13 ms·

Windows will improve user privacy with DNS over HTTPS

189 points by omiossec 7y ago

zaarn 7y ago
I guess that is the end of the naysaying really; if the underlying OS supports DoH then browsers can use the settings of that resolver if present and rely on them instead of having to manually do it. On another note; I like the principles laid out in the article, they do reflect how I'd want a system to act in the presence of DoH servers. I bet the steps forward will be to test if the DHCP Server configured is capable of DoH and if it is, then using it only over DoH on that network. A second thing might be if DHCP or RA's learn a new flag that indicate the resolver uses DoH upstream or supports DoH itself.
- numlock86 7y ago
  Did you mean DNS server instead of DHCP server? What has DHCP to do with any of this?
  - vetinari 7y ago
    DHCP tells the devices on the local network, what DNS server they are supposed to be using.
    - numlock86 7y ago
      I know. Hence the question.
  - jlgaddis 7y ago
    A DHCP option, e.g., "DoH server", could be added to the DHCP spec to tell clients which DoH servers to use (just like happens now with "regular DNS").
    - numlock86 7y ago
      And why not just use the DNS server itself for this? Like negotiate with the DNS if it supports DoH? Why does it need to influence other standards like DHCP? It's the same with deal with HTTP and HTTPS basically: The server tells me if HTTPS is supported or not. (Yes, there is HSTS but that's a different story ...)
      - jlgaddis 7y ago
        The first thing that comes to mind is that DHCP option 6 specifices (one or more) IP addresses, whereas with DoH you probably want to specify (ideally, multiple) hostnames, for various reasons.
        fanf2 7y ago
        The DoH server needs to be identified using a URL (a target for POST requests) or template (for GET requests). There isn’t a standard way to get from a server name to a DoH URL and DoH servers differ in their choice of path name.
        jlgaddis 7y ago
        We pretty much already have this exact thing with options 66 (hostname) and 67 (filename) for clients booting via TFTP. Most DoH servers, AIUI, use the same well-known path, so we'd simply need two more DHCP options: one for the DoH server's hostname and another for the path. There's no reason something like this couldn't easily be added to the DHCP specification and, at some point, I expect it will... everyone will come together to agree on the details and we'll end up with a new/updated RFC.
- protomyth 7y ago
  Well, it certainly changes the equation from being a rogue element on a network to something that is just another management setting. I won't be truly happy until I can setup a DoH server of my own. Does anyone know if there is any value to adding DoH to the external servers that are only used by other name servers? Will anyone's name servers do their lookup with DoH? The less the outside world knows about what's on a private network the better. Information leaking be it the processor or to someone's servers is just another problem waiting to happen.
  - zamadatix 7y ago
    What's stopping you from setting up a DoH server of your own today? DoH is only focusing to encrypt the first hop for now as it was easiest to hit and where the majority of the problem is.
    - protomyth 7y ago
      Because no OS would use it. I'm against web browsers (or frankly any other client program) using a DNS other than what the OS is set for.
      - psanford 7y ago
        Its really not that hard. I've got /etc/resolv.conf pointed at 127.0.0.1 and a local stub resolver forwarding to an upstream DOH server. Boom! everything using gethostbyname is now using DOH.
        protomyth 7y ago
        We have a private network with many internal servers and many operating systems. Having browsers skip our name servers is a problem.
        zamadatix 7y ago
        The above solution has nothing to do with browsers.
- josteink 7y ago
  > I guess that is the end of the naysaying really The whole “naysaying” (as you so insultingly put it) was never against encryption. It was always about putting the user, the OS and network-operator in control of their own infrastructure, something the DoH-crowd dismissed entirely as a valid concern. So now that Microsoft has just provided that control, sure we’re happy. But don’t act like the complaints made by the “naysayers” weren’t 100% valid. The DoH-crowd was short-sighted, enclosed in their own echo-chamber and didn’t listen to feedback or criticism. This probably hurt DoH long term more than anything else. Now it’s by default “tainted” technology and people have already created and deployed firewalling solutions to block it. Those solutions are probably going to stay in place.
  - zaarn 7y ago
    Well, I don't see how DoH prevents you from being in control of your infrastructure. You can run your own DoH server and set it as DoH Server in Firefox without much issue and I doubt Windows will be different.
ggzgd 7y ago
>DNS traffic represents a snapshot of the user’s browsing history This is what the Mozilla Corporation didn't get when they decided to send by default all the DNS traffic to Cloudflare. Or, perhaps, they did get it right...
- beatgammit 7y ago
  Well, it's at least different than sending it to your ISP, which I'm sure most users do by default. The question is, do you trust CloudFlare or your ISP more? I hope more DNS servers support DNS over HTTPS soon because my options for using it are: - CloudFlare - self hosted with CloudFlare's code Not a lot of options there...
  - sheogorath 7y ago
    You might want to take a look at my repository: https://git.shivering-isles.com/container-library/dns-over-https https://git.shivering-isles.com/container-library/dns-over-h... It's not that complicated to run DoH, one just has to do it.
  - turbinerneiter 7y ago
    My ISP. They are regulated and I pay them. If they do stuff I don't want I can complain and switch. I have not relationship with Cloudfare. I don't want them to have data about me. I never signed a contract with them.
    - olyjohn 7y ago
      > If they do stuff I don't want I can complain and switch. You must be one of the lucky few.
    - smileysteve 7y ago
