4 ms·

The other scary consequence of these changes that you have even less control over your network than before. You can bring devices into your home and have absol

The other scary consequence of these changes that you have even less control over your network than before. You can bring devices into your home and have absolutely no control or knowledge of what they are connecting to or what they are doing. It's also a problem for obsolesce of cloud connected devices; I'm not able to, even if technically possible, to replace the cloud services some of my devices connect to because of certificate validation and encryption.

tptacek 7y ago
This problem has nothing to do with DoH; it only seems that way because DoH makes it clear that you lack this control and that systems that tried to exert this control using DNS were hacks to begin with.
- wvenable 7y ago
  Before DoH, you could control and filter DNS queries at your gateway to the Internet. Now you won't be able to do that. The reason we even want DoH is because we don't want others to control and filter our DNS queries at their gateway when we are on their network.
  - tptacek 7y ago
    I get that; I think everyone gets that. Before, with cooperative hostile programs, you could block their access to the Internet by managing DNS. Now you can't. But cooperative hostile programs are a very strange threat model! Hostile code that can talk to the network --- which has to be your threat model regardless! --- doesn't have to use RFC1035-style DNS to look up names at all. For this concern to make sense, you have to imagine threat actors determined enough to do bad things if they can look up hostnames with your standard DNS, but not determined enough to use some alternative lookup or C&C mechanism if standard DNS isn't available. Who are those threat actors? If they're browser-resident --- which they have to be if Firefox defaulting to DoH is your big concern! --- why can't they just do their own DoH regardless of what Firefox decides to do?
    - TeMPOraL 7y ago
      > Who are those threat actors? Any app that includes an advertising or telemetry SDK? App developers will appreciate the ease of just adding a library that from user's point of view is malicious, but neither the app developers nor the SDK vendors will likely want to bother with building and maintaining their own name resolution scheme. If you consider advertising and telemetry to be hostile actions (as many here, myself included, do), the space of threat actors expands to encompass a large amount of "cooperative hostile programs".
      - tptacek 7y ago
        Why? Because your data is valuable enough to harvest so long as they don't have to task a single developer to spend 3 days building a DNS tunneling feature?
        TeMPOraL 7y ago
        Yes? I was under the impression that most Android apps make money by slapping a random ad SDK and watching the money roll in. I haven't heard of SDK vendors running their own name resolution schemes in order to avoid DNS-based content blocking. DoH will give them this feature by default.
        tptacek 7y ago
        Which is it? Is the problem that browsers and operating systems are now doing DoH on your desktop, or that you can install an app on your Android phone that could itself DoH out to an untrusted DoH resolver the same way it could have TLS'd out to a C&C server?
    - wvenable 7y ago
      > But cooperative hostile programs are a very strange threat model! Actually, I think it's the most common threat model these days. Viruses/Trojens? I haven't had one in years. I remember getting rooted on my first Linux box hours after connecting to the Internet -- that doesn't happen anymore either. Instead, all the threats are cooperative hostile programs from my search engine, my television, my apps, etc. > You have to imagine threat actors determined enough to do bad things if they can look up hostnames with your standard DNS, but not determined enough to use some alternative lookup. But most of these bad actors don't believe they're doing anything bad. This is just the normal accepted operation of their software. Operating according to the normal and expected way that Internet applications are supposed to work. If a few "techie geeks" find a way around it so be it. The alternative methods you describe are just another point of failure. -- We're moving towards a model where you have absolutely no knowledge or control of what goes through your network anymore. It used to be I could monitor and even re-write any IP traffic on my network to my hearts content through my Linux router but I can't do that anymore. DoH is just one piece -- perhaps the final piece -- that makes this transformation complete.

tptacek 7y ago

This problem has nothing to do with DoH; it only seems that way because DoH makes it clear that you lack this control and that systems that tried to exert this control using DNS were hacks to begin with.

wvenable 7y ago
Before DoH, you could control and filter DNS queries at your gateway to the Internet. Now you won't be able to do that. The reason we even want DoH is because we don't want others to control and filter our DNS queries at their gateway when we are on their network.
- tptacek 7y ago
  I get that; I think everyone gets that. Before, with cooperative hostile programs, you could block their access to the Internet by managing DNS. Now you can't. But cooperative hostile programs are a very strange threat model! Hostile code that can talk to the network --- which has to be your threat model regardless! --- doesn't have to use RFC1035-style DNS to look up names at all. For this concern to make sense, you have to imagine threat actors determined enough to do bad things if they can look up hostnames with your standard DNS, but not determined enough to use some alternative lookup or C&C mechanism if standard DNS isn't available. Who are those threat actors? If they're browser-resident --- which they have to be if Firefox defaulting to DoH is your big concern! --- why can't they just do their own DoH regardless of what Firefox decides to do?
  - TeMPOraL 7y ago
    > Who are those threat actors? Any app that includes an advertising or telemetry SDK? App developers will appreciate the ease of just adding a library that from user's point of view is malicious, but neither the app developers nor the SDK vendors will likely want to bother with building and maintaining their own name resolution scheme. If you consider advertising and telemetry to be hostile actions (as many here, myself included, do), the space of threat actors expands to encompass a large amount of "cooperative hostile programs".
    - tptacek 7y ago
      Why? Because your data is valuable enough to harvest so long as they don't have to task a single developer to spend 3 days building a DNS tunneling feature?
      - TeMPOraL 7y ago
        Yes? I was under the impression that most Android apps make money by slapping a random ad SDK and watching the money roll in. I haven't heard of SDK vendors running their own name resolution schemes in order to avoid DNS-based content blocking. DoH will give them this feature by default.
        tptacek 7y ago
        Which is it? Is the problem that browsers and operating systems are now doing DoH on your desktop, or that you can install an app on your Android phone that could itself DoH out to an untrusted DoH resolver the same way it could have TLS'd out to a C&C server?
  - wvenable 7y ago
    > But cooperative hostile programs are a very strange threat model! Actually, I think it's the most common threat model these days. Viruses/Trojens? I haven't had one in years. I remember getting rooted on my first Linux box hours after connecting to the Internet -- that doesn't happen anymore either. Instead, all the threats are cooperative hostile programs from my search engine, my television, my apps, etc. > You have to imagine threat actors determined enough to do bad things if they can look up hostnames with your standard DNS, but not determined enough to use some alternative lookup. But most of these bad actors don't believe they're doing anything bad. This is just the normal accepted operation of their software. Operating according to the normal and expected way that Internet applications are supposed to work. If a few "techie geeks" find a way around it so be it. The alternative methods you describe are just another point of failure. -- We're moving towards a model where you have absolutely no knowledge or control of what goes through your network anymore. It used to be I could monitor and even re-write any IP traffic on my network to my hearts content through my Linux router but I can't do that anymore. DoH is just one piece -- perhaps the final piece -- that makes this transformation complete.