3 ms·

> But cooperative hostile programs are a very strange threat model! Actually, I think it's the most common threat model these days. Viruses/Trojens? I haven'

> But cooperative hostile programs are a very strange threat model! Actually, I think it's the most common threat model these days. Viruses/Trojens? I haven't had one in years. I remember getting rooted on my first Linux box hours after connecting to the Internet -- that doesn't happen anymore either. Instead, all the threats are cooperative hostile programs from my search engine, my television, my apps, etc. > You have to imagine threat actors determined enough to do bad things if they can look up hostnames with your standard DNS, but not determined enough to use some alternative lookup. But most of these bad actors don't believe they're doing anything bad. This is just the normal accepted operation of their software. Operating according to the normal and expected way that Internet applications are supposed to work. If a few "techie geeks" find a way around it so be it. The alternative methods you describe are just another point of failure. -- We're moving towards a model where you have absolutely no knowledge or control of what goes through your network anymore. It used to be I could monitor and even re-write any IP traffic on my network to my hearts content through my Linux router but I can't do that anymore. DoH is just one piece -- perhaps the final piece -- that makes this transformation complete.

tptacek 7y ago
If it runs on your computer, your computer gives you better information about what it is than the network possibly can. If it's a device on your network that you don't control, the problem is that you don't control or trust a device you've plugged into your network. Either way: DoH is a red herring. It's making you aware of a problem you most definitely already had with untrusted devices, while mitigating another problem you had in your browser. Firefox didn't enable DoH in your Chromecast or whatever, and if DoH didn't exist, your Chromecast could (and should) have done something like DoH anyways. Honestly, and I know I lose credibility by being intemperate enough to say this, I think people freaking out about DoH and all the low-rent control of low-rent bad-ware that it breaks need to grow up and either take the problems they're talking about seriously, or recite the Serenity Prayer and let it go.
- wvenable 7y ago
  > If it runs on your computer, your computer gives you better information about what it is than the network possibly can. Except if that computer is in your TV, or is in an iOS-based device, or in another piece of hardware. > The problem is that you don't control or trust a device you've plugged into your network. Yes. I would like to use the device and filter out any of its harmful effects -- the best of both worlds really. Same reason I run an ad-blocker on my browser. > Either way: DoH is a red herring. I agree. My point was not to single out DoH in this scenario. It's just one more way in which we've lost control of our local network. When it's not our network, it's a benefit. The same reason why use we SSL. > It's making you aware of a problem you most definitely already had with untrusted devices Oh definitely. We used to have at least this as a last line of defense. And now we won't. I think it's good to be aware of that. I'm not saying that we shouldn't use DoH or the benefits don't outweigh the costs -- but it should be noted that there are costs. Honestly, I never considered the personal costs of all these good security practices until a cloud hardware device I own had the company go out of business. Their security was very good -- all SSL, pinned certificates, etc. There's no way to emulate the cloud services it connects to because there's no way it will connect to anything other than it's own services. It's just a black box on my network. I can see what DNS queries it uses but that's not very much help...
  - ryukafalz 7y ago
    >Except if that computer is in your TV, or is in an iOS-based device, or in another piece of hardware. This is a problem, yes. We should fix that problem. >It's just one more way in which we've lost control of our local network. When it's not our network, it's a benefit. The same reason why use we SSL. I think part of the reason why I'm in favor of things like DoH and SSL everywhere is there are very few cases nowadays where services are running entirely on a local network. The vast majority of things that people do on networks now touch the internet. >I would like to use the device and filter out any of its harmful effects ... We used to have at least this as a last line of defense. And now we won't. Except that "last line of defense" was always an illusion; as tptacek mentioned, malicious devices have always been able to perform encrypted DNS lookups if their developers really wanted to. DNS filtering was never a reliable defense. You still do have IP blocking as a last line of defense, and that _is_ reliable considering nothing's going to get routed through the internet without being in an IP packet. >I never considered the personal costs of all these good security practices until a cloud hardware device I own had the company go out of business. My recommendation: if it depends on someone running something out on the internet to function, avoid it like the plague. The service _will_ shut down, it's just a matter of time, and IMO it's a waste to buy something that could turn into an expensive paperweight at any time.

tptacek 7y ago

If it runs on your computer, your computer gives you better information about what it is than the network possibly can. If it's a device on your network that you don't control, the problem is that you don't control or trust a device you've plugged into your network. Either way: DoH is a red herring. It's making you aware of a problem you most definitely already had with untrusted devices, while mitigating another problem you had in your browser. Firefox didn't enable DoH in your Chromecast or whatever, and if DoH didn't exist, your Chromecast could (and should) have done something like DoH anyways. Honestly, and I know I lose credibility by being intemperate enough to say this, I think people freaking out about DoH and all the low-rent control of low-rent bad-ware that it breaks need to grow up and either take the problems they're talking about seriously, or recite the Serenity Prayer and let it go.

wvenable 7y ago
> If it runs on your computer, your computer gives you better information about what it is than the network possibly can. Except if that computer is in your TV, or is in an iOS-based device, or in another piece of hardware. > The problem is that you don't control or trust a device you've plugged into your network. Yes. I would like to use the device and filter out any of its harmful effects -- the best of both worlds really. Same reason I run an ad-blocker on my browser. > Either way: DoH is a red herring. I agree. My point was not to single out DoH in this scenario. It's just one more way in which we've lost control of our local network. When it's not our network, it's a benefit. The same reason why use we SSL. > It's making you aware of a problem you most definitely already had with untrusted devices Oh definitely. We used to have at least this as a last line of defense. And now we won't. I think it's good to be aware of that. I'm not saying that we shouldn't use DoH or the benefits don't outweigh the costs -- but it should be noted that there are costs. Honestly, I never considered the personal costs of all these good security practices until a cloud hardware device I own had the company go out of business. Their security was very good -- all SSL, pinned certificates, etc. There's no way to emulate the cloud services it connects to because there's no way it will connect to anything other than it's own services. It's just a black box on my network. I can see what DNS queries it uses but that's not very much help...
- ryukafalz 7y ago
  >Except if that computer is in your TV, or is in an iOS-based device, or in another piece of hardware. This is a problem, yes. We should fix that problem. >It's just one more way in which we've lost control of our local network. When it's not our network, it's a benefit. The same reason why use we SSL. I think part of the reason why I'm in favor of things like DoH and SSL everywhere is there are very few cases nowadays where services are running entirely on a local network. The vast majority of things that people do on networks now touch the internet. >I would like to use the device and filter out any of its harmful effects ... We used to have at least this as a last line of defense. And now we won't. Except that "last line of defense" was always an illusion; as tptacek mentioned, malicious devices have always been able to perform encrypted DNS lookups if their developers really wanted to. DNS filtering was never a reliable defense. You still do have IP blocking as a last line of defense, and that _is_ reliable considering nothing's going to get routed through the internet without being in an IP packet. >I never considered the personal costs of all these good security practices until a cloud hardware device I own had the company go out of business. My recommendation: if it depends on someone running something out on the internet to function, avoid it like the plague. The service _will_ shut down, it's just a matter of time, and IMO it's a waste to buy something that could turn into an expensive paperweight at any time.