      > My ISP. They are regulated and I pay them. Depending on the regulations (this is true some of the EU) On the other hand, Cloudflare has larger customers who also often have an interest in your privacy (the services you are using). And CloudFlare isn't a government granted monopoly, so both their customers and their users have more ability to switch.
zeruch 7y ago
...it just won't improve it with the endless telemetry and crap ads it inserts at the OS level.
atesti 7y ago
Currently DNS filters and hosts files are a good way to block trackers and telemetry. By securing this using HTTPS, we are not far from closing another loophole for user freedom: What if Chrome does not allow self signed PKI roots anymore? On Android one already gets a scary message each day when installing a root certificate
- chopin 7y ago
  I doubt that as it would exclude Chrome from many corporate environments.
- shawnz 7y ago
  We support strong widely available encryption even though it enables terrorism, weapons dealing, human trafficking, etc. But when it enables the delivery of hard-to-block ads, that's too far? In my opinion it was wrong to go down the path of using DNS for content blocking in the first place. Even without widely available DoH, bypassing dns-based content blocking is trivial.
  - JohnFen 7y ago
    >But when it enables the delivery of hard-to-block ads, that's too far? If I'm aware of terrorism, weapons dealing, human trafficking, etc., traffic on my network, I'd certainly block that. That's a different issue from crypto. Also, I'm not so interested in blocking advertising anyway. I'm interested in blocking unauthorized data leakage (tracking, telemetry, etc.) > In my opinion it was wrong to go down the path of using DNS for content blocking in the first place. It has never been an awesome approach, true, but it's often the only approach available. > Even without widely available DoH, bypassing dns-based content blocking is trivial. Possible, yes. Trivial, no.
  - userbinator 7y ago
    Possibly contrarian opinion: I only support "strongly widely available encryption" that gives the user freedom. I don't support using encryption to create authoritarian "walled garden" prisons or as a "security" excuse to take away freedoms of the user (this includes, among other things, DRM.)
hiccuphippo 7y ago
I already use dnscrypt-proxy on both Windows and Linux for DoH. Filtering hosts is even easier because it allows wildcards.
josteink 7y ago
> Silently changing the DNS servers trusted to do Windows resolutions could inadvertently bypass these controls and frustrate our users. We believe device administrators have the right to control where their DNS traffic goes. What Google and Mozilla seems not to get, Microsoft gets 100%. Good on them. Thanks for sticking up for the user, MS. At least someone did.
- kyrra 7y ago
  Mozilla is being more aggressive here than Google. My understanding about how Chrome will work, if the DNS servers configured on your machine support DoH, they will silently upgrade to use DoH. But it is entirely based on what your system DNS server is set to. https://9to5google.com/2019/10/28/chrome-encrypt-dns/ https://9to5google.com/2019/10/28/chrome-encrypt-dns/ Mozilla (I believe) is doing rolling out DoH to users (in the US) to use CloudFlare's DoH server. This will bypass the system configured DNS servers. This can be disabled in settings. And if the DoH DNS lookup fails, it'll fallback to the system configured DNS. https://support.mozilla.org/en-US/kb/firefox-dns-over-https https://support.mozilla.org/en-US/kb/firefox-dns-over-https (I'm a googler, opinions are my own)
  - SAI_Peregrinus 7y ago
    Additionally (for Mozilla, not sure about chrome) there are a couple of checks to allow system administrators to force Firefox to fall back to the system DNS if desired. Either they can return NXDOMAIN (or some other options) to queries for use-application-dns.net, or they can use the usual group policy/active directory/policies.json methods to configure users' Firefox to not use DoH or use their internal DNS server with DoH if supported. https://support.mozilla.org/en-US/kb/canary-domain-use-application-dnsnet https://support.mozilla.org/en-US/kb/canary-domain-use-appli... https://support.mozilla.org/en-US/kb/customizing-firefox-using-group-policy-windows https://support.mozilla.org/en-US/kb/customizing-firefox-usi... https://support.mozilla.org/en-US/kb/customizing-firefox-using-policiesjson https://support.mozilla.org/en-US/kb/customizing-firefox-usi... https://github.com/mozilla/policy-templates/blob/master/README.md#dnsoverhttps https://github.com/mozilla/policy-templates/blob/master/READ...
LinuxBender 7y ago
If you are a stubborn troglodyte like me and have your own secure DNS solution in place, then you can add the following domain to your local DNS to always NXDOMAIN: use-application-dns.net to tell the resolver to use local network DNS settings. And then of course, null route all the DoH resolvers. I am somewhat curious what the fallout would be if ISP's decided to NXDOMAIN that domain. Would they get in any trouble?
- EvanAnderson 7y ago
  If your DNS server doesn't easily allow you to return an NXDOMAIN (the DNS server in Windows Server is this way, for example) you can also just create an empty zone for "use-application-dns.net". As long as no "A" or "AAAA" records are returned the conditions for the canary will be satisfied.
- asveikau 7y ago
  I added that after I read about it from mozilla. Is there cross-vendor support for that same canary? It would be nice if implementers standardize on that.
- jlgaddis 7y ago
  Mozilla stated previously that if the bypassing was "abused" (such as by ISPs), they'd effectively just ignore it (paraphrasing) and continue to use DoH anyways.
sb057 7y ago
I wonder if the ISPA (British telecom association) will nominate Microsoft for the 2020 Internet Villain Award. https://www.ispa.org.uk/ispa-announces-finalists-for-2019-internet-heroes-and-villains-trump-and-mozilla-lead-the-way-as-villain-nominees/ https://www.ispa.org.uk/ispa-announces-finalists-for-2019-in...
- agwa 7y ago
  Read the article. Unlike Mozilla's approach, Microsoft's DoH rollout is intentionally designed to not bypass DNS-based filtering. ISPA shouldn't have any problem with what Microsoft is doing.
