4 ms·

> The whole point of DoH is that you don't run the DoH recursive cache on the network you don't trust. Nope. There is no point to DoH and you can't actually r

> The whole point of DoH is that you don't run the DoH recursive cache on the network you don't trust. Nope. There is no point to DoH and you can't actually run "DoH recursive cache" within trusted network, because it communicates with authoritative servers over public internet.

tptacek 7y ago
You still don't get it. The threat model of DoH is your local ISP. The mitigation is to move DNS off your untrusted local ISP to a network you trust more. To the extent it's not cached, if you have a shared DoH resolver, yes, the DNS queries you're generating are eventually sent in plaintext. But they're sent in plaintext over a network you trust more than your ISP's. DoH is essentially a DNS-only VPN. It has exactly the security model of a VPN with respect to the DNS protocol. The attack DoH breaks immediately is your US mainstream ISP recording all your DNS queries, which is something that is happening today. I really don't understand how people rationalize around this. It's not an exotic attack, like the cache-corruption attacks DNSSEC attempts to defend against; it's something that's happening constantly, all day, every day.
- zzzcpan 7y ago
  > The threat model of DoH is your local ISP. There is no threat model for DoH, only ad hoc attempts to justify it. Here's the thing, your ISP sees all of your packets with all the IP addresses and ports and payload size and the exact time they were sent and received. This identifies every website you visited with very high accuracy, I mean just IP addresses alone identify more than 90% of the websites you visited. > DoH is essentially a DNS-only VPN. It has exactly the security model of a VPN with respect to the DNS protocol. That "security model" is just integrity in communications with resolver, but it actually sacrifices privacy for that. > The attack DoH breaks immediately is your US mainstream ISP recording all your DNS queries This is absolutely useless "attack" to break. Most ISPs in the world record netflow-like data and store it for a long time, which provides more detailed profile on you, than DNS queries. If they store DNS queries, those are just for commercialization, not for snooping.
  - tptacek 7y ago
    If you don't believe that DNS query data has any value, then you shouldn't have any opinion about where you send it. Your argument doesn't make any sense. I'm not sure what you think NetFlow records contain.
    - zzzcpan 7y ago
      Luckily, I do believe that DNS query data has value, that's the reason I'm arguing against anti-privacy crap like DoH and have been since the beginning. If my arguments don't make sense to you, it's either because you lack understanding or have an agenda to push DoH. > I'm not sure what you think NetFlow records contain. I don't need to think what they contain, I implemented a netflow collector or two in the past.
      - tptacek 7y ago
        Same! I was the product lead on Arbor Networks DOS product. How exactly is it that you think that a heavily sampled collection of IP addresses is equivalent to the exact names you type into a URL bar? The rest of your argument is just motte-and-bailey message board stuff. You started out saying that running your own local recurser is privacy-enhancing (it's the opposite) and that ISPs can see your DNS queries when you run DoH (they can't) and retreated to a position of "other things leak". That's true, other things do leak! We'll fix them too; we'll have ESNI soon enough, for instance. Make a coherent argument, please.
        zzzcpan 7y ago
        Whether netflow is heavily sampled or not depends on where and how it is generated and for what purposes. It's just a format. > You started out saying that running your own local recurser is privacy-enhancing (it's the opposite) and that ISPs can see your DNS queries when you run DoH (they can't) and retreated to a position of "other things leak". Never said any of that, but your remarks are still wrong. What I said is basically that at ISP level there is much more information about what you are doing than DNS queries, including information that allows to identify the websites you are visited. Again, just IP addresses alone identify more than 90% of websites (can't remember the exact number from the research, it's like 95% from alexa top 1 million). Now with regards to privacy. First it's important to understand what privacy is actually about. Within your traffic there is a lot of meta and side channel-like information, some of the sources of that information overlap a lot or are even identical, a lot of redundant information. Like we can look at a packet with a DNS query and see domain name identifying a website. Or we can look at IP address of a packet initiating new connection, it won't identify every website uniquely, but it will most of them, to get to 95% we would need to also look at IP addresses of new connections following that connection, i.e. sub resources, making sort of an IP set fingerprint, either way single IP addresses or a fingerprint can be mapped to unique domains or a set of potential domains. To complete this example there is also SNI in plain text in packets and domain names in Host: headers, which also uniquely identify websites. So there is at least 3 sources of the same or almost the same information. What kind of privacy level is that? Well, we have a single party with access to the same relatively easily extractable information from multiple redundant sources, it's a lot to trust with. Would it change anything if remove any of the sources? Not really, it would have very insignificant effect on privacy since other sources are still available. And if we have to send that information to another party, now that would make things much worse, because now we would have to trust two parties with the same information, rather than one. Ok, so, how can we actually improve it? We can try to remove all three sources of information and send all of them through another party. This changes the party we have to trust, but we still have to trust it with just as much. What if we can't trust any party that much? Then the next choice is to shard (partition) that information to as many parties as we can. Trusting even just with half of that information to one party and half to another is already much better and is where we finally start scratching the surface of privacy. I hope it's clear that DoH is not helping with privacy, it just steals one of the sources of this information. As for running local recursive DNS server instead of the one provided by an ISP, it isn't leaking significantly more information to anyone. Packets likely go through the same route and there is a bit more of them for queries that didn't hit the cache for few popular domains. IP address is also exposed in such DNS packets, but ISP's DNS server would be coming from an IP address that belongs to the same AS and this leaks almost the same amount of identifying information.

