4 ms·

I suppose my model is that every connected device and app, every web site someone visits, is malware. My household is full of things collecting data and passing

by tbyehl 7y ago

I suppose my model is that every connected device and app, every web site someone visits, is malware. My household is full of things collecting data and passing it on to entities I don't wish to share that data with. How do I stop that when my ability to control what happens on my own network has been been reduced to Can access the Internet over 443, or not?

afiori 7y ago
My question is how does DoH contributes to that in practice/theory. If a malicious/incompetent app/device wants to access random servers with DoH they would need to include a DoH implementation and then DoH offer nothing more than VPNs. In this context I do not understand if you are worried to have wireguard installed on your connected devices. If you are talking about Firefox itself, then disable it. I sympathize with wanting more control, but I do not understand how DoH changes things in a household settings. (I am assuming your is not a corporate point of view, in that case I agree that DoH might cause significant headaches)
- tbyehl 7y ago
  > I do not understand how DoH changes things in a household settings. Imagine you run a PiHole or use a service like OpenDNS. It doesn't matter what you've chosen to use or block, what matters is that you've made a choice to utilize DNS filtering for certain things. You soon discover that some apps and devices don't respect your DNS decisions. They make money or derive other value through communications that are blocked by certain DNS-based filters, so they query 8.8.8.8 or some other DNS directly. You figure out how to make them respect your choice, through a combination of restricting DNS egress and DNAT at the router, and all is well again. Mozilla and Chrome come along with DoH. That's alright. You can configure them not to. There's the canary domain, so you don't even need to configure browsers manually, tho I expect the canary will eventually go away -- it is destined to be "abused" by every entity in a position to get away with it. What's going to come next is real the problem: Every entity which can benefit from being able to bypass DNS filters is going to move to DoH. It's in their best interests to do so. They don't need to respect the canary. You won't even be able to tell what they're doing because everything is encrypted with TLS and have pinned their certificates. App will do it. Embedded devices will do it. Actual malware will do it. This outcome is inevitable and that is my objection to the mere existence of DoH.
  - afiori 7y ago
    My question is how is DoH different from contacting 1.1.1.1 over https and asking for DNS information without the DNS protocols. I understand why people do not want this and want control over their own network, I find that a commendable goal. I do not understand how DoH specifically introduces anything new since you could already get DNS data from HTTPS API
    - tbyehl 7y ago
      The two are not unrelated. Also, turns out that malware has already jumped on the DoH bandwagon. https://www.google.com/search?q=doh+dns+malware https://www.google.com/search?q=doh+dns+malware

by tbyehl 7y ago

afiori 7y ago

My question is how does DoH contributes to that in practice/theory. If a malicious/incompetent app/device wants to access random servers with DoH they would need to include a DoH implementation and then DoH offer nothing more than VPNs. In this context I do not understand if you are worried to have wireguard installed on your connected devices. If you are talking about Firefox itself, then disable it. I sympathize with wanting more control, but I do not understand how DoH changes things in a household settings. (I am assuming your is not a corporate point of view, in that case I agree that DoH might cause significant headaches)

tbyehl 7y ago
> I do not understand how DoH changes things in a household settings. Imagine you run a PiHole or use a service like OpenDNS. It doesn't matter what you've chosen to use or block, what matters is that you've made a choice to utilize DNS filtering for certain things. You soon discover that some apps and devices don't respect your DNS decisions. They make money or derive other value through communications that are blocked by certain DNS-based filters, so they query 8.8.8.8 or some other DNS directly. You figure out how to make them respect your choice, through a combination of restricting DNS egress and DNAT at the router, and all is well again. Mozilla and Chrome come along with DoH. That's alright. You can configure them not to. There's the canary domain, so you don't even need to configure browsers manually, tho I expect the canary will eventually go away -- it is destined to be "abused" by every entity in a position to get away with it. What's going to come next is real the problem: Every entity which can benefit from being able to bypass DNS filters is going to move to DoH. It's in their best interests to do so. They don't need to respect the canary. You won't even be able to tell what they're doing because everything is encrypted with TLS and have pinned their certificates. App will do it. Embedded devices will do it. Actual malware will do it. This outcome is inevitable and that is my objection to the mere existence of DoH.
- afiori 7y ago
  My question is how is DoH different from contacting 1.1.1.1 over https and asking for DNS information without the DNS protocols. I understand why people do not want this and want control over their own network, I find that a commendable goal. I do not understand how DoH specifically introduces anything new since you could already get DNS data from HTTPS API
  - tbyehl 7y ago
    The two are not unrelated. Also, turns out that malware has already jumped on the DoH bandwagon. https://www.google.com/search?q=doh+dns+malware https://www.google.com/search?q=doh+dns+malware