  - TazeTSchnitzel 7y ago
    Au contraire, if you've configured Windows to use e.g. Google's DNS then it will bypass deep-packet-inspection-based DNS filtering.
    - chupasaurus 7y ago
      Except ISP will block 443/tcp for these widely known servers and if I got it right Windows will fallback to unencrypted DNS.
      - myu701 7y ago
        It sounds like in this early milestone they will NOT fallback to unencrypted DNS to do a sort of 'scream test'. > We can start seeing the challenges in enforcing the line on preferring resolution failure to unencrypted fallback. In line with principle 4, this DoH use will be enforced so that a server confirmed by Windows to support DoH will not be consulted via classic DNS. If this preference for privacy over functionality causes any disruption in common web scenarios, we’ll find out early.
      - throw0101a 7y ago
        Until HTTP/3 gets popular, and then 443/udp becomes a things as well. :)
dTal 7y ago
Can anyone expand on what advantage HTTPS has over raw SSL/TLS? Why tunnel over another application-level protocol? What's the value-add of throwing GET and POST etc into the mix? Truth be told, I don't even really understand why we didn't adopt "DNSs" decades ago along with HTTPS. Encrypt at socket level, done. What's the catch?
- dqv 7y ago
  Here's what the RFC[0] says about it: >Two primary use cases were considered during this protocol's development. These use cases are preventing on-path devices from interfering with DNS operations, and also allowing web applications to access DNS information via existing browser APIs in a safe way consistent with Cross Origin Resource Sharing [...] [0]: https://tools.ietf.org/html/rfc8484#page-3 https://tools.ietf.org/html/rfc8484#page-3
  - dTal 7y ago
    I don't see how on-path devices could distinguish between DNS-over-HTTPS and DNS-over-TLS, provided they were run on the same port. It's just an encrypted socketed connection. As for web apps... well, that's horrifying enough to be the real reason. Javascript should not be running its own DNS queries, outside of the system DNS settings - it's a layering violation that looks a lot like an end run around the "user agent" concept (i.e. the web app, rather than the browser itself, is the "trusted endpoint" and the user is considered an adversary). If web browsers actually wanted such functionality to be available, they could easily expose an API for it.
  - catalogia 7y ago
    > "allowing web applications to access DNS information via existing browser APIs in a safe way consistent with Cross Origin Resource Sharing [...]" What justifications for this exist?
- zokier 7y ago
  There is RFC 7858 Specification for DNS over Transport Layer Security (TLS) https://tools.ietf.org/html/rfc7858 https://tools.ietf.org/html/rfc7858
pdkl95 7y ago
> There is an assumption by many that DNS encryption requires DNS centralization. A lot of the discussion recently, like this statement, conflates "DNS encryption" with "DoH". Encrypting DNS does not require centralization, but DoH does require[1] centralization in in the RFC. DoH doesn't even "improve user privacy"; it simply changes who can record your DNS queries. Instead of the ISP, Cloudflare/Microsoft/etc gets to see your unencrypted DNS queries. The way to actually improve privacy is to perform the recursive resolution locally[2]. The actual communication with each individual DNS server needs to be encrypted, which is where work needs to be done. DNS servers need to support DNS over TLS (DoT) or some other type of encrypted transport. Hypothetically, DoH could be modified to support this, although that seems more complicated than simply wrapping the DNS protocol in TLS. You don't get privacy by centralizing all of your requests onto one server. To protect privacy, you limit the data that any one party can see. DNS was designed for this purpose: only the NS record of a domain needs to be sent to a centralized server, which is easy to cache for a long time. Most requests then go to domain-specified authoritative server[4]. It's good to see Microsoft at least trying to address this at the OS level. App doing DNS without involving the OS seems to be more about taking away control from the user. I'm sure Google would love to be able top bypass DNS based adblocking. [1] https://news.ycombinator.com/item?id=21110296 https://news.ycombinator.com/item?id=21110296 [2] Which is easy: follow NS records until you get to the server that has your authoritative answer. [3] https://news.ycombinator.com/item?id=21348328 https://news.ycombinator.com/item?id=21348328
- Someone1234 7y ago
  > Encrypting DNS does not require centralization, but DoH does require centralization in in the RFC. This isn't a problem that DoH was designed to solve. It is designed to be a highly compatible, secure, endpoint DNS solution. Which it is. So while this criticism is accurate, it is also irrelevant, DoH replaces one "hop" on DNS and that's all it was ever designed to do. > DoH doesn't even "improve user privacy"; it simply changes who can record your DNS queries. I It stops passive eavesdropping. Right now you can change who you use for DNS and your ISP can still monitor your DNS to profile you and invade your privacy. With DoH you can pick a privacy focused endpoint and nobody between you or that endpoint can trivially monitor your DNS. DoT solves this too but has issues (see next response). > DNS servers need to support DNS over TLS (DoT) or some other type of encrypted transport. DoT and even unencrypted DNS is blocked on a lot of free WiFi. Now what? DoH solves this issue, as it was designed to. DoH can traverse even the most locked down network over the same HTTPS channel as any other web traffic. > You don't get privacy by centralizing all of your requests onto one server. Perhaps, but it scales really well and is the basis for all current DNS resolution. If everyone on the internet did as you suggested core internet infrastructure would fail under the load. You've essentially killed almost all caching.
2bitencryption 7y ago
Is there an easy explanation anywhere of how I can achieve the most secure DNS configuration that is reasonably simple to set up today? I.e. what's the best I can do, short of hosting my own DNS?
