4 ms·

> DNS is the primary way governments control and spy on web access. And DoH will enable every device you own to continue spying on you for the benefit of corpo

by tbyehl 7y ago

> DNS is the primary way governments control and spy on web access. And DoH will enable every device you own to continue spying on you for the benefit of corporations. DNS is the last bastion of preventing devices I can't sufficiently control from spying on me. I use DNS filtering to block their tracking domains. I use my firewall to prevent devices from accessing DNS resolvers I don't control. DoH takes those options away from me. Ridiculously, in the name of privacy. Ha! Unfortunately, the battle was lost the moment someone created a DoH implementation. It hardly matters what the browsers do. All the other things I don't want to have DoH will eventually implement it. And they won't respect use-application-dns.net or whatever other frameworks Mozilla comes up with for controlling DoH at the network level. (Also, does anyone really believe that governments, ISPs, and public DNS resolvers aren't going to disable DoH with use-application-dns.net? I'm sure whomever came up with DoH in the first place had great intentions but the end result is a disaster that will cause more harm than benefit)

afiori 7y ago
So your point is that your attack model was that makers of malwareApp would try to connect to malwareapp.net instead of a random IP? If you are worried about traffic in the browser you can not enable it, it you are worried about anything else then VPNs were already a thing since some time ago.
- tbyehl 7y ago
  I suppose my model is that every connected device and app, every web site someone visits, is malware. My household is full of things collecting data and passing it on to entities I don't wish to share that data with. How do I stop that when my ability to control what happens on my own network has been been reduced to Can access the Internet over 443, or not?
  - afiori 7y ago
    My question is how does DoH contributes to that in practice/theory. If a malicious/incompetent app/device wants to access random servers with DoH they would need to include a DoH implementation and then DoH offer nothing more than VPNs. In this context I do not understand if you are worried to have wireguard installed on your connected devices. If you are talking about Firefox itself, then disable it. I sympathize with wanting more control, but I do not understand how DoH changes things in a household settings. (I am assuming your is not a corporate point of view, in that case I agree that DoH might cause significant headaches)
    - tbyehl 7y ago
      > I do not understand how DoH changes things in a household settings. Imagine you run a PiHole or use a service like OpenDNS. It doesn't matter what you've chosen to use or block, what matters is that you've made a choice to utilize DNS filtering for certain things. You soon discover that some apps and devices don't respect your DNS decisions. They make money or derive other value through communications that are blocked by certain DNS-based filters, so they query 8.8.8.8 or some other DNS directly. You figure out how to make them respect your choice, through a combination of restricting DNS egress and DNAT at the router, and all is well again. Mozilla and Chrome come along with DoH. That's alright. You can configure them not to. There's the canary domain, so you don't even need to configure browsers manually, tho I expect the canary will eventually go away -- it is destined to be "abused" by every entity in a position to get away with it. What's going to come next is real the problem: Every entity which can benefit from being able to bypass DNS filters is going to move to DoH. It's in their best interests to do so. They don't need to respect the canary. You won't even be able to tell what they're doing because everything is encrypted with TLS and have pinned their certificates. App will do it. Embedded devices will do it. Actual malware will do it. This outcome is inevitable and that is my objection to the mere existence of DoH.
      - afiori 7y ago
        My question is how is DoH different from contacting 1.1.1.1 over https and asking for DNS information without the DNS protocols. I understand why people do not want this and want control over their own network, I find that a commendable goal. I do not understand how DoH specifically introduces anything new since you could already get DNS data from HTTPS API
        tbyehl 7y ago
        The two are not unrelated. Also, turns out that malware has already jumped on the DoH bandwagon. https://www.google.com/search?q=doh+dns+malware https://www.google.com/search?q=doh+dns+malware

by tbyehl 7y ago

afiori 7y ago

So your point is that your attack model was that makers of malwareApp would try to connect to malwareapp.net instead of a random IP? If you are worried about traffic in the browser you can not enable it, it you are worried about anything else then VPNs were already a thing since some time ago.

tbyehl 7y ago
I suppose my model is that every connected device and app, every web site someone visits, is malware. My household is full of things collecting data and passing it on to entities I don't wish to share that data with. How do I stop that when my ability to control what happens on my own network has been been reduced to Can access the Internet over 443, or not?
- afiori 7y ago
  My question is how does DoH contributes to that in practice/theory. If a malicious/incompetent app/device wants to access random servers with DoH they would need to include a DoH implementation and then DoH offer nothing more than VPNs. In this context I do not understand if you are worried to have wireguard installed on your connected devices. If you are talking about Firefox itself, then disable it. I sympathize with wanting more control, but I do not understand how DoH changes things in a household settings. (I am assuming your is not a corporate point of view, in that case I agree that DoH might cause significant headaches)
  - tbyehl 7y ago
    > I do not understand how DoH changes things in a household settings. Imagine you run a PiHole or use a service like OpenDNS. It doesn't matter what you've chosen to use or block, what matters is that you've made a choice to utilize DNS filtering for certain things. You soon discover that some apps and devices don't respect your DNS decisions. They make money or derive other value through communications that are blocked by certain DNS-based filters, so they query 8.8.8.8 or some other DNS directly. You figure out how to make them respect your choice, through a combination of restricting DNS egress and DNAT at the router, and all is well again. Mozilla and Chrome come along with DoH. That's alright. You can configure them not to. There's the canary domain, so you don't even need to configure browsers manually, tho I expect the canary will eventually go away -- it is destined to be "abused" by every entity in a position to get away with it. What's going to come next is real the problem: Every entity which can benefit from being able to bypass DNS filters is going to move to DoH. It's in their best interests to do so. They don't need to respect the canary. You won't even be able to tell what they're doing because everything is encrypted with TLS and have pinned their certificates. App will do it. Embedded devices will do it. Actual malware will do it. This outcome is inevitable and that is my objection to the mere existence of DoH.
    - afiori 7y ago
      My question is how is DoH different from contacting 1.1.1.1 over https and asking for DNS information without the DNS protocols. I understand why people do not want this and want control over their own network, I find that a commendable goal. I do not understand how DoH specifically introduces anything new since you could already get DNS data from HTTPS API
      - tbyehl 7y ago
        The two are not unrelated. Also, turns out that malware has already jumped on the DoH bandwagon. https://www.google.com/search?q=doh+dns+malware https://www.google.com/search?q=doh+dns+malware