5 ms·

The underlying issue is that a DoH provider can craft the DNS answers individual users get if it wants to. Think about it: a Firefox DoH user could get differe

The underlying issue is that a DoH provider can craft the DNS answers individual users get if it wants to. Think about it: a Firefox DoH user could get different DNS answers than other apps get on the same machine using standard DNS on port 53, if Google or Cloudflare wanted to, because they’re essentially talking to different versions of the internet. Remember, all of the properties that allows HTTPS to be trackable—cookies, fingerprinting and the rest—is in play for DNS over HTTPS as well. DoT doesn’t allow for that. If all these providers wanted was encrypted DNS, they’d be pushing DNS over TLS, which is just standard DNS using TLS as the transport. Sure, it uses port 853, but given time, enterprises and other security-conscious organizations would have adjusted, especially if the entire DNS ecosystem got behind it. But because Google, Cloudflare and NextDNS see an opportunity of some kind, they are pushing for DoH. The DNS is an open, global, distributed hierarchical database; DoH starts to break this because apps can bypass most of this and that’s not how the internet was designed to work. The same way Gmail broke the model of federated SMTP servers to a large extent, there’s the potential for the major DoH providers to do the same to DNS. Imagine if Cloudflare decided to block certain DNS records from their users. Certain services that worked fine pre-DoH would break. Take a look at the article DNS Wars; it’s eye opening: https://blog.apnic.net/2019/11/04/dns-wars/ https://blog.apnic.net/2019/11/04/dns-wars/

ryanisnan 7y ago
> Think about it: a Firefox DoH user could get different DNS answers than other apps get on the same machine using standard DNS on port 53, if Google or Cloudflare wanted to, because they’re essentially talking to different versions of the internet. How is that different than existing DNS servers?
- sp332 7y ago
  There's no difference that a DNS server can see between a browser on your computer making a DNS request vs. any other app. But if the browser is using DoH and other apps don't, then it can tell.
  - ryanisnan 7y ago
    Right, but that's just an argument for more applications and lower level networking stacks to support DoH.
    - deleted 7y ago
      [deleted]
    - corford 7y ago
      Not really. It's an argument for the industry moving to something sensible; not "split braining" low level infrastructure by shoehorning some of it into HTTP, apps and a handful of centralised coporations who claim to play a little nicer than telcos.
- alwillis 7y ago
  How is that different than existing DNS servers? Because standard DNS servers using mostly UDP can’t track you the way a DoH server can. The more centralized DoH becomes, the more tempting it’ll be to monetize that traffic.
sp332 7y ago
What DoH implementation sends cookies?
- alwillis 7y ago
  They all can; that’s built in to HTTPS. Whether they will, we’ll have to wait and see.
  - sp332 7y ago
    Normal DNS over UDP can also contain arbitrary data, which completely hypothetcally could be used to send identifying data about the client. E.g. https://unit42.paloaltonetworks.com/dns-tunneling-how-dns-can-be-abused-by-malicious-actors/ https://unit42.paloaltonetworks.com/dns-tunneling-how-dns-ca... But that's not really a strike against the protocol, that would be a fault of the implementation.
alwillis 7y ago
I posted the article Centralised DoH is bad for Privacy, in 2019 and beyond to HN nearly a week ago [1]. Here’s the money quote: DNS over HTTPS however neatly separates out each device (and even each individual application on that device) to a separate query stream. This alone is worrying, as we now have individual users’ queries, but the TLS that underlies HTTPS also typically uses TLS Resumption which offers even further tracking capabilities. [1]: https://news.ycombinator.com/item?id=22362864 https://news.ycombinator.com/item?id=22362864
- comex 7y ago
  Yes, in the hypothetical case that some agency is compelling CloudFlare (and/or NextDNS) to provide ongoing real-time decryption, which would be somewhat unprecedented: not entirely dissimilar to things which have been publicly reported before, but not the same either. In the more likely case that that isn't happening, you make those agencies' lives a lot harder.
comex 7y ago
> Cloudflare does not block or filter content through the Cloudflare Resolver for Firefox. As part of its agreement with Mozilla, Cloudflare is providing only direct DNS resolution. If Cloudflare were to receive written requests from law enforcement and government agencies to block access to domains or content through the Cloudflare resolver for Firefox, Cloudflare would, in consultation with Mozilla, exhaust our legal remedies before complying with such a request. We also commit to documenting any government request to block access in our semi-annual transparency report, unless legally prohibited from doing so. https://developers.cloudflare.com/1.1.1.1/commitment-to-priv.. https://developers.cloudflare.com/1.1.1.1/commitment-to-priv....

ryanisnan 7y ago

> Think about it: a Firefox DoH user could get different DNS answers than other apps get on the same machine using standard DNS on port 53, if Google or Cloudflare wanted to, because they’re essentially talking to different versions of the internet. How is that different than existing DNS servers?

sp332 7y ago
There's no difference that a DNS server can see between a browser on your computer making a DNS request vs. any other app. But if the browser is using DoH and other apps don't, then it can tell.
- ryanisnan 7y ago
  Right, but that's just an argument for more applications and lower level networking stacks to support DoH.
  - deleted 7y ago
    [deleted]
  - corford 7y ago
    Not really. It's an argument for the industry moving to something sensible; not "split braining" low level infrastructure by shoehorning some of it into HTTP, apps and a handful of centralised coporations who claim to play a little nicer than telcos.
alwillis 7y ago
How is that different than existing DNS servers? Because standard DNS servers using mostly UDP can’t track you the way a DoH server can. The more centralized DoH becomes, the more tempting it’ll be to monetize that traffic.

sp332 7y ago

What DoH implementation sends cookies?

alwillis 7y ago
They all can; that’s built in to HTTPS. Whether they will, we’ll have to wait and see.
- sp332 7y ago
  Normal DNS over UDP can also contain arbitrary data, which completely hypothetcally could be used to send identifying data about the client. E.g. https://unit42.paloaltonetworks.com/dns-tunneling-how-dns-can-be-abused-by-malicious-actors/ https://unit42.paloaltonetworks.com/dns-tunneling-how-dns-ca... But that's not really a strike against the protocol, that would be a fault of the implementation.

alwillis 7y ago

I posted the article Centralised DoH is bad for Privacy, in 2019 and beyond to HN nearly a week ago [1]. Here’s the money quote: DNS over HTTPS however neatly separates out each device (and even each individual application on that device) to a separate query stream. This alone is worrying, as we now have individual users’ queries, but the TLS that underlies HTTPS also typically uses TLS Resumption which offers even further tracking capabilities. [1]: https://news.ycombinator.com/item?id=22362864 https://news.ycombinator.com/item?id=22362864

comex 7y ago
Yes, in the hypothetical case that some agency is compelling CloudFlare (and/or NextDNS) to provide ongoing real-time decryption, which would be somewhat unprecedented: not entirely dissimilar to things which have been publicly reported before, but not the same either. In the more likely case that that isn't happening, you make those agencies' lives a lot harder.

comex 7y ago

> Cloudflare does not block or filter content through the Cloudflare Resolver for Firefox. As part of its agreement with Mozilla, Cloudflare is providing only direct DNS resolution. If Cloudflare were to receive written requests from law enforcement and government agencies to block access to domains or content through the Cloudflare resolver for Firefox, Cloudflare would, in consultation with Mozilla, exhaust our legal remedies before complying with such a request. We also commit to documenting any government request to block access in our semi-annual transparency report, unless legally prohibited from doing so. https://developers.cloudflare.com/1.1.1.1/commitment-to-priv.. https://developers.cloudflare.com/1.1.1.1/commitment-to-priv....