- josteink 7y ago
  Hosting your own DNS is easy. I’m pretty sure there are pre-made images for the raspberry pi just for this purpose.
- babypuncher 7y ago
  I have a few VMs that run all my networking services. One of them runs cloudflared and Pihole. Cloudflared is a DNS server that routs all DNS queries to 1.1.1.1 using DoH. I have Pihole configured to use cloudflared as its upstream DNS. So in addition to the Pihole's ad/tracker blocking, all DNS requests leaving my network are done over DoH regardless if clients actually support it.
- basch 7y ago
  If taking safest in the most literal sense, and you trust PCH/IBM, then Quad9 is a pretty good choice for most people. Unlike normal DNS, Quad9 purposely does not resolve threatening results. If you view "safest" more to mean "prevents the spread of malware, keeping everyone safer" than "gives me absolute privacy I can audit" then it's hard to beat. They do log data at the city/metropolitan level for threat analysis. It's one of the few services that supports DoH, and Chrome already automatically upgrades requests when it detects you using Quad9. https://www.quad9.net/policy/ https://www.quad9.net/policy/
kodablah 7y ago
> However, since these servers and their DoH configurations are well known, Windows can automatically upgrade to DoH while using the same server. They are not well known. How do they know my DNS server is DoH? It's good that, like Chrome and unlike FF, they plan on using the existing DNS servers but are they also using a known whitelist of DoH servers? How can I get on there? We need an HSTS/Alt-Svc for DoH...can't I return an EDNS response or something w/ my standard DNS response that says I support DoH and the clients use it henceforth while it remains the same configured server? Maybe even a default domain to check DoH support even on NXDOMAIN so it doesn't leak the first domain requested in clear UDP.
- judge2020 7y ago
  Chrome has an upgrade list[0], last time I checked Firefox allowed you to choose in settings. 0: https://github.com/chromium/chromium/blob/711b1ba2735f8af4bd6359c6292e1875412df74f/net/dns/dns_util.cc#L146-L217 https://github.com/chromium/chromium/blob/711b1ba2735f8af4bd...
  - kodablah 7y ago
    I feared it was hardcoded :-( I am trying not to ask every user of my DNS server to manually configure each of their browsers and their OS.
dancemethis1 7y ago
...Are people going to believe this?
andrewstuart 7y ago
This is awesome news. Long awaited and MUCH needed for privacy. This is the primary way in which your privacy is invaded. Where is Apple on this?
ocdtrekkie 7y ago
This is the correct approach, and I'm glad to see Microsoft is taking the lead here. The operating system should support DoH. Any browser not respecting the operating system's DNS configuration should rollback their plans to hijack DNS requests (particularly Firefox) and entrust the network stack to the OS, as is intended.
cm2187 7y ago
And of course, for your privacy, Microsoft will send a copy of all your DNS requests to its telemetry servers unless you opt out with a registry key!
- foxrob92 7y ago
  A registry key that is reset to the default every major update, no less.
m0xte 7y ago
Let us disable telemetry first.
JohnFen 7y ago
DoH provides a way for programs to do DNS lookups while evading any attempts at blocking certain DNS lookups. This is a dream situation for advertisers and enforced telemetry. This is also why the existence of DoH has made it necessary for me to install a MITM HTTPS proxy in my network, so that I can regain control. DoH brings some privacy benefits, but it also brings privacy costs. It is not an unambiguous win -- it is a tradeoff.
- dastx 7y ago
  If you run a local DNS server (e.g. AdGuard Home or Pi-Hole) you can set them up as a DoH system and still block requests. My bigger issue with this is that Microsoft is trying to paint themselves as an angel when in reality, as part of Windows 10, they've added so much telemetry, it feels as if they're closer to an ad giant than a software giant.
  - tybit 7y ago
    Genuine question, at that point does DoH buy you anything?
    - kodablah 7y ago
      There are security benefits of TLS. Now, if you're asking what benefits it has over DNS-over-TLS, making DNS requests indistinguishable from other HTTP requests has privacy/shaping benefits.
    - tptacek 7y ago
      If you're in the US, your ISP is right now actively recording and monetizing your DNS requests by passive collection. DoH immediately exempts you from this surveillance.
      - dastx 7y ago
        > exempts Specifically, ISPs are unable to read the requests or responses of your DNS requests due to end to end encryption between the client and the DNS server.
mc3 7y ago
Why are Microsoft doing this? One explanation is morality - they are doing it for the greater good. Another explaination is branding - they want to look like the new "no evil company" which ties in with their open source initiatives. It could also be a way to prevent Google having too much power which is a good thing for Microsoft. It also might be to sell more Windows licences, but I doubt this would factor into the decision about what OS to use. Or it is just that technical people got to make the decision unhampered by management, and technical people value privacy.
- godelski 7y ago
  There's the age old question, "if someone does something good for the wrong reasons, are those things still good?" I for one welcome the new competitive facade of privacy and security. Minor improvements are at least improvements.
- zamadatix 7y ago
  It could also be that it was looking like a nightmare world where every app had its own independent DNS configuration and they didn't want to have to deal with that.
deleted 7y ago
[deleted]
auslander 7y ago
Is it possible in DoH to store and serve HTTP cookies?
iramiller 7y ago
I suppose with DNS level blocking of ads now impossible that means I will need to crawl my DNS blocklist and resolve those domains, then block those IP addresses at the network gateway... Even if clients punch out through a secret DoH ip those resolved advertiser domains will still be null routed. Not as easy but just as effective.

