4 ms·

I still can't wrap my head around DNS encryption; can someone explain it or link me to an article/video? I seem to remember reading that for this to work, you

by mrlala 7y ago

I still can't wrap my head around DNS encryption; can someone explain it or link me to an article/video? I seem to remember reading that for this to work, you would have to trust someone like google, but then wouldn't you essentially have to proxy all of your data through google or some dns encryption source.. i.e., almost making it a VPN? Surely I am missing something- I just don't see how you can hide traffic from your ISP without a proxy in the middle..

heavyset_go 7y ago
DNS isn't encrypted. Anyone passing your DNS queries between you and your DNS provider can inspect them. DoH or DoT would allow your upstream DNS provider to see your queries, but anyone passing them around wouldn't see the content of the queries. Comcast won't be able to read those queries if they're encrypted via DoH, and part of their business model involves spying on their customers' queries and selling the data. DoH has nothing to do with proxying.
- mrlala 7y ago
  Thank you, however I still don't understand how it works from what you said. What is an "upstream DNS provider" in this context? I'm just not seeing how Comcast can't still know where you going, since obviously you are routing your traffic through them and they see the IP address; how is the IP not giving them enough information to figure out where you are going? Is encrypted DNS only going to work for a handful of sites running in some special way, or is this supposed to work for everything?
  - heavyset_go 7y ago
    > What is an "upstream DNS provider" in this context? This would be your DoH provider. You can have layers of caching and DNS servers on your machine and network, but DNS queries ultimately have to go a foreign DNS provider. > I'm just not seeing how Comcast can't still know where you going If your connections aren't encrypted, or you only access servers with static IP addresses, then Comcast will be able to know where you're going. Modern web applications have many layers of indirection, and you can't always correlate accessed IP addresses with the service the user is using. As an example, consider a site that uses HTTPS and is proxied with Cloudflare. To Comcast, you're sending encrypted bytes to an IP address that doesn't identify the site, it's just Cloudflare. With unencrypted DNS, Comcast can just look at your DNS queries and determine the sites you're visiting. With encrypted DNS, Comcast sees that you connected to your DNS provider and Cloudflare, which isn't exactly valuable.
    - zzzcpan 7y ago
      > With encrypted DNS, Comcast sees that you connected to your DNS provider and Cloudflare, which isn't exactly valuable. Comcast also sees SNI in plain text, sees all the other connections to other IPs for 3rd party resources on that domain, also with SNI, and sizes of all the responses of course. And just the IP addresses and response sizes give enough information to figure out what domain is visited, never mind seeing it in plain text in SNI.
      - xav0989 7y ago
        In combination with Encrypted SNI in TLS 1.3 (https://blog.cloudflare.com/encrypted-sni/ https://blog.cloudflare.com/encrypted-sni/), they won't be able to see that.
        zzzcpan 7y ago
        DoH + eSNI + TLS 1.3 won't prevent seeing IP sets. See this thread https://news.ycombinator.com/item?id=21340671 https://news.ycombinator.com/item?id=21340671 and my other comments here. There are only detrimental effects from DoH on privacy, because extra party sees lots of stuff about you and your ISP still sees everything.
      - heavyset_go 7y ago
        Good point. Hopefully encrypted SNI will gain traction, as well.
- jagged-chisel 7y ago
  Has DNS yet removed the possibility of an ISP front-running replies for outside DNS? For example, you want to see HN, but Comcast would rather you see HN through their ad-injecting proxy - their systems can see your DNS query and reply with the proxy. Seems like encryption and signing would help here as well.
  - growse 7y ago
    Do you mean Dan kaminsky's issue from 2008? (https://en.wikipedia.org/wiki/Dan_Kaminsky#Flaw_in_DNS https://en.wikipedia.org/wiki/Dan_Kaminsky#Flaw_in_DNS) If so, this was fixed... in 2008.
    - slededit 7y ago
      Fixed is much too strong a word. Mitigated is more descriptive. From your link: > This fix is widely seen as a stopgap measure, as it only makes the attack up to 65,536 times harder. An attacker willing to send billions of packets can still corrupt names.
      - growse 7y ago
        Fair.
    - monocasa 7y ago
      Nah, they'd be able to use a much more surgical approach because they wouldn't need to guess the txid. They can just spool off packets that match what they're looking for and respond to them themselves instead of sending them along to 8.8.8.8 or whoever.
  - monocasa 7y ago
    They don't need to front run. They can simply impersonate and not pass along the queries.
vizzier 7y ago
You don't need a proxy for the same reason that your ISP can't read your https data. The data transmitted is encrypted at either end so people passing that data can't read it. Current DNS requests are passed in plain text so all hops along the way can read that information. However, you are correct that if using some sort of encrypted DNS you'd still have to trust the provider you use to be able to read those requests and have to choose a provider that isn't your ISP (which tends to be the default in most places) and the two primary providers at the moment appear to be Amazon (via cloudflare) or google. To that extent, pick your poison.
Belphemur 7y ago
Normal DNS use UDP protocol on port 53. It's very easy to intercept, monitor and redirect. Which is what we think Comcast is doing. DNS-over-TLS encapsulate the DNS traffic in a TCP connection with TLS. In other words, all request are encrypted and it's impossible (without installing root cert and MITM) to know what site you're consulting. DNS-over-HTTPS decide to recreate the protocol as either JSON or dns-message (binary protocol akin to the original DNS protocol) and use an HTTPS request (with HTTP2 minimum and TLS 1.2/1.3). Different way to achieve the same idea, encrypt your DNS data, the site you visit, only here to also make Comcast think you're consulting a normal website securely. You're not redirecting all your traffic to a trusted source, just the DNS traffic. Moreover, you can easily setup your own DNS Encryption service or choose a provider you trust.
- mrlala 7y ago
  But Comcast would still know what IP address you are communicating with.. isn't that going to tell them 99% of the time where you are going still? I mean right now, I do a DNS lookup for news.ycombinator.com and I see 209.216.230.240 .. I'm refreshing the site and that is the address I'm communicating with. Granted you can have multiple DNS assigned to the same IP.. but that's not going to do a whole lot, right? What's to stop comcast from just using their ip->dns lookup table to do basically what they are doing now? Yeah it gives them a slightly less clear picture.. but almost the same?
  - abawany 7y ago
    One thing they tend to do is when one tries to go to a site that does not exist, they instead serve up a 'search' page with their ad links and other unrelated junk. Perhaps they don't want to lose the ad revenue from hijacking their user searches?
  - sliken 7y ago
    Say you are large ISP and you want to maximize profit. If you can track who your users are connecting to you can then start degrading their network connection and the target to pay for a better connection. Comcast was doing this, people noticed much better latency/bandwidth if they used a VPN so that Comcast couldn't tell they were communicating with netflix. So now with encrypted DNS a user looks up netflix.com: "bill@kona:~$ dig +short netflix.com | head -1" gets you 52.37.69.124 But they just see encrypted packets. They can of course do a reverse lookup on the IP and: "bill@kona:~$ dig +short -x 52.37.69.124" gets you ec2-52-37-69-124.us-west-2.compute.amazonaws.com. Is that a webcam watching an eagles nest? One of a zillion video streaming services? Is it a users cat monitoring webcam proxied through a random webcam provider? Someone hosting their plex server on amazon? Without being able to see the DNS records it becomes much harder to track, market, and muck with a users traffic. Comcast could of course make everyone's network connection worse (not just netflix), but then people would complain that they are paying for a high speed internet connection (not just a connection to comcast services) and not getting it. Almost like net neutrality.

