3 ms·

I think the last line is the major concern for the OP. It's fine and dandy if your browser _lets_ you use different DOH server with it's own self-signed cert. I

by arpa 7y ago

I think the last line is the major concern for the OP. It's fine and dandy if your browser _lets_ you use different DOH server with it's own self-signed cert. If you're locked down... well, it's game over.

mtgx 7y ago
How is that different than the OS "letting you" change the DNS servers? It's much easier to change browsers than operating systems.
JoshTriplett 7y ago
> with it's own self-signed cert No reason you can't get a real certificate, to ensure that your device talks to the server it intends to. > If you're locked down... well, it's game over. Devices today can already use pinned certificates and other similar measures to ensure that they only talk to the server they want to talk to. DoH doesn't make that any more or less effective, just simpler to get right.
- d00bianista 7y ago
  A trusted certificate is nice and all but if you have to rely on DNS to find the CNAME-record that translates to an A-record and so forth, it becomes complicated and simpler for malicious parties to MITM you. A self signed certificate is actually better in that sense that nothing trusts it and with the assumption that you can add permanent exceptions and pinning, you'll know immediately if something is wrong.
- xg15 7y ago
  > No reason you can't get a real certificate, to ensure that your device talks to the server it intends to. You'd have to get a certificate for whatever domain the device wants to talk to - a domain you very likely have no control over. No sane CA will give you a cert for that. The whole point of the PKI is to keep MITMs from pretending to be domains that they actually don't control - which is exactly what we'd be doing here.
  - tialaramex 7y ago
    The intent would be that the device has a setting where you pick which DoH service to use, and if that's a free text input you can put my-doh-server.my-vanity-domain.example If 90% of users leave it as shipped set to (say) Google, 9% switch to their preferred service and only a handful like you actually type in a DNS name, that freedom to do is preserved. If it doesn't check the certificate from the DoH server when you override the configuration, you are immediately exposed to a MITM so it needs to check. However you'll have no trouble getting a cert for your own FQDN, and that's what the poster you replied to is thinking of.
    - xg15 7y ago
      Not all devices have a screen or an easy method to input a TRR URL. So even if a vendor has the best intentions, the effort needed to make DoH configurable could be more than what can be justified for a "niche feature". I believe there are ideas for a network-level autodiscovery of DoH servers, analogous to regular DNS. That would solve the problem, but I can't see how it would get buy-in from the DoH crowd, as it would tie DNS to the network again - and it would still have to be implemented by every single device. Of course all of this is moot if the vendor actively wants to prevent you from intercepting DNS.

by arpa 7y ago

mtgx 7y ago

How is that different than the OS "letting you" change the DNS servers? It's much easier to change browsers than operating systems.

JoshTriplett 7y ago

> with it's own self-signed cert No reason you can't get a real certificate, to ensure that your device talks to the server it intends to. > If you're locked down... well, it's game over. Devices today can already use pinned certificates and other similar measures to ensure that they only talk to the server they want to talk to. DoH doesn't make that any more or less effective, just simpler to get right.

d00bianista 7y ago
A trusted certificate is nice and all but if you have to rely on DNS to find the CNAME-record that translates to an A-record and so forth, it becomes complicated and simpler for malicious parties to MITM you. A self signed certificate is actually better in that sense that nothing trusts it and with the assumption that you can add permanent exceptions and pinning, you'll know immediately if something is wrong.
xg15 7y ago
> No reason you can't get a real certificate, to ensure that your device talks to the server it intends to. You'd have to get a certificate for whatever domain the device wants to talk to - a domain you very likely have no control over. No sane CA will give you a cert for that. The whole point of the PKI is to keep MITMs from pretending to be domains that they actually don't control - which is exactly what we'd be doing here.
- tialaramex 7y ago
  The intent would be that the device has a setting where you pick which DoH service to use, and if that's a free text input you can put my-doh-server.my-vanity-domain.example If 90% of users leave it as shipped set to (say) Google, 9% switch to their preferred service and only a handful like you actually type in a DNS name, that freedom to do is preserved. If it doesn't check the certificate from the DoH server when you override the configuration, you are immediately exposed to a MITM so it needs to check. However you'll have no trouble getting a cert for your own FQDN, and that's what the poster you replied to is thinking of.
  - xg15 7y ago
    Not all devices have a screen or an easy method to input a TRR URL. So even if a vendor has the best intentions, the effort needed to make DoH configurable could be more than what can be justified for a "niche feature". I believe there are ideas for a network-level autodiscovery of DoH servers, analogous to regular DNS. That would solve the problem, but I can't see how it would get buy-in from the DoH crowd, as it would tie DNS to the network again - and it would still have to be implemented by every single device. Of course all of this is moot if the vendor actively wants to prevent you from intercepting DNS.