6 ms·

Currently DNS filters and hosts files are a good way to block trackers and telemetry. By securing this using HTTPS, we are not far from closing another loophole

by atesti 7y ago

Currently DNS filters and hosts files are a good way to block trackers and telemetry. By securing this using HTTPS, we are not far from closing another loophole for user freedom: What if Chrome does not allow self signed PKI roots anymore? On Android one already gets a scary message each day when installing a root certificate

chopin 7y ago
I doubt that as it would exclude Chrome from many corporate environments.
shawnz 7y ago
We support strong widely available encryption even though it enables terrorism, weapons dealing, human trafficking, etc. But when it enables the delivery of hard-to-block ads, that's too far? In my opinion it was wrong to go down the path of using DNS for content blocking in the first place. Even without widely available DoH, bypassing dns-based content blocking is trivial.
- JohnFen 7y ago
  >But when it enables the delivery of hard-to-block ads, that's too far? If I'm aware of terrorism, weapons dealing, human trafficking, etc., traffic on my network, I'd certainly block that. That's a different issue from crypto. Also, I'm not so interested in blocking advertising anyway. I'm interested in blocking unauthorized data leakage (tracking, telemetry, etc.) > In my opinion it was wrong to go down the path of using DNS for content blocking in the first place. It has never been an awesome approach, true, but it's often the only approach available. > Even without widely available DoH, bypassing dns-based content blocking is trivial. Possible, yes. Trivial, no.
- userbinator 7y ago
  Possibly contrarian opinion: I only support "strongly widely available encryption" that gives the user freedom. I don't support using encryption to create authoritarian "walled garden" prisons or as a "security" excuse to take away freedoms of the user (this includes, among other things, DRM.)
agwa 7y ago
You'll still be able to run your own resolver that applies DNS filters and configure your client to use it, just like today. The difference will be that connections between the client and the resolver will be secured with HTTPS, so your DNS can only be tampered with and surveilled if you give consent. That seems like a win for user freedom to me.
- throwaway2048 7y ago
  This is only true if devices and programs don't use pre-baked in DoH servers, like chromecast currently is.
  - agwa 7y ago
    The Chromecast has always been a locked-down device. I suppose it's frustrating if unsecured DNS was the one way that you could exert some control over a device that isn't truly yours, but that's just not a battle than can be won. Your beef should be with the Chromecast, not DoH.
  - belltaco 7y ago
    Chromecast could also switch to using a new custom encrypted protocol that no one else understands or can decrypt to communicate with Google servers and funnel IP lookups through it, regardless of DNS or DoH. You cannot fight and circumvent such malware already present in software and hardware that you bought or installed.
    - TeMPOraL 7y ago
      Trivial inconveniences matter. The easier it is to act malicious, the more software will.
- JohnFen 7y ago
  > You'll still be able to run your own resolver that applies DNS filters and configure your client to use it, just like today. Not really, because you have no way to enforce the use of your own resolver or filters without using a proxy to MITM your HTTPS connections.
wvenable 7y ago
The other scary consequence of these changes that you have even less control over your network than before. You can bring devices into your home and have absolutely no control or knowledge of what they are connecting to or what they are doing. It's also a problem for obsolesce of cloud connected devices; I'm not able to, even if technically possible, to replace the cloud services some of my devices connect to because of certificate validation and encryption.
- tptacek 7y ago
  This problem has nothing to do with DoH; it only seems that way because DoH makes it clear that you lack this control and that systems that tried to exert this control using DNS were hacks to begin with.
  - wvenable 7y ago
    Before DoH, you could control and filter DNS queries at your gateway to the Internet. Now you won't be able to do that. The reason we even want DoH is because we don't want others to control and filter our DNS queries at their gateway when we are on their network.
    - tptacek 7y ago
      I get that; I think everyone gets that. Before, with cooperative hostile programs, you could block their access to the Internet by managing DNS. Now you can't. But cooperative hostile programs are a very strange threat model! Hostile code that can talk to the network --- which has to be your threat model regardless! --- doesn't have to use RFC1035-style DNS to look up names at all. For this concern to make sense, you have to imagine threat actors determined enough to do bad things if they can look up hostnames with your standard DNS, but not determined enough to use some alternative lookup or C&C mechanism if standard DNS isn't available. Who are those threat actors? If they're browser-resident --- which they have to be if Firefox defaulting to DoH is your big concern! --- why can't they just do their own DoH regardless of what Firefox decides to do?
jbott 7y ago
This is software running on a users' computer. They will always have the opportunity to modify their configuration (or patch the running software if needed). The argument that DoH is a step backwards doesn't make sense, since it's always been possible for software that wants to circumvent hosts file / DNS filters to use an alternate name resolver. I agree that we should push for more configuration options, but the fact remains that it's the users decision to run software that doesn't respect their freedom of choice, and ultimately they control the code that runs on their machine. DoH is overall a huge benefit to preventing in-flight tampering and protecting user privacy. The net-benefits far outweigh the downside that "good" network providers can no longer tamper with DNS results.
- JohnFen 7y ago
  > it's always been possible for software that wants to circumvent hosts file / DNS filters to use an alternate name resolver. And it's always been possible to block access to all DNS resolvers except your local one. Until now. > the fact remains that it's the users decision to run software that doesn't respect their freedom of choice Unless that code is malware or some Javascript an advertiser has placed on a website. There is no way to stop software from doing its own DoH requests without using browser or OS services to do it, so the controls supplied by the browser or OS are of rather limited value. > The net-benefits far outweigh the downside that "good" network providers can no longer tamper with DNS results. I disagree. I'm of the opinion that DoH brought with it a security problem that is difficult to resolve. It does provide additional security in another area, but that's not something that couldn't have been done using a more reasonable approach that didn't hamper my ability to control what's happening on my own machines.
  - growse 7y ago
    > Unless that code is malware or some Javascript an advertiser has placed on a website. There is no way to stop software from doing its own DoH requests without using browser or OS services to do it, so the controls supplied by the browser or OS are of rather limited value. This is true irrespective of DoH. If software wants to ignore the OS settings and resolve names down via its own custom protocol, that's what it's going to do. Short of auditing that software and it's connections, you can't really stop it. The OS settings are not a control, they're a convenience.
deleted 7y ago
[deleted]