189 points by omiossec 7y ago

I guess that is the end of the naysaying really; if the underlying OS supports DoH then browsers can use the settings of that resolver if present and rely on them instead of having to manually do it. On another note; I like the principles laid out in the article, they do reflect how I'd want a system to act in the presence of DoH servers. I bet the steps forward will be to test if the DHCP Server configured is capable of DoH and if it is, then using it only over DoH on that network. A second thing might be if DHCP or RA's learn a new flag that indicate the resolver uses DoH upstream or supports DoH itself.

numlock86 7y ago
Did you mean DNS server instead of DHCP server? What has DHCP to do with any of this?
- vetinari 7y ago
  DHCP tells the devices on the local network, what DNS server they are supposed to be using.
  - numlock86 7y ago
    I know. Hence the question.
- jlgaddis 7y ago
  A DHCP option, e.g., "DoH server", could be added to the DHCP spec to tell clients which DoH servers to use (just like happens now with "regular DNS").
  - numlock86 7y ago
    And why not just use the DNS server itself for this? Like negotiate with the DNS if it supports DoH? Why does it need to influence other standards like DHCP? It's the same with deal with HTTP and HTTPS basically: The server tells me if HTTPS is supported or not. (Yes, there is HSTS but that's a different story ...)
    - jlgaddis 7y ago
      The first thing that comes to mind is that DHCP option 6 specifices (one or more) IP addresses, whereas with DoH you probably want to specify (ideally, multiple) hostnames, for various reasons.
      - fanf2 7y ago
        The DoH server needs to be identified using a URL (a target for POST requests) or template (for GET requests). There isn’t a standard way to get from a server name to a DoH URL and DoH servers differ in their choice of path name.
        jlgaddis 7y ago
        We pretty much already have this exact thing with options 66 (hostname) and 67 (filename) for clients booting via TFTP. Most DoH servers, AIUI, use the same well-known path, so we'd simply need two more DHCP options: one for the DoH server's hostname and another for the path. There's no reason something like this couldn't easily be added to the DHCP specification and, at some point, I expect it will... everyone will come together to agree on the details and we'll end up with a new/updated RFC.
protomyth 7y ago
Well, it certainly changes the equation from being a rogue element on a network to something that is just another management setting. I won't be truly happy until I can setup a DoH server of my own. Does anyone know if there is any value to adding DoH to the external servers that are only used by other name servers? Will anyone's name servers do their lookup with DoH? The less the outside world knows about what's on a private network the better. Information leaking be it the processor or to someone's servers is just another problem waiting to happen.
- zamadatix 7y ago
  What's stopping you from setting up a DoH server of your own today? DoH is only focusing to encrypt the first hop for now as it was easiest to hit and where the majority of the problem is.
  - protomyth 7y ago
    Because no OS would use it. I'm against web browsers (or frankly any other client program) using a DNS other than what the OS is set for.
    - psanford 7y ago
      Its really not that hard. I've got /etc/resolv.conf pointed at 127.0.0.1 and a local stub resolver forwarding to an upstream DOH server. Boom! everything using gethostbyname is now using DOH.
      - protomyth 7y ago
        We have a private network with many internal servers and many operating systems. Having browsers skip our name servers is a problem.
        zamadatix 7y ago
        The above solution has nothing to do with browsers.
josteink 7y ago
> I guess that is the end of the naysaying really The whole “naysaying” (as you so insultingly put it) was never against encryption. It was always about putting the user, the OS and network-operator in control of their own infrastructure, something the DoH-crowd dismissed entirely as a valid concern. So now that Microsoft has just provided that control, sure we’re happy. But don’t act like the complaints made by the “naysayers” weren’t 100% valid. The DoH-crowd was short-sighted, enclosed in their own echo-chamber and didn’t listen to feedback or criticism. This probably hurt DoH long term more than anything else. Now it’s by default “tainted” technology and people have already created and deployed firewalling solutions to block it. Those solutions are probably going to stay in place.
- zaarn 7y ago
  Well, I don't see how DoH prevents you from being in control of your infrastructure. You can run your own DoH server and set it as DoH Server in Firefox without much issue and I doubt Windows will be different.

ggzgd 7y ago

>DNS traffic represents a snapshot of the user’s browsing history This is what the Mozilla Corporation didn't get when they decided to send by default all the DNS traffic to Cloudflare. Or, perhaps, they did get it right...

beatgammit 7y ago
Well, it's at least different than sending it to your ISP, which I'm sure most users do by default. The question is, do you trust CloudFlare or your ISP more? I hope more DNS servers support DNS over HTTPS soon because my options for using it are: - CloudFlare - self hosted with CloudFlare's code Not a lot of options there...
- sheogorath 7y ago
  You might want to take a look at my repository: https://git.shivering-isles.com/container-library/dns-over-https https://git.shivering-isles.com/container-library/dns-over-h... It's not that complicated to run DoH, one just has to do it.
- turbinerneiter 7y ago
  My ISP. They are regulated and I pay them. If they do stuff I don't want I can complain and switch. I have not relationship with Cloudfare. I don't want them to have data about me. I never signed a contract with them.
  - olyjohn 7y ago
    > If they do stuff I don't want I can complain and switch. You must be one of the lucky few.
  - smileysteve 7y ago
    > My ISP. They are regulated and I pay them. Depending on the regulations (this is true some of the EU) On the other hand, Cloudflare has larger customers who also often have an interest in your privacy (the services you are using). And CloudFlare isn't a government granted monopoly, so both their customers and their users have more ability to switch.