by mrlala 7y ago

heavyset_go 7y ago

DNS isn't encrypted. Anyone passing your DNS queries between you and your DNS provider can inspect them. DoH or DoT would allow your upstream DNS provider to see your queries, but anyone passing them around wouldn't see the content of the queries. Comcast won't be able to read those queries if they're encrypted via DoH, and part of their business model involves spying on their customers' queries and selling the data. DoH has nothing to do with proxying.

mrlala 7y ago
Thank you, however I still don't understand how it works from what you said. What is an "upstream DNS provider" in this context? I'm just not seeing how Comcast can't still know where you going, since obviously you are routing your traffic through them and they see the IP address; how is the IP not giving them enough information to figure out where you are going? Is encrypted DNS only going to work for a handful of sites running in some special way, or is this supposed to work for everything?
- heavyset_go 7y ago
  > What is an "upstream DNS provider" in this context? This would be your DoH provider. You can have layers of caching and DNS servers on your machine and network, but DNS queries ultimately have to go a foreign DNS provider. > I'm just not seeing how Comcast can't still know where you going If your connections aren't encrypted, or you only access servers with static IP addresses, then Comcast will be able to know where you're going. Modern web applications have many layers of indirection, and you can't always correlate accessed IP addresses with the service the user is using. As an example, consider a site that uses HTTPS and is proxied with Cloudflare. To Comcast, you're sending encrypted bytes to an IP address that doesn't identify the site, it's just Cloudflare. With unencrypted DNS, Comcast can just look at your DNS queries and determine the sites you're visiting. With encrypted DNS, Comcast sees that you connected to your DNS provider and Cloudflare, which isn't exactly valuable.
  - zzzcpan 7y ago
    > With encrypted DNS, Comcast sees that you connected to your DNS provider and Cloudflare, which isn't exactly valuable. Comcast also sees SNI in plain text, sees all the other connections to other IPs for 3rd party resources on that domain, also with SNI, and sizes of all the responses of course. And just the IP addresses and response sizes give enough information to figure out what domain is visited, never mind seeing it in plain text in SNI.
    - xav0989 7y ago
      In combination with Encrypted SNI in TLS 1.3 (https://blog.cloudflare.com/encrypted-sni/ https://blog.cloudflare.com/encrypted-sni/), they won't be able to see that.
      - zzzcpan 7y ago
        DoH + eSNI + TLS 1.3 won't prevent seeing IP sets. See this thread https://news.ycombinator.com/item?id=21340671 https://news.ycombinator.com/item?id=21340671 and my other comments here. There are only detrimental effects from DoH on privacy, because extra party sees lots of stuff about you and your ISP still sees everything.
    - heavyset_go 7y ago
      Good point. Hopefully encrypted SNI will gain traction, as well.
jagged-chisel 7y ago
Has DNS yet removed the possibility of an ISP front-running replies for outside DNS? For example, you want to see HN, but Comcast would rather you see HN through their ad-injecting proxy - their systems can see your DNS query and reply with the proxy. Seems like encryption and signing would help here as well.
- growse 7y ago
  Do you mean Dan kaminsky's issue from 2008? (https://en.wikipedia.org/wiki/Dan_Kaminsky#Flaw_in_DNS https://en.wikipedia.org/wiki/Dan_Kaminsky#Flaw_in_DNS) If so, this was fixed... in 2008.
  - slededit 7y ago
    Fixed is much too strong a word. Mitigated is more descriptive. From your link: > This fix is widely seen as a stopgap measure, as it only makes the attack up to 65,536 times harder. An attacker willing to send billions of packets can still corrupt names.
    - growse 7y ago
      Fair.
  - monocasa 7y ago
    Nah, they'd be able to use a much more surgical approach because they wouldn't need to guess the txid. They can just spool off packets that match what they're looking for and respond to them themselves instead of sending them along to 8.8.8.8 or whoever.
- monocasa 7y ago
  They don't need to front run. They can simply impersonate and not pass along the queries.