by atesti 7y ago

chopin 7y ago

I doubt that as it would exclude Chrome from many corporate environments.

shawnz 7y ago

We support strong widely available encryption even though it enables terrorism, weapons dealing, human trafficking, etc. But when it enables the delivery of hard-to-block ads, that's too far? In my opinion it was wrong to go down the path of using DNS for content blocking in the first place. Even without widely available DoH, bypassing dns-based content blocking is trivial.

JohnFen 7y ago
>But when it enables the delivery of hard-to-block ads, that's too far? If I'm aware of terrorism, weapons dealing, human trafficking, etc., traffic on my network, I'd certainly block that. That's a different issue from crypto. Also, I'm not so interested in blocking advertising anyway. I'm interested in blocking unauthorized data leakage (tracking, telemetry, etc.) > In my opinion it was wrong to go down the path of using DNS for content blocking in the first place. It has never been an awesome approach, true, but it's often the only approach available. > Even without widely available DoH, bypassing dns-based content blocking is trivial. Possible, yes. Trivial, no.
userbinator 7y ago
Possibly contrarian opinion: I only support "strongly widely available encryption" that gives the user freedom. I don't support using encryption to create authoritarian "walled garden" prisons or as a "security" excuse to take away freedoms of the user (this includes, among other things, DRM.)

agwa 7y ago

You'll still be able to run your own resolver that applies DNS filters and configure your client to use it, just like today. The difference will be that connections between the client and the resolver will be secured with HTTPS, so your DNS can only be tampered with and surveilled if you give consent. That seems like a win for user freedom to me.

