3 ms·

Luckily, I do believe that DNS query data has value, that's the reason I'm arguing against anti-privacy crap like DoH and have been since the beginning. If my a

Luckily, I do believe that DNS query data has value, that's the reason I'm arguing against anti-privacy crap like DoH and have been since the beginning. If my arguments don't make sense to you, it's either because you lack understanding or have an agenda to push DoH. > I'm not sure what you think NetFlow records contain. I don't need to think what they contain, I implemented a netflow collector or two in the past.

tptacek 7y ago
Same! I was the product lead on Arbor Networks DOS product. How exactly is it that you think that a heavily sampled collection of IP addresses is equivalent to the exact names you type into a URL bar? The rest of your argument is just motte-and-bailey message board stuff. You started out saying that running your own local recurser is privacy-enhancing (it's the opposite) and that ISPs can see your DNS queries when you run DoH (they can't) and retreated to a position of "other things leak". That's true, other things do leak! We'll fix them too; we'll have ESNI soon enough, for instance. Make a coherent argument, please.
- zzzcpan 7y ago
  Whether netflow is heavily sampled or not depends on where and how it is generated and for what purposes. It's just a format. > You started out saying that running your own local recurser is privacy-enhancing (it's the opposite) and that ISPs can see your DNS queries when you run DoH (they can't) and retreated to a position of "other things leak". Never said any of that, but your remarks are still wrong. What I said is basically that at ISP level there is much more information about what you are doing than DNS queries, including information that allows to identify the websites you are visited. Again, just IP addresses alone identify more than 90% of websites (can't remember the exact number from the research, it's like 95% from alexa top 1 million). Now with regards to privacy. First it's important to understand what privacy is actually about. Within your traffic there is a lot of meta and side channel-like information, some of the sources of that information overlap a lot or are even identical, a lot of redundant information. Like we can look at a packet with a DNS query and see domain name identifying a website. Or we can look at IP address of a packet initiating new connection, it won't identify every website uniquely, but it will most of them, to get to 95% we would need to also look at IP addresses of new connections following that connection, i.e. sub resources, making sort of an IP set fingerprint, either way single IP addresses or a fingerprint can be mapped to unique domains or a set of potential domains. To complete this example there is also SNI in plain text in packets and domain names in Host: headers, which also uniquely identify websites. So there is at least 3 sources of the same or almost the same information. What kind of privacy level is that? Well, we have a single party with access to the same relatively easily extractable information from multiple redundant sources, it's a lot to trust with. Would it change anything if remove any of the sources? Not really, it would have very insignificant effect on privacy since other sources are still available. And if we have to send that information to another party, now that would make things much worse, because now we would have to trust two parties with the same information, rather than one. Ok, so, how can we actually improve it? We can try to remove all three sources of information and send all of them through another party. This changes the party we have to trust, but we still have to trust it with just as much. What if we can't trust any party that much? Then the next choice is to shard (partition) that information to as many parties as we can. Trusting even just with half of that information to one party and half to another is already much better and is where we finally start scratching the surface of privacy. I hope it's clear that DoH is not helping with privacy, it just steals one of the sources of this information. As for running local recursive DNS server instead of the one provided by an ISP, it isn't leaking significantly more information to anyone. Packets likely go through the same route and there is a bit more of them for queries that didn't hit the cache for few popular domains. IP address is also exposed in such DNS packets, but ISP's DNS server would be coming from an IP address that belongs to the same AS and this leaks almost the same amount of identifying information.
  - tptacek 7y ago
    You didn't answer the question; you just wrote a wall of text evading it. Obviously, running a local cache server isn't privacy-enhancing, despite anything you may have said upthread. Obviously, a sampled feed of NetFlow records isn't the same thing as the full-fidelity feed of every DNS name you searched for. Obviously, you're better off not giving that information to your ISP if you don't have to, and with DOH, you don't have to: you can pick the network from which your DNS queries will originate, most of which (if you don't run your own) will have contractual obligations not to log that no US ISP has.
    - zzzcpan 7y ago
      > Obviously, you're better off not giving that information to your ISP if you don't have to, and with DOH, you don't have to: This is incorrect. DoH doesn't take away that information, DoH only takes away one source of that information, other sources are still available to your ISP. So adding DoH to the mix simply forces you trust more parties with the same amount of information. There is just no way around it. DoH is simply not for privacy.