zeruch 7y ago

...it just won't improve it with the endless telemetry and crap ads it inserts at the OS level.

atesti 7y ago

Currently DNS filters and hosts files are a good way to block trackers and telemetry. By securing this using HTTPS, we are not far from closing another loophole for user freedom: What if Chrome does not allow self signed PKI roots anymore? On Android one already gets a scary message each day when installing a root certificate

chopin 7y ago
I doubt that as it would exclude Chrome from many corporate environments.
shawnz 7y ago
We support strong widely available encryption even though it enables terrorism, weapons dealing, human trafficking, etc. But when it enables the delivery of hard-to-block ads, that's too far? In my opinion it was wrong to go down the path of using DNS for content blocking in the first place. Even without widely available DoH, bypassing dns-based content blocking is trivial.
- JohnFen 7y ago
  >But when it enables the delivery of hard-to-block ads, that's too far? If I'm aware of terrorism, weapons dealing, human trafficking, etc., traffic on my network, I'd certainly block that. That's a different issue from crypto. Also, I'm not so interested in blocking advertising anyway. I'm interested in blocking unauthorized data leakage (tracking, telemetry, etc.) > In my opinion it was wrong to go down the path of using DNS for content blocking in the first place. It has never been an awesome approach, true, but it's often the only approach available. > Even without widely available DoH, bypassing dns-based content blocking is trivial. Possible, yes. Trivial, no.
- userbinator 7y ago
  Possibly contrarian opinion: I only support "strongly widely available encryption" that gives the user freedom. I don't support using encryption to create authoritarian "walled garden" prisons or as a "security" excuse to take away freedoms of the user (this includes, among other things, DRM.)

hiccuphippo 7y ago

I already use dnscrypt-proxy on both Windows and Linux for DoH. Filtering hosts is even easier because it allows wildcards.

josteink 7y ago

> Silently changing the DNS servers trusted to do Windows resolutions could inadvertently bypass these controls and frustrate our users. We believe device administrators have the right to control where their DNS traffic goes. What Google and Mozilla seems not to get, Microsoft gets 100%. Good on them. Thanks for sticking up for the user, MS. At least someone did.

kyrra 7y ago
Mozilla is being more aggressive here than Google. My understanding about how Chrome will work, if the DNS servers configured on your machine support DoH, they will silently upgrade to use DoH. But it is entirely based on what your system DNS server is set to. https://9to5google.com/2019/10/28/chrome-encrypt-dns/ https://9to5google.com/2019/10/28/chrome-encrypt-dns/ Mozilla (I believe) is doing rolling out DoH to users (in the US) to use CloudFlare's DoH server. This will bypass the system configured DNS servers. This can be disabled in settings. And if the DoH DNS lookup fails, it'll fallback to the system configured DNS. https://support.mozilla.org/en-US/kb/firefox-dns-over-https https://support.mozilla.org/en-US/kb/firefox-dns-over-https (I'm a googler, opinions are my own)
- SAI_Peregrinus 7y ago
  Additionally (for Mozilla, not sure about chrome) there are a couple of checks to allow system administrators to force Firefox to fall back to the system DNS if desired. Either they can return NXDOMAIN (or some other options) to queries for use-application-dns.net, or they can use the usual group policy/active directory/policies.json methods to configure users' Firefox to not use DoH or use their internal DNS server with DoH if supported. https://support.mozilla.org/en-US/kb/canary-domain-use-application-dnsnet https://support.mozilla.org/en-US/kb/canary-domain-use-appli... https://support.mozilla.org/en-US/kb/customizing-firefox-using-group-policy-windows https://support.mozilla.org/en-US/kb/customizing-firefox-usi... https://support.mozilla.org/en-US/kb/customizing-firefox-using-policiesjson https://support.mozilla.org/en-US/kb/customizing-firefox-usi... https://github.com/mozilla/policy-templates/blob/master/README.md#dnsoverhttps https://github.com/mozilla/policy-templates/blob/master/READ...

LinuxBender 7y ago

If you are a stubborn troglodyte like me and have your own secure DNS solution in place, then you can add the following domain to your local DNS to always NXDOMAIN: use-application-dns.net to tell the resolver to use local network DNS settings. And then of course, null route all the DoH resolvers. I am somewhat curious what the fallout would be if ISP's decided to NXDOMAIN that domain. Would they get in any trouble?

EvanAnderson 7y ago
If your DNS server doesn't easily allow you to return an NXDOMAIN (the DNS server in Windows Server is this way, for example) you can also just create an empty zone for "use-application-dns.net". As long as no "A" or "AAAA" records are returned the conditions for the canary will be satisfied.
asveikau 7y ago
I added that after I read about it from mozilla. Is there cross-vendor support for that same canary? It would be nice if implementers standardize on that.
jlgaddis 7y ago
Mozilla stated previously that if the bypassing was "abused" (such as by ISPs), they'd effectively just ignore it (paraphrasing) and continue to use DoH anyways.

sb057 7y ago

I wonder if the ISPA (British telecom association) will nominate Microsoft for the 2020 Internet Villain Award. https://www.ispa.org.uk/ispa-announces-finalists-for-2019-internet-heroes-and-villains-trump-and-mozilla-lead-the-way-as-villain-nominees/ https://www.ispa.org.uk/ispa-announces-finalists-for-2019-in...

