4 ms·

Device manufacturers will absolutely use DoH (with a pinned certificate) as an architecture of control. You won't be able to filter network access for such devi

Device manufacturers will absolutely use DoH (with a pinned certificate) as an architecture of control. You won't be able to filter network access for such devices. They'll just fail to work if you attempt to intercept their traffic. DoH is a gift for device manufacturers who want to ensure forced obsolescence, make sure their ads get displayed, etc. Devices already use pinned certificates, but DoH gives the device manufacturer a convenient and unblockabke way to resolve names against a trusted server. Device manufacturers could be jerks already, but I'd argue that DoH lowers the barrier-to-entry for being a jerk. Consumers don't, by and large, give a damn about whether they actually own their devices or not. This is yet another reason why those of us who care about ownership and control of our own networks can't have the cool new "toys". We're back to feudalism.

atomi 7y ago
Chromecast for example forces it's device to bypass local resolution and use Google's DNS. Bad Google, but that would still be an issue even without DoH. With DoH you just won't be able to port block ":53" which no one really does anyway. If you want device manufacturers to behave you're going to have to do it through regulation.
- user927272 7y ago
  Yes but today one need to build and sell a device to take control of DNS. With DoH any app can do that
- xg15 7y ago
  > Bad Google, but that would still be an issue even without DoH. Well, with regular DNS, you can force-route 8.8.8.8 to pi-hole and regain control relatively easily. That's not possible with DoH due to TLS.
  - atomi 7y ago
    > force-route 8.8.8.8 Yeah static IP routing is an option - for both nameservers and nefarious servers. That is, we may just have to resort to using IP blocks.
tptacek 7y ago
Device manufacturers don't need DoH to implement an architecture of control. They already have everything they need to do so. They don't even need to use DNS at all.
- EvanAnderson 7y ago
  I should have said "yet another architecture of control". Call it the opposite of defense-in-depth. Device manufacturers who aren't thorough might allow a class of "attacks" by way of using DNS. Having ubiquitous DoH takes away that "attack" vector. I'm not arguing device manufacturers need DoH to be jerks. Having it available just enables the less sophisticated ones to be jerky more easily. DNS-over-TLS does the same thing, it's just marginally less frustrating because it can be blocked at the network layer, at least. I understand that allowing owners of devices to do what they want on their own networks runs counter to the whole "protect the public from bad network operators" / "protect the public from bad people" narrative. I'm in the minority. It's just damned frustrating. It's sucking all the fun out of computing and networking. It's irrational and self-serving, but dammit it makes me angry.
  - tptacek 7y ago
    This doesn't make any sense. Device vendors don't need encrypted DNS to obfuscate their command-and-control any more than bot developers do. They already have code execution on their platform that has network access. They can use whatever encrypted channel they want. Skype was doing this before DoH had even occurred to anybody. We're supposed to tell home users to keep using plaintext DNS because an incompetent device manufacturer might not be able to come up with a better encrypted C&C than DoH?
    - EvanAnderson 7y ago
      I'm not arguing home users, or anybody, should keep using unencrypted DNS. I'm not arguing anything. I'm just depressed as hell that every solution to "protect the average person" involves making me own my devices even less. You're right, I'm wrong. I'm sorry I engaged. Chalk it up to me being old and angry.
userbinator 7y ago
Device manufacturers could be jerks already, but I'd argue that DoH lowers the barrier-to-entry for being a jerk. And now that it's being marketed heavily, it just gave them another reason to do it that they didn't have before ("Mozilla is doing it too!")

atomi 7y ago

Chromecast for example forces it's device to bypass local resolution and use Google's DNS. Bad Google, but that would still be an issue even without DoH. With DoH you just won't be able to port block ":53" which no one really does anyway. If you want device manufacturers to behave you're going to have to do it through regulation.

user927272 7y ago
Yes but today one need to build and sell a device to take control of DNS. With DoH any app can do that
xg15 7y ago
> Bad Google, but that would still be an issue even without DoH. Well, with regular DNS, you can force-route 8.8.8.8 to pi-hole and regain control relatively easily. That's not possible with DoH due to TLS.
- atomi 7y ago
  > force-route 8.8.8.8 Yeah static IP routing is an option - for both nameservers and nefarious servers. That is, we may just have to resort to using IP blocks.

tptacek 7y ago

Device manufacturers don't need DoH to implement an architecture of control. They already have everything they need to do so. They don't even need to use DNS at all.

EvanAnderson 7y ago
I should have said "yet another architecture of control". Call it the opposite of defense-in-depth. Device manufacturers who aren't thorough might allow a class of "attacks" by way of using DNS. Having ubiquitous DoH takes away that "attack" vector. I'm not arguing device manufacturers need DoH to be jerks. Having it available just enables the less sophisticated ones to be jerky more easily. DNS-over-TLS does the same thing, it's just marginally less frustrating because it can be blocked at the network layer, at least. I understand that allowing owners of devices to do what they want on their own networks runs counter to the whole "protect the public from bad network operators" / "protect the public from bad people" narrative. I'm in the minority. It's just damned frustrating. It's sucking all the fun out of computing and networking. It's irrational and self-serving, but dammit it makes me angry.
- tptacek 7y ago
  This doesn't make any sense. Device vendors don't need encrypted DNS to obfuscate their command-and-control any more than bot developers do. They already have code execution on their platform that has network access. They can use whatever encrypted channel they want. Skype was doing this before DoH had even occurred to anybody. We're supposed to tell home users to keep using plaintext DNS because an incompetent device manufacturer might not be able to come up with a better encrypted C&C than DoH?
  - EvanAnderson 7y ago
    I'm not arguing home users, or anybody, should keep using unencrypted DNS. I'm not arguing anything. I'm just depressed as hell that every solution to "protect the average person" involves making me own my devices even less. You're right, I'm wrong. I'm sorry I engaged. Chalk it up to me being old and angry.

userbinator 7y ago

Device manufacturers could be jerks already, but I'd argue that DoH lowers the barrier-to-entry for being a jerk. And now that it's being marketed heavily, it just gave them another reason to do it that they didn't have before ("Mozilla is doing it too!")