3 ms·

Before DoH, you could control and filter DNS queries at your gateway to the Internet. Now you won't be able to do that. The reason we even want DoH is because

Before DoH, you could control and filter DNS queries at your gateway to the Internet. Now you won't be able to do that. The reason we even want DoH is because we don't want others to control and filter our DNS queries at their gateway when we are on their network.

tptacek 7y ago
I get that; I think everyone gets that. Before, with cooperative hostile programs, you could block their access to the Internet by managing DNS. Now you can't. But cooperative hostile programs are a very strange threat model! Hostile code that can talk to the network --- which has to be your threat model regardless! --- doesn't have to use RFC1035-style DNS to look up names at all. For this concern to make sense, you have to imagine threat actors determined enough to do bad things if they can look up hostnames with your standard DNS, but not determined enough to use some alternative lookup or C&C mechanism if standard DNS isn't available. Who are those threat actors? If they're browser-resident --- which they have to be if Firefox defaulting to DoH is your big concern! --- why can't they just do their own DoH regardless of what Firefox decides to do?
- TeMPOraL 7y ago
  > Who are those threat actors? Any app that includes an advertising or telemetry SDK? App developers will appreciate the ease of just adding a library that from user's point of view is malicious, but neither the app developers nor the SDK vendors will likely want to bother with building and maintaining their own name resolution scheme. If you consider advertising and telemetry to be hostile actions (as many here, myself included, do), the space of threat actors expands to encompass a large amount of "cooperative hostile programs".
  - tptacek 7y ago
    Why? Because your data is valuable enough to harvest so long as they don't have to task a single developer to spend 3 days building a DNS tunneling feature?
    - TeMPOraL 7y ago
      Yes? I was under the impression that most Android apps make money by slapping a random ad SDK and watching the money roll in. I haven't heard of SDK vendors running their own name resolution schemes in order to avoid DNS-based content blocking. DoH will give them this feature by default.
      - tptacek 7y ago
        Which is it? Is the problem that browsers and operating systems are now doing DoH on your desktop, or that you can install an app on your Android phone that could itself DoH out to an untrusted DoH resolver the same way it could have TLS'd out to a C&C server?
- wvenable 7y ago
  > But cooperative hostile programs are a very strange threat model! Actually, I think it's the most common threat model these days. Viruses/Trojens? I haven't had one in years. I remember getting rooted on my first Linux box hours after connecting to the Internet -- that doesn't happen anymore either. Instead, all the threats are cooperative hostile programs from my search engine, my television, my apps, etc. > You have to imagine threat actors determined enough to do bad things if they can look up hostnames with your standard DNS, but not determined enough to use some alternative lookup. But most of these bad actors don't believe they're doing anything bad. This is just the normal accepted operation of their software. Operating according to the normal and expected way that Internet applications are supposed to work. If a few "techie geeks" find a way around it so be it. The alternative methods you describe are just another point of failure. -- We're moving towards a model where you have absolutely no knowledge or control of what goes through your network anymore. It used to be I could monitor and even re-write any IP traffic on my network to my hearts content through my Linux router but I can't do that anymore. DoH is just one piece -- perhaps the final piece -- that makes this transformation complete.
  - tptacek 7y ago
    If it runs on your computer, your computer gives you better information about what it is than the network possibly can. If it's a device on your network that you don't control, the problem is that you don't control or trust a device you've plugged into your network. Either way: DoH is a red herring. It's making you aware of a problem you most definitely already had with untrusted devices, while mitigating another problem you had in your browser. Firefox didn't enable DoH in your Chromecast or whatever, and if DoH didn't exist, your Chromecast could (and should) have done something like DoH anyways. Honestly, and I know I lose credibility by being intemperate enough to say this, I think people freaking out about DoH and all the low-rent control of low-rent bad-ware that it breaks need to grow up and either take the problems they're talking about seriously, or recite the Serenity Prayer and let it go.
    - wvenable 7y ago
      > If it runs on your computer, your computer gives you better information about what it is than the network possibly can. Except if that computer is in your TV, or is in an iOS-based device, or in another piece of hardware. > The problem is that you don't control or trust a device you've plugged into your network. Yes. I would like to use the device and filter out any of its harmful effects -- the best of both worlds really. Same reason I run an ad-blocker on my browser. > Either way: DoH is a red herring. I agree. My point was not to single out DoH in this scenario. It's just one more way in which we've lost control of our local network. When it's not our network, it's a benefit. The same reason why use we SSL. > It's making you aware of a problem you most definitely already had with untrusted devices Oh definitely. We used to have at least this as a last line of defense. And now we won't. I think it's good to be aware of that. I'm not saying that we shouldn't use DoH or the benefits don't outweigh the costs -- but it should be noted that there are costs. Honestly, I never considered the personal costs of all these good security practices until a cloud hardware device I own had the company go out of business. Their security was very good -- all SSL, pinned certificates, etc. There's no way to emulate the cloud services it connects to because there's no way it will connect to anything other than it's own services. It's just a black box on my network. I can see what DNS queries it uses but that's not very much help...
- ryan_hallinger 7y ago
  cooperative as in devices that users have elected to use? Additionally, it isn't clear as to why DoH presents a challenge when malware can already communicate to Youtube for example to download its payload. The chances of blocking Youtube are negligible.