agwa 7y ago
Read the article. Unlike Mozilla's approach, Microsoft's DoH rollout is intentionally designed to not bypass DNS-based filtering. ISPA shouldn't have any problem with what Microsoft is doing.
- TazeTSchnitzel 7y ago
  Au contraire, if you've configured Windows to use e.g. Google's DNS then it will bypass deep-packet-inspection-based DNS filtering.
  - chupasaurus 7y ago
    Except ISP will block 443/tcp for these widely known servers and if I got it right Windows will fallback to unencrypted DNS.
    - myu701 7y ago
      It sounds like in this early milestone they will NOT fallback to unencrypted DNS to do a sort of 'scream test'. > We can start seeing the challenges in enforcing the line on preferring resolution failure to unencrypted fallback. In line with principle 4, this DoH use will be enforced so that a server confirmed by Windows to support DoH will not be consulted via classic DNS. If this preference for privacy over functionality causes any disruption in common web scenarios, we’ll find out early.
    - throw0101a 7y ago
      Until HTTP/3 gets popular, and then 443/udp becomes a things as well. :)

dTal 7y ago

Can anyone expand on what advantage HTTPS has over raw SSL/TLS? Why tunnel over another application-level protocol? What's the value-add of throwing GET and POST etc into the mix? Truth be told, I don't even really understand why we didn't adopt "DNSs" decades ago along with HTTPS. Encrypt at socket level, done. What's the catch?

dqv 7y ago
Here's what the RFC[0] says about it: >Two primary use cases were considered during this protocol's development. These use cases are preventing on-path devices from interfering with DNS operations, and also allowing web applications to access DNS information via existing browser APIs in a safe way consistent with Cross Origin Resource Sharing [...] [0]: https://tools.ietf.org/html/rfc8484#page-3 https://tools.ietf.org/html/rfc8484#page-3
- dTal 7y ago
  I don't see how on-path devices could distinguish between DNS-over-HTTPS and DNS-over-TLS, provided they were run on the same port. It's just an encrypted socketed connection. As for web apps... well, that's horrifying enough to be the real reason. Javascript should not be running its own DNS queries, outside of the system DNS settings - it's a layering violation that looks a lot like an end run around the "user agent" concept (i.e. the web app, rather than the browser itself, is the "trusted endpoint" and the user is considered an adversary). If web browsers actually wanted such functionality to be available, they could easily expose an API for it.
- catalogia 7y ago
  > "allowing web applications to access DNS information via existing browser APIs in a safe way consistent with Cross Origin Resource Sharing [...]" What justifications for this exist?
zokier 7y ago
There is RFC 7858 Specification for DNS over Transport Layer Security (TLS) https://tools.ietf.org/html/rfc7858 https://tools.ietf.org/html/rfc7858

pdkl95 7y ago

> There is an assumption by many that DNS encryption requires DNS centralization. A lot of the discussion recently, like this statement, conflates "DNS encryption" with "DoH". Encrypting DNS does not require centralization, but DoH does require[1] centralization in in the RFC. DoH doesn't even "improve user privacy"; it simply changes who can record your DNS queries. Instead of the ISP, Cloudflare/Microsoft/etc gets to see your unencrypted DNS queries. The way to actually improve privacy is to perform the recursive resolution locally[2]. The actual communication with each individual DNS server needs to be encrypted, which is where work needs to be done. DNS servers need to support DNS over TLS (DoT) or some other type of encrypted transport. Hypothetically, DoH could be modified to support this, although that seems more complicated than simply wrapping the DNS protocol in TLS. You don't get privacy by centralizing all of your requests onto one server. To protect privacy, you limit the data that any one party can see. DNS was designed for this purpose: only the NS record of a domain needs to be sent to a centralized server, which is easy to cache for a long time. Most requests then go to domain-specified authoritative server[4]. It's good to see Microsoft at least trying to address this at the OS level. App doing DNS without involving the OS seems to be more about taking away control from the user. I'm sure Google would love to be able top bypass DNS based adblocking. [1] https://news.ycombinator.com/item?id=21110296 https://news.ycombinator.com/item?id=21110296 [2] Which is easy: follow NS records until you get to the server that has your authoritative answer. [3] https://news.ycombinator.com/item?id=21348328 https://news.ycombinator.com/item?id=21348328

Someone1234 7y ago
> Encrypting DNS does not require centralization, but DoH does require centralization in in the RFC. This isn't a problem that DoH was designed to solve. It is designed to be a highly compatible, secure, endpoint DNS solution. Which it is. So while this criticism is accurate, it is also irrelevant, DoH replaces one "hop" on DNS and that's all it was ever designed to do. > DoH doesn't even "improve user privacy"; it simply changes who can record your DNS queries. I It stops passive eavesdropping. Right now you can change who you use for DNS and your ISP can still monitor your DNS to profile you and invade your privacy. With DoH you can pick a privacy focused endpoint and nobody between you or that endpoint can trivially monitor your DNS. DoT solves this too but has issues (see next response). > DNS servers need to support DNS over TLS (DoT) or some other type of encrypted transport. DoT and even unencrypted DNS is blocked on a lot of free WiFi. Now what? DoH solves this issue, as it was designed to. DoH can traverse even the most locked down network over the same HTTPS channel as any other web traffic. > You don't get privacy by centralizing all of your requests onto one server. Perhaps, but it scales really well and is the basis for all current DNS resolution. If everyone on the internet did as you suggested core internet infrastructure would fail under the load. You've essentially killed almost all caching.

