4 ms·

How does DoH allow marketers to do anything they couldn't have done before by just hardcoding their own DNS server? It might make it harder to block queries by

by shawnz 7y ago

How does DoH allow marketers to do anything they couldn't have done before by just hardcoding their own DNS server? It might make it harder to block queries by deep packet inspection, but do you actually do that on your network right now?

JohnFen 7y ago
Marketers using hardcoded private servers are the easiest thing to defend against: just block those servers. That fact is one of the big reasons why marketers and other spies don't do that -- they use DNS lookups to find the mother ship. However, now marketers can use DoH, combined with public servers that would cause disruption to block, to be able to engage in lookups without a means of detecting or blocking them short of doing a MITM setup. > do you actually do that on your network right now? Yes, I installed it months ago to defend myself against DoH. I MITM all HTTPS connections, detect DoH lookups, and block them.
- shawnz 7y ago
  If you are going to that level of effort then why not just block the IPs of the marketing servers themselves?
  - JohnFen 7y ago
    That is an ineffective approach for a number of reasons. This is essentially a blacklist approach, and blacklist approaches are very weak. The number of such servers is in the several thousands, at least. They also move and new ones spin up, requiring constant updating of the blacklist. It's much more effective to take a whitelist approach or, what I do, just block the DNS lookups for them all. (That said, I do keep such a blacklist, as one small part of my multilayered security approach.)
    - shawnz 7y ago
      Don't those disadvantages apply just the same to your blacklisting of marketers' DNS servers?
      - JohnFen 7y ago
        Indeed they do, which is why that's not a sufficient defense all by itself. The next level up is to block the DNS lookups that happen when the spies are trying to find their servers. That's what DoH prevents.
        shawnz 7y ago
        I think maybe you misunderstood what I'm asking. Why couldn't such a spy just hardcode their own DNS server IP address, rather than using your network provided DNS server? If the answer is that you'll blacklist the spy's DNS servers, then how is that any different than the situation with DoH? DoH isn't adding any value for the spy unless you are doing deep packet inspection of any packet that contains DNS data.
        JohnFen 7y ago
        > If the answer is that you'll blacklist the spy's DNS servers, then how is that any different than the situation with DoH? There are two differences that DoH brings up about this. The first is that because mainstream DNS providers are beginning to support DoH, there is no need for anyone to set up their own private DNS server. In fact, they wouldn't want to -- much better to use a real one that can't be blocked without causing unacceptable collateral damage. The second is that DoH hides the entire interaction from me (unless I do what I did -- implement a MITM proxy to decrypt all HTTPS traffic). > DoH isn't adding any value for the spy unless you are doing deep packet inspection of any packet that contains DNS data. Sure it is. It effectively disables a layer of defenses from the spies.
        shawnz 7y ago
        > The first is that because mainstream DNS providers are beginning to support DoH, there is no need for anyone to set up their own private DNS server. That was already true though, because they could have used those mainstream providers' unencrypted DNS servers too. > Sure it is. It effectively disables a layer of defenses from the spies. But why would any spy rely on such a layer when you've left the front door (unencrypted DNS) wide open?
- JoshTriplett 7y ago
  Safer protocols don't care who or what they protect. Even if browsers didn't use DoH, other devices could. And any protocol Mozilla can use to protect their users will also work for other devices. I don't think it makes sense to bemoan the newfound existence of safer infrastructure for everyone just because devices you don't like can also use that infrastructure.
  - JohnFen 7y ago
    > Even if browsers didn't use DoH, other devices could. Precisely so. > I don't think it makes sense to bemoan the newfound existence of safer infrastructure for everyone just because devices you don't like can also use that infrastructure. I'm not. First, I don't think this is actually a "safer infrastructure" compared with other DNS encryption schemes, because it opens a new hole. Second, this isn't about "devices I don't like" using an infrastructure. This is about software and websites being able to bypass a layer of my defenses.
    - JoshTriplett 7y ago
      > First, I don't think this is actually a "safer infrastructure" compared with other DNS encryption schemes, because it opens a new hole. Browsers are completely correct to treat the network as hostile in their default configurations, unless explicitly configured to trust something. More prevalent end-to-end encryption is a good thing. And DoH makes it easier to get encrypted DNS requests through without having them blocked by hostile networks who want to intercept those DNS requests. If an encrypted DNS scheme is blockable by you, it's blockable by an ISP. There will not be an uproar about it, any more than there's currently an uproar about ISP's selling DNS-based browsing information about their users. It will simply fail.
      - JohnFen 7y ago
        > More prevalent end-to-end encryption is a good thing. I agree -- I am not arguing against more prevalent e2e crypto at all. > If an encrypted DNS scheme is blockable by you, it's blockable by an ISP. Perhaps, but it's also possible (unless you're using DoH) to evade those blocks without a great deal of difficulty. I'm not arguing with anything you've said here, really. I'm just pointing out that the way that DoH works means that there is a security hole that makes it very easy for marketers and other spies to evade your protections against them. So yes, DoH brings some security gains. But at the same time, it also brings some security losses. Whether that tradeoff is good for you should be a decision you can make -- but again, due to the way DoH works, you no longer have that choice available to you without going to extreme measures like I have.

