3 ms·

You're exactly right, insofar as that DoH removes the "speedbumps". Once DoH (and certificate pinning to go along with it, to prevent you MiTM'ing the requests

You're exactly right, insofar as that DoH removes the "speedbumps". Once DoH (and certificate pinning to go along with it, to prevent you MiTM'ing the requests) is pervasive you won't get to control DNS on devices where you can't execute arbitrary code. That ship has sailed. It fills me with a deep sadness and frustration, but that's the way it will be. (I went back and forth with tptacek on this in an earlier discussion. I didn't really have an argument, per se, but he demolished it anyway.) Get ready for browsers (that run inside your browser) implemented in WASM complete with their own DoH implementation, too. It's a publisher's dream come true...

tptacek 7y ago
I seriously don't understand this argument. It really reads to me that you're saying "because of DoH, entities that can run arbitrary code on my machine where that code can talk to the network can now look up hostnames whether I want them to or not". But entities that can run arbitrary network-connected code on your machine have always been able to do that, and if you have that problem, you have bigger problems than name lookups.
- EvanAnderson 7y ago
  I don't have an argument. You're absolutely right in everything you're saying. I'm explicitly not making an argument about code running on general purpose computers that I (ostensibly) own and control. The WASM/browser comment I made was a flippant jab (though I absolutely think it will happen) and absolutely a separate issue. I'm one of those people who think the web should have stayed more like Gopher and less like Java. I'm a nut-job who browses w/ Javascript disabled by default. I think it's ridiculous that I need to run a VM for third-parties to jam arbitrary code into so I can read articles. Yes-- third-parties could always run arbitrary code on my computer. In the past they had to convince me to install their software. Now visiting their website is, effectively, installing software. I'd be interested to hear how you square the circle of controlling your own computing experience in the face of near-requirement of allowing websites to execute arbitrary code on your computers. re: DoH People are clearly used to using DNS-based filtering tools to control network traffic (the "Pi Hole", Cisco's Umbrella product, creating empty zones in self-hosted recursive resolvers to prevent unwanted domains from resolving, etc). I don't think the people who use these tools understand that DoH creates an easy standards-based way for that control to be removed. I wholeheartedly agree that DNS filtering wasn't absolute control, but it was a degree of control. Yes-- bad actors could always have made up their own name resolution protocols, their own encrypted command-and-control channels, etc. Most of them just used DNS. Having control of DNS to do filtering was something, clearly. The last exchange I had w/ you set my mind straight. The control that DNS filtering provided was a comfortable illusion. It existed because Internet protocols were designed with too much trust to begin with, and because it was easier and more cost effective for developers to use standards-based protocols (at the expense of their traffic being vulnerable to tampering). The world, as it is now, won't work w/ unscrupulous entities exploiting the trust engineered into early protocols. I don't want my ISP "monetizing" my DNS traffic, injecting content into my HTTP sessions, etc. Removing the ability of unscrupulous network operators to use my traffic against me means removing my own ability to influence that traffic to my own benefit.
JohnFen 7y ago
> Once DoH (and certificate pinning to go along with it, to prevent you MiTM'ing the requests) is pervasive you won't get to control DNS on devices where you can't execute arbitrary code. That ship has sailed. This isn't entirely the case. I have regained this control on my own machines by implementing a proxy that MITMs all HTTPS connections that happen over my network. Certificate pinning won't allow this to be evaded -- all it will do is prevent the HTTPS connection from being established. All devices that I use, including remote ones, only connect to the internet through a VPN that I run in my network, so they are all MITMd as well. That's not a solution that everyone can pull off, and it's not a solution that I'm happy with (because I'm introducing a weakness in the security chain), but it's the best one I could think of.

tptacek 7y ago

I seriously don't understand this argument. It really reads to me that you're saying "because of DoH, entities that can run arbitrary code on my machine where that code can talk to the network can now look up hostnames whether I want them to or not". But entities that can run arbitrary network-connected code on your machine have always been able to do that, and if you have that problem, you have bigger problems than name lookups.

EvanAnderson 7y ago
I don't have an argument. You're absolutely right in everything you're saying. I'm explicitly not making an argument about code running on general purpose computers that I (ostensibly) own and control. The WASM/browser comment I made was a flippant jab (though I absolutely think it will happen) and absolutely a separate issue. I'm one of those people who think the web should have stayed more like Gopher and less like Java. I'm a nut-job who browses w/ Javascript disabled by default. I think it's ridiculous that I need to run a VM for third-parties to jam arbitrary code into so I can read articles. Yes-- third-parties could always run arbitrary code on my computer. In the past they had to convince me to install their software. Now visiting their website is, effectively, installing software. I'd be interested to hear how you square the circle of controlling your own computing experience in the face of near-requirement of allowing websites to execute arbitrary code on your computers. re: DoH People are clearly used to using DNS-based filtering tools to control network traffic (the "Pi Hole", Cisco's Umbrella product, creating empty zones in self-hosted recursive resolvers to prevent unwanted domains from resolving, etc). I don't think the people who use these tools understand that DoH creates an easy standards-based way for that control to be removed. I wholeheartedly agree that DNS filtering wasn't absolute control, but it was a degree of control. Yes-- bad actors could always have made up their own name resolution protocols, their own encrypted command-and-control channels, etc. Most of them just used DNS. Having control of DNS to do filtering was something, clearly. The last exchange I had w/ you set my mind straight. The control that DNS filtering provided was a comfortable illusion. It existed because Internet protocols were designed with too much trust to begin with, and because it was easier and more cost effective for developers to use standards-based protocols (at the expense of their traffic being vulnerable to tampering). The world, as it is now, won't work w/ unscrupulous entities exploiting the trust engineered into early protocols. I don't want my ISP "monetizing" my DNS traffic, injecting content into my HTTP sessions, etc. Removing the ability of unscrupulous network operators to use my traffic against me means removing my own ability to influence that traffic to my own benefit.

JohnFen 7y ago

> Once DoH (and certificate pinning to go along with it, to prevent you MiTM'ing the requests) is pervasive you won't get to control DNS on devices where you can't execute arbitrary code. That ship has sailed. This isn't entirely the case. I have regained this control on my own machines by implementing a proxy that MITMs all HTTPS connections that happen over my network. Certificate pinning won't allow this to be evaded -- all it will do is prevent the HTTPS connection from being established. All devices that I use, including remote ones, only connect to the internet through a VPN that I run in my network, so they are all MITMd as well. That's not a solution that everyone can pull off, and it's not a solution that I'm happy with (because I'm introducing a weakness in the security chain), but it's the best one I could think of.