tptacek 7y ago

Same! I was the product lead on Arbor Networks DOS product. How exactly is it that you think that a heavily sampled collection of IP addresses is equivalent to the exact names you type into a URL bar? The rest of your argument is just motte-and-bailey message board stuff. You started out saying that running your own local recurser is privacy-enhancing (it's the opposite) and that ISPs can see your DNS queries when you run DoH (they can't) and retreated to a position of "other things leak". That's true, other things do leak! We'll fix them too; we'll have ESNI soon enough, for instance. Make a coherent argument, please.

zzzcpan 7y ago
Whether netflow is heavily sampled or not depends on where and how it is generated and for what purposes. It's just a format. > You started out saying that running your own local recurser is privacy-enhancing (it's the opposite) and that ISPs can see your DNS queries when you run DoH (they can't) and retreated to a position of "other things leak". Never said any of that, but your remarks are still wrong. What I said is basically that at ISP level there is much more information about what you are doing than DNS queries, including information that allows to identify the websites you are visited. Again, just IP addresses alone identify more than 90% of websites (can't remember the exact number from the research, it's like 95% from alexa top 1 million). Now with regards to privacy. First it's important to understand what privacy is actually about. Within your traffic there is a lot of meta and side channel-like information, some of the sources of that information overlap a lot or are even identical, a lot of redundant information. Like we can look at a packet with a DNS query and see domain name identifying a website. Or we can look at IP address of a packet initiating new connection, it won't identify every website uniquely, but it will most of them, to get to 95% we would need to also look at IP addresses of new connections following that connection, i.e. sub resources, making sort of an IP set fingerprint, either way single IP addresses or a fingerprint can be mapped to unique domains or a set of potential domains. To complete this example there is also SNI in plain text in packets and domain names in Host: headers, which also uniquely identify websites. So there is at least 3 sources of the same or almost the same information. What kind of privacy level is that? Well, we have a single party with access to the same relatively easily extractable information from multiple redundant sources, it's a lot to trust with. Would it change anything if remove any of the sources? Not really, it would have very insignificant effect on privacy since other sources are still available. And if we have to send that information to another party, now that would make things much worse, because now we would have to trust two parties with the same information, rather than one. Ok, so, how can we actually improve it? We can try to remove all three sources of information and send all of them through another party. This changes the party we have to trust, but we still have to trust it with just as much. What if we can't trust any party that much? Then the next choice is to shard (partition) that information to as many parties as we can. Trusting even just with half of that information to one party and half to another is already much better and is where we finally start scratching the surface of privacy. I hope it's clear that DoH is not helping with privacy, it just steals one of the sources of this information. As for running local recursive DNS server instead of the one provided by an ISP, it isn't leaking significantly more information to anyone. Packets likely go through the same route and there is a bit more of them for queries that didn't hit the cache for few popular domains. IP address is also exposed in such DNS packets, but ISP's DNS server would be coming from an IP address that belongs to the same AS and this leaks almost the same amount of identifying information.
- tptacek 7y ago
  You didn't answer the question; you just wrote a wall of text evading it. Obviously, running a local cache server isn't privacy-enhancing, despite anything you may have said upthread. Obviously, a sampled feed of NetFlow records isn't the same thing as the full-fidelity feed of every DNS name you searched for. Obviously, you're better off not giving that information to your ISP if you don't have to, and with DOH, you don't have to: you can pick the network from which your DNS queries will originate, most of which (if you don't run your own) will have contractual obligations not to log that no US ISP has.
  - zzzcpan 7y ago
    > Obviously, you're better off not giving that information to your ISP if you don't have to, and with DOH, you don't have to: This is incorrect. DoH doesn't take away that information, DoH only takes away one source of that information, other sources are still available to your ISP. So adding DoH to the mix simply forces you trust more parties with the same amount of information. There is just no way around it. DoH is simply not for privacy.