2bitencryption 7y ago

Is there an easy explanation anywhere of how I can achieve the most secure DNS configuration that is reasonably simple to set up today? I.e. what's the best I can do, short of hosting my own DNS?

josteink 7y ago
Hosting your own DNS is easy. I’m pretty sure there are pre-made images for the raspberry pi just for this purpose.
babypuncher 7y ago
I have a few VMs that run all my networking services. One of them runs cloudflared and Pihole. Cloudflared is a DNS server that routs all DNS queries to 1.1.1.1 using DoH. I have Pihole configured to use cloudflared as its upstream DNS. So in addition to the Pihole's ad/tracker blocking, all DNS requests leaving my network are done over DoH regardless if clients actually support it.
basch 7y ago
If taking safest in the most literal sense, and you trust PCH/IBM, then Quad9 is a pretty good choice for most people. Unlike normal DNS, Quad9 purposely does not resolve threatening results. If you view "safest" more to mean "prevents the spread of malware, keeping everyone safer" than "gives me absolute privacy I can audit" then it's hard to beat. They do log data at the city/metropolitan level for threat analysis. It's one of the few services that supports DoH, and Chrome already automatically upgrades requests when it detects you using Quad9. https://www.quad9.net/policy/ https://www.quad9.net/policy/

kodablah 7y ago

> However, since these servers and their DoH configurations are well known, Windows can automatically upgrade to DoH while using the same server. They are not well known. How do they know my DNS server is DoH? It's good that, like Chrome and unlike FF, they plan on using the existing DNS servers but are they also using a known whitelist of DoH servers? How can I get on there? We need an HSTS/Alt-Svc for DoH...can't I return an EDNS response or something w/ my standard DNS response that says I support DoH and the clients use it henceforth while it remains the same configured server? Maybe even a default domain to check DoH support even on NXDOMAIN so it doesn't leak the first domain requested in clear UDP.

judge2020 7y ago
Chrome has an upgrade list[0], last time I checked Firefox allowed you to choose in settings. 0: https://github.com/chromium/chromium/blob/711b1ba2735f8af4bd6359c6292e1875412df74f/net/dns/dns_util.cc#L146-L217 https://github.com/chromium/chromium/blob/711b1ba2735f8af4bd...
- kodablah 7y ago
  I feared it was hardcoded :-( I am trying not to ask every user of my DNS server to manually configure each of their browsers and their OS.

dancemethis1 7y ago

...Are people going to believe this?

andrewstuart 7y ago

This is awesome news. Long awaited and MUCH needed for privacy. This is the primary way in which your privacy is invaded. Where is Apple on this?

ocdtrekkie 7y ago

This is the correct approach, and I'm glad to see Microsoft is taking the lead here. The operating system should support DoH. Any browser not respecting the operating system's DNS configuration should rollback their plans to hijack DNS requests (particularly Firefox) and entrust the network stack to the OS, as is intended.

cm2187 7y ago

And of course, for your privacy, Microsoft will send a copy of all your DNS requests to its telemetry servers unless you opt out with a registry key!

foxrob92 7y ago
A registry key that is reset to the default every major update, no less.

m0xte 7y ago

Let us disable telemetry first.

JohnFen 7y ago

DoH provides a way for programs to do DNS lookups while evading any attempts at blocking certain DNS lookups. This is a dream situation for advertisers and enforced telemetry. This is also why the existence of DoH has made it necessary for me to install a MITM HTTPS proxy in my network, so that I can regain control. DoH brings some privacy benefits, but it also brings privacy costs. It is not an unambiguous win -- it is a tradeoff.

dastx 7y ago
If you run a local DNS server (e.g. AdGuard Home or Pi-Hole) you can set them up as a DoH system and still block requests. My bigger issue with this is that Microsoft is trying to paint themselves as an angel when in reality, as part of Windows 10, they've added so much telemetry, it feels as if they're closer to an ad giant than a software giant.
- tybit 7y ago
  Genuine question, at that point does DoH buy you anything?
  - kodablah 7y ago
    There are security benefits of TLS. Now, if you're asking what benefits it has over DNS-over-TLS, making DNS requests indistinguishable from other HTTP requests has privacy/shaping benefits.
  - tptacek 7y ago
    If you're in the US, your ISP is right now actively recording and monetizing your DNS requests by passive collection. DoH immediately exempts you from this surveillance.
    - dastx 7y ago
      > exempts Specifically, ISPs are unable to read the requests or responses of your DNS requests due to end to end encryption between the client and the DNS server.

mc3 7y ago

Why are Microsoft doing this? One explanation is morality - they are doing it for the greater good. Another explaination is branding - they want to look like the new "no evil company" which ties in with their open source initiatives. It could also be a way to prevent Google having too much power which is a good thing for Microsoft. It also might be to sell more Windows licences, but I doubt this would factor into the decision about what OS to use. Or it is just that technical people got to make the decision unhampered by management, and technical people value privacy.

godelski 7y ago
There's the age old question, "if someone does something good for the wrong reasons, are those things still good?" I for one welcome the new competitive facade of privacy and security. Minor improvements are at least improvements.
zamadatix 7y ago
It could also be that it was looking like a nightmare world where every app had its own independent DNS configuration and they didn't want to have to deal with that.

deleted 7y ago

[deleted]

auslander 7y ago

Is it possible in DoH to store and serve HTTP cookies?

iramiller 7y ago

I suppose with DNS level blocking of ads now impossible that means I will need to crawl my DNS blocklist and resolve those domains, then block those IP addresses at the network gateway... Even if clients punch out through a secret DoH ip those resolved advertiser domains will still be null routed. Not as easy but just as effective.