tptacek 7y ago

I get that; I think everyone gets that. Before, with cooperative hostile programs, you could block their access to the Internet by managing DNS. Now you can't. But cooperative hostile programs are a very strange threat model! Hostile code that can talk to the network --- which has to be your threat model regardless! --- doesn't have to use RFC1035-style DNS to look up names at all. For this concern to make sense, you have to imagine threat actors determined enough to do bad things if they can look up hostnames with your standard DNS, but not determined enough to use some alternative lookup or C&C mechanism if standard DNS isn't available. Who are those threat actors? If they're browser-resident --- which they have to be if Firefox defaulting to DoH is your big concern! --- why can't they just do their own DoH regardless of what Firefox decides to do?

TeMPOraL 7y ago
> Who are those threat actors? Any app that includes an advertising or telemetry SDK? App developers will appreciate the ease of just adding a library that from user's point of view is malicious, but neither the app developers nor the SDK vendors will likely want to bother with building and maintaining their own name resolution scheme. If you consider advertising and telemetry to be hostile actions (as many here, myself included, do), the space of threat actors expands to encompass a large amount of "cooperative hostile programs".
- tptacek 7y ago
  Why? Because your data is valuable enough to harvest so long as they don't have to task a single developer to spend 3 days building a DNS tunneling feature?
  - TeMPOraL 7y ago
    Yes? I was under the impression that most Android apps make money by slapping a random ad SDK and watching the money roll in. I haven't heard of SDK vendors running their own name resolution schemes in order to avoid DNS-based content blocking. DoH will give them this feature by default.
    - tptacek 7y ago
      Which is it? Is the problem that browsers and operating systems are now doing DoH on your desktop, or that you can install an app on your Android phone that could itself DoH out to an untrusted DoH resolver the same way it could have TLS'd out to a C&C server?
wvenable 7y ago
> But cooperative hostile programs are a very strange threat model! Actually, I think it's the most common threat model these days. Viruses/Trojens? I haven't had one in years. I remember getting rooted on my first Linux box hours after connecting to the Internet -- that doesn't happen anymore either. Instead, all the threats are cooperative hostile programs from my search engine, my television, my apps, etc. > You have to imagine threat actors determined enough to do bad things if they can look up hostnames with your standard DNS, but not determined enough to use some alternative lookup. But most of these bad actors don't believe they're doing anything bad. This is just the normal accepted operation of their software. Operating according to the normal and expected way that Internet applications are supposed to work. If a few "techie geeks" find a way around it so be it. The alternative methods you describe are just another point of failure. -- We're moving towards a model where you have absolutely no knowledge or control of what goes through your network anymore. It used to be I could monitor and even re-write any IP traffic on my network to my hearts content through my Linux router but I can't do that anymore. DoH is just one piece -- perhaps the final piece -- that makes this transformation complete.
- tptacek 7y ago
  If it runs on your computer, your computer gives you better information about what it is than the network possibly can. If it's a device on your network that you don't control, the problem is that you don't control or trust a device you've plugged into your network. Either way: DoH is a red herring. It's making you aware of a problem you most definitely already had with untrusted devices, while mitigating another problem you had in your browser. Firefox didn't enable DoH in your Chromecast or whatever, and if DoH didn't exist, your Chromecast could (and should) have done something like DoH anyways. Honestly, and I know I lose credibility by being intemperate enough to say this, I think people freaking out about DoH and all the low-rent control of low-rent bad-ware that it breaks need to grow up and either take the problems they're talking about seriously, or recite the Serenity Prayer and let it go.
  - wvenable 7y ago
    > If it runs on your computer, your computer gives you better information about what it is than the network possibly can. Except if that computer is in your TV, or is in an iOS-based device, or in another piece of hardware. > The problem is that you don't control or trust a device you've plugged into your network. Yes. I would like to use the device and filter out any of its harmful effects -- the best of both worlds really. Same reason I run an ad-blocker on my browser. > Either way: DoH is a red herring. I agree. My point was not to single out DoH in this scenario. It's just one more way in which we've lost control of our local network. When it's not our network, it's a benefit. The same reason why use we SSL. > It's making you aware of a problem you most definitely already had with untrusted devices Oh definitely. We used to have at least this as a last line of defense. And now we won't. I think it's good to be aware of that. I'm not saying that we shouldn't use DoH or the benefits don't outweigh the costs -- but it should be noted that there are costs. Honestly, I never considered the personal costs of all these good security practices until a cloud hardware device I own had the company go out of business. Their security was very good -- all SSL, pinned certificates, etc. There's no way to emulate the cloud services it connects to because there's no way it will connect to anything other than it's own services. It's just a black box on my network. I can see what DNS queries it uses but that's not very much help...
ryan_hallinger 7y ago
cooperative as in devices that users have elected to use? Additionally, it isn't clear as to why DoH presents a challenge when malware can already communicate to Youtube for example to download its payload. The chances of blocking Youtube are negligible.