tptacek 7y ago

You still don't get it. The threat model of DoH is your local ISP. The mitigation is to move DNS off your untrusted local ISP to a network you trust more. To the extent it's not cached, if you have a shared DoH resolver, yes, the DNS queries you're generating are eventually sent in plaintext. But they're sent in plaintext over a network you trust more than your ISP's. DoH is essentially a DNS-only VPN. It has exactly the security model of a VPN with respect to the DNS protocol. The attack DoH breaks immediately is your US mainstream ISP recording all your DNS queries, which is something that is happening today. I really don't understand how people rationalize around this. It's not an exotic attack, like the cache-corruption attacks DNSSEC attempts to defend against; it's something that's happening constantly, all day, every day.

zzzcpan 7y ago
> The threat model of DoH is your local ISP. There is no threat model for DoH, only ad hoc attempts to justify it. Here's the thing, your ISP sees all of your packets with all the IP addresses and ports and payload size and the exact time they were sent and received. This identifies every website you visited with very high accuracy, I mean just IP addresses alone identify more than 90% of the websites you visited. > DoH is essentially a DNS-only VPN. It has exactly the security model of a VPN with respect to the DNS protocol. That "security model" is just integrity in communications with resolver, but it actually sacrifices privacy for that. > The attack DoH breaks immediately is your US mainstream ISP recording all your DNS queries This is absolutely useless "attack" to break. Most ISPs in the world record netflow-like data and store it for a long time, which provides more detailed profile on you, than DNS queries. If they store DNS queries, those are just for commercialization, not for snooping.
- tptacek 7y ago
  If you don't believe that DNS query data has any value, then you shouldn't have any opinion about where you send it. Your argument doesn't make any sense. I'm not sure what you think NetFlow records contain.
  - zzzcpan 7y ago
    Luckily, I do believe that DNS query data has value, that's the reason I'm arguing against anti-privacy crap like DoH and have been since the beginning. If my arguments don't make sense to you, it's either because you lack understanding or have an agenda to push DoH. > I'm not sure what you think NetFlow records contain. I don't need to think what they contain, I implemented a netflow collector or two in the past.
    - tptacek 7y ago
      Same! I was the product lead on Arbor Networks DOS product. How exactly is it that you think that a heavily sampled collection of IP addresses is equivalent to the exact names you type into a URL bar? The rest of your argument is just motte-and-bailey message board stuff. You started out saying that running your own local recurser is privacy-enhancing (it's the opposite) and that ISPs can see your DNS queries when you run DoH (they can't) and retreated to a position of "other things leak". That's true, other things do leak! We'll fix them too; we'll have ESNI soon enough, for instance. Make a coherent argument, please.
      - zzzcpan 7y ago
        Whether netflow is heavily sampled or not depends on where and how it is generated and for what purposes. It's just a format. > You started out saying that running your own local recurser is privacy-enhancing (it's the opposite) and that ISPs can see your DNS queries when you run DoH (they can't) and retreated to a position of "other things leak". Never said any of that, but your remarks are still wrong. What I said is basically that at ISP level there is much more information about what you are doing than DNS queries, including information that allows to identify the websites you are visited. Again, just IP addresses alone identify more than 90% of websites (can't remember the exact number from the research, it's like 95% from alexa top 1 million). Now with regards to privacy. First it's important to understand what privacy is actually about. Within your traffic there is a lot of meta and side channel-like information, some of the sources of that information overlap a lot or are even identical, a lot of redundant information. Like we can look at a packet with a DNS query and see domain name identifying a website. Or we can look at IP address of a packet initiating new connection, it won't identify every website uniquely, but it will most of them, to get to 95% we would need to also look at IP addresses of new connections following that connection, i.e. sub resources, making sort of an IP set fingerprint, either way single IP addresses or a fingerprint can be mapped to unique domains or a set of potential domains. To complete this example there is also SNI in plain text in packets and domain names in Host: headers, which also uniquely identify websites. So there is at least 3 sources of the same or almost the same information. What kind of privacy level is that? Well, we have a single party with access to the same relatively easily extractable information from multiple redundant sources, it's a lot to trust with. Would it change anything if remove any of the sources? Not really, it would have very insignificant effect on privacy since other sources are still available. And if we have to send that information to another party, now that would make things much worse, because now we would have to trust two parties with the same information, rather than one. Ok, so, how can we actually improve it? We can try to remove all three sources of information and send all of them through another party. This changes the party we have to trust, but we still have to trust it with just as much. What if we can't trust any party that much? Then the next choice is to shard (partition) that information to as many parties as we can. Trusting even just with half of that information to one party and half to another is already much better and is where we finally start scratching the surface of privacy. I hope it's clear that DoH is not helping with privacy, it just steals one of the sources of this information. As for running local recursive DNS server instead of the one provided by an ISP, it isn't leaking significantly more information to anyone. Packets likely go through the same route and there is a bit more of them for queries that didn't hit the cache for few popular domains. IP address is also exposed in such DNS packets, but ISP's DNS server would be coming from an IP address that belongs to the same AS and this leaks almost the same amount of identifying information.