vizzier 7y ago

You don't need a proxy for the same reason that your ISP can't read your https data. The data transmitted is encrypted at either end so people passing that data can't read it. Current DNS requests are passed in plain text so all hops along the way can read that information. However, you are correct that if using some sort of encrypted DNS you'd still have to trust the provider you use to be able to read those requests and have to choose a provider that isn't your ISP (which tends to be the default in most places) and the two primary providers at the moment appear to be Amazon (via cloudflare) or google. To that extent, pick your poison.

Belphemur 7y ago

Normal DNS use UDP protocol on port 53. It's very easy to intercept, monitor and redirect. Which is what we think Comcast is doing. DNS-over-TLS encapsulate the DNS traffic in a TCP connection with TLS. In other words, all request are encrypted and it's impossible (without installing root cert and MITM) to know what site you're consulting. DNS-over-HTTPS decide to recreate the protocol as either JSON or dns-message (binary protocol akin to the original DNS protocol) and use an HTTPS request (with HTTP2 minimum and TLS 1.2/1.3). Different way to achieve the same idea, encrypt your DNS data, the site you visit, only here to also make Comcast think you're consulting a normal website securely. You're not redirecting all your traffic to a trusted source, just the DNS traffic. Moreover, you can easily setup your own DNS Encryption service or choose a provider you trust.

mrlala 7y ago
But Comcast would still know what IP address you are communicating with.. isn't that going to tell them 99% of the time where you are going still? I mean right now, I do a DNS lookup for news.ycombinator.com and I see 209.216.230.240 .. I'm refreshing the site and that is the address I'm communicating with. Granted you can have multiple DNS assigned to the same IP.. but that's not going to do a whole lot, right? What's to stop comcast from just using their ip->dns lookup table to do basically what they are doing now? Yeah it gives them a slightly less clear picture.. but almost the same?
- abawany 7y ago
  One thing they tend to do is when one tries to go to a site that does not exist, they instead serve up a 'search' page with their ad links and other unrelated junk. Perhaps they don't want to lose the ad revenue from hijacking their user searches?
- sliken 7y ago
  Say you are large ISP and you want to maximize profit. If you can track who your users are connecting to you can then start degrading their network connection and the target to pay for a better connection. Comcast was doing this, people noticed much better latency/bandwidth if they used a VPN so that Comcast couldn't tell they were communicating with netflix. So now with encrypted DNS a user looks up netflix.com: "bill@kona:~$ dig +short netflix.com | head -1" gets you 52.37.69.124 But they just see encrypted packets. They can of course do a reverse lookup on the IP and: "bill@kona:~$ dig +short -x 52.37.69.124" gets you ec2-52-37-69-124.us-west-2.compute.amazonaws.com. Is that a webcam watching an eagles nest? One of a zillion video streaming services? Is it a users cat monitoring webcam proxied through a random webcam provider? Someone hosting their plex server on amazon? Without being able to see the DNS records it becomes much harder to track, market, and muck with a users traffic. Comcast could of course make everyone's network connection worse (not just netflix), but then people would complain that they are paying for a high speed internet connection (not just a connection to comcast services) and not getting it. Almost like net neutrality.