throwaway2048 7y ago
This is only true if devices and programs don't use pre-baked in DoH servers, like chromecast currently is.
- agwa 7y ago
  The Chromecast has always been a locked-down device. I suppose it's frustrating if unsecured DNS was the one way that you could exert some control over a device that isn't truly yours, but that's just not a battle than can be won. Your beef should be with the Chromecast, not DoH.
- belltaco 7y ago
  Chromecast could also switch to using a new custom encrypted protocol that no one else understands or can decrypt to communicate with Google servers and funnel IP lookups through it, regardless of DNS or DoH. You cannot fight and circumvent such malware already present in software and hardware that you bought or installed.
  - TeMPOraL 7y ago
    Trivial inconveniences matter. The easier it is to act malicious, the more software will.
JohnFen 7y ago
> You'll still be able to run your own resolver that applies DNS filters and configure your client to use it, just like today. Not really, because you have no way to enforce the use of your own resolver or filters without using a proxy to MITM your HTTPS connections.

wvenable 7y ago

The other scary consequence of these changes that you have even less control over your network than before. You can bring devices into your home and have absolutely no control or knowledge of what they are connecting to or what they are doing. It's also a problem for obsolesce of cloud connected devices; I'm not able to, even if technically possible, to replace the cloud services some of my devices connect to because of certificate validation and encryption.

tptacek 7y ago
This problem has nothing to do with DoH; it only seems that way because DoH makes it clear that you lack this control and that systems that tried to exert this control using DNS were hacks to begin with.
- wvenable 7y ago
  Before DoH, you could control and filter DNS queries at your gateway to the Internet. Now you won't be able to do that. The reason we even want DoH is because we don't want others to control and filter our DNS queries at their gateway when we are on their network.
  - tptacek 7y ago
    I get that; I think everyone gets that. Before, with cooperative hostile programs, you could block their access to the Internet by managing DNS. Now you can't. But cooperative hostile programs are a very strange threat model! Hostile code that can talk to the network --- which has to be your threat model regardless! --- doesn't have to use RFC1035-style DNS to look up names at all. For this concern to make sense, you have to imagine threat actors determined enough to do bad things if they can look up hostnames with your standard DNS, but not determined enough to use some alternative lookup or C&C mechanism if standard DNS isn't available. Who are those threat actors? If they're browser-resident --- which they have to be if Firefox defaulting to DoH is your big concern! --- why can't they just do their own DoH regardless of what Firefox decides to do?

jbott 7y ago

This is software running on a users' computer. They will always have the opportunity to modify their configuration (or patch the running software if needed). The argument that DoH is a step backwards doesn't make sense, since it's always been possible for software that wants to circumvent hosts file / DNS filters to use an alternate name resolver. I agree that we should push for more configuration options, but the fact remains that it's the users decision to run software that doesn't respect their freedom of choice, and ultimately they control the code that runs on their machine. DoH is overall a huge benefit to preventing in-flight tampering and protecting user privacy. The net-benefits far outweigh the downside that "good" network providers can no longer tamper with DNS results.

JohnFen 7y ago
> it's always been possible for software that wants to circumvent hosts file / DNS filters to use an alternate name resolver. And it's always been possible to block access to all DNS resolvers except your local one. Until now. > the fact remains that it's the users decision to run software that doesn't respect their freedom of choice Unless that code is malware or some Javascript an advertiser has placed on a website. There is no way to stop software from doing its own DoH requests without using browser or OS services to do it, so the controls supplied by the browser or OS are of rather limited value. > The net-benefits far outweigh the downside that "good" network providers can no longer tamper with DNS results. I disagree. I'm of the opinion that DoH brought with it a security problem that is difficult to resolve. It does provide additional security in another area, but that's not something that couldn't have been done using a more reasonable approach that didn't hamper my ability to control what's happening on my own machines.
- growse 7y ago
  > Unless that code is malware or some Javascript an advertiser has placed on a website. There is no way to stop software from doing its own DoH requests without using browser or OS services to do it, so the controls supplied by the browser or OS are of rather limited value. This is true irrespective of DoH. If software wants to ignore the OS settings and resolve names down via its own custom protocol, that's what it's going to do. Short of auditing that software and it's connections, you can't really stop it. The OS settings are not a control, they're a convenience.

deleted 7y ago

[deleted]