? How do I configure a systemwide DOH setting? Right now none of those questions can be given a simple answer. DOH is a rogue technology.

arpa 7y ago

I think the last line is the major concern for the OP. It's fine and dandy if your browser _lets_ you use different DOH server with it's own self-signed cert. If you're locked down... well, it's game over.

mtgx 7y ago
How is that different than the OS "letting you" change the DNS servers? It's much easier to change browsers than operating systems.
JoshTriplett 7y ago
> with it's own self-signed cert No reason you can't get a real certificate, to ensure that your device talks to the server it intends to. > If you're locked down... well, it's game over. Devices today can already use pinned certificates and other similar measures to ensure that they only talk to the server they want to talk to. DoH doesn't make that any more or less effective, just simpler to get right.
- d00bianista 7y ago
  A trusted certificate is nice and all but if you have to rely on DNS to find the CNAME-record that translates to an A-record and so forth, it becomes complicated and simpler for malicious parties to MITM you. A self signed certificate is actually better in that sense that nothing trusts it and with the assumption that you can add permanent exceptions and pinning, you'll know immediately if something is wrong.
- xg15 7y ago
  > No reason you can't get a real certificate, to ensure that your device talks to the server it intends to. You'd have to get a certificate for whatever domain the device wants to talk to - a domain you very likely have no control over. No sane CA will give you a cert for that. The whole point of the PKI is to keep MITMs from pretending to be domains that they actually don't control - which is exactly what we'd be doing here.
  - tialaramex 7y ago
    The intent would be that the device has a setting where you pick which DoH service to use, and if that's a free text input you can put my-doh-server.my-vanity-domain.example If 90% of users leave it as shipped set to (say) Google, 9% switch to their preferred service and only a handful like you actually type in a DNS name, that freedom to do is preserved. If it doesn't check the certificate from the DoH server when you override the configuration, you are immediately exposed to a MITM so it needs to check. However you'll have no trouble getting a cert for your own FQDN, and that's what the poster you replied to is thinking of.
    - xg15 7y ago
      Not all devices have a screen or an easy method to input a TRR URL. So even if a vendor has the best intentions, the effort needed to make DoH configurable could be more than what can be justified for a "niche feature". I believe there are ideas for a network-level autodiscovery of DoH servers, analogous to regular DNS. That would solve the problem, but I can't see how it would get buy-in from the DoH crowd, as it would tie DNS to the network again - and it would still have to be implemented by every single device. Of course all of this is moot if the vendor actively wants to prevent you from intercepting DNS.

EvanAnderson 7y ago

To a device manufacturer the consumer is a malicious party.

user827272 7y ago

And if that client happens to be the only one avalible to access some service or happens to dominate the market you're doomed. And don't forget that you can change the resolver today, as you can install uBO, but what about tomorrow?

throw0101a 7y ago

> No. Run your own DoH server, point your DoH client to your own DoH server ... Except when the client ignores what you tell it. Per Paul Vixie: google, this is bogus as hell. my dhcp server gives you dns servers to use. please don't make me route and answer 8.8.8.8 just to watch youtube. > [71] 2019-02-13 16:39:40.548137 [#68 vtnet0 4095] \ > [24.104.150.186].56915 [8.8.8.8].53 \ > dns QUERY,NOERROR,7357,rd \ > 1 lh3.googleusercontent.com,IN,A 0 0 0 > [71] 2019-02-13 16:39:40.548210 [#69 vtnet0 4095] \ > [24.104.150.186].56915 [8.8.8.8].53 \ > dns QUERY,NOERROR,49247,rd \ > 1 lh3.googleusercontent.com,IN,AAAA 0 0 0 (no, this device i've paid for, will NOT be allowed to send you any information, other than what i personally approve, which will never include DNS traffic. if you don't like that deal, buy it back from me and i'll find some other video appliance that doesn't twist my arm.) * https://news.ycombinator.com/item?id=19170671 https://news.ycombinator.com/item?id=19170671 Of course with DoH you can't just do a UDP redirect. With DoT, which uses tcp/953, you can at least block access. But with DoH, you have just lost control of your network. (Unless block 443 and force everything to go through a (Squid) proxy?)

josteink 7y ago
> But with DoH, you have just lost control of your network. (Unless block 443 and force everything to go through a (Squid) proxy?) Expect “enterprise” network equipment using an approach like this to provide a “DOH firewall” in the near future. Net privacy gained: negative.
- throw0101a 7y ago
  I've been on networks where everything had to go through a proxy, where browsers were told how to act via WPAD/proxy.pac and you set an HTTPS_PROXY env for wget/cURL to work.
- akerl_ 7y ago
  The goal isn’t adding privacy on enterprise networks. Enterprise networks should already be accounting for the existence of HTTPS, and either allowing, blocking, or proxying employee/device connections based on their threat model. The goal for DoH is to improve privacy for individual humans, and it does that.

josteink 7y ago

> Run your own DoH server, point your DoH client to your own DoH server, and your DoH server can then provide any responses you want. What DOH client would that be? Where would I configure it? How do I configure a systemwide DOH setting? Right now none of those questions can be given a simple answer. DOH is a rogue technology.