by shawnz 7y ago

JohnFen 7y ago

Marketers using hardcoded private servers are the easiest thing to defend against: just block those servers. That fact is one of the big reasons why marketers and other spies don't do that -- they use DNS lookups to find the mother ship. However, now marketers can use DoH, combined with public servers that would cause disruption to block, to be able to engage in lookups without a means of detecting or blocking them short of doing a MITM setup. > do you actually do that on your network right now? Yes, I installed it months ago to defend myself against DoH. I MITM all HTTPS connections, detect DoH lookups, and block them.

shawnz 7y ago
If you are going to that level of effort then why not just block the IPs of the marketing servers themselves?
- JohnFen 7y ago
  That is an ineffective approach for a number of reasons. This is essentially a blacklist approach, and blacklist approaches are very weak. The number of such servers is in the several thousands, at least. They also move and new ones spin up, requiring constant updating of the blacklist. It's much more effective to take a whitelist approach or, what I do, just block the DNS lookups for them all. (That said, I do keep such a blacklist, as one small part of my multilayered security approach.)
  - shawnz 7y ago
    Don't those disadvantages apply just the same to your blacklisting of marketers' DNS servers?
    - JohnFen 7y ago
      Indeed they do, which is why that's not a sufficient defense all by itself. The next level up is to block the DNS lookups that happen when the spies are trying to find their servers. That's what DoH prevents.
      - shawnz 7y ago
        I think maybe you misunderstood what I'm asking. Why couldn't such a spy just hardcode their own DNS server IP address, rather than using your network provided DNS server? If the answer is that you'll blacklist the spy's DNS servers, then how is that any different than the situation with DoH? DoH isn't adding any value for the spy unless you are doing deep packet inspection of any packet that contains DNS data.
        JohnFen 7y ago
        > If the answer is that you'll blacklist the spy's DNS servers, then how is that any different than the situation with DoH? There are two differences that DoH brings up about this. The first is that because mainstream DNS providers are beginning to support DoH, there is no need for anyone to set up their own private DNS server. In fact, they wouldn't want to -- much better to use a real one that can't be blocked without causing unacceptable collateral damage. The second is that DoH hides the entire interaction from me (unless I do what I did -- implement a MITM proxy to decrypt all HTTPS traffic). > DoH isn't adding any value for the spy unless you are doing deep packet inspection of any packet that contains DNS data. Sure it is. It effectively disables a layer of defenses from the spies.
        shawnz 7y ago
        > The first is that because mainstream DNS providers are beginning to support DoH, there is no need for anyone to set up their own private DNS server. That was already true though, because they could have used those mainstream providers' unencrypted DNS servers too. > Sure it is. It effectively disables a layer of defenses from the spies. But why would any spy rely on such a layer when you've left the front door (unencrypted DNS) wide open?
JoshTriplett 7y ago
Safer protocols don't care who or what they protect. Even if browsers didn't use DoH, other devices could. And any protocol Mozilla can use to protect their users will also work for other devices. I don't think it makes sense to bemoan the newfound existence of safer infrastructure for everyone just because devices you don't like can also use that infrastructure.
- JohnFen 7y ago
  > Even if browsers didn't use DoH, other devices could. Precisely so. > I don't think it makes sense to bemoan the newfound existence of safer infrastructure for everyone just because devices you don't like can also use that infrastructure. I'm not. First, I don't think this is actually a "safer infrastructure" compared with other DNS encryption schemes, because it opens a new hole. Second, this isn't about "devices I don't like" using an infrastructure. This is about software and websites being able to bypass a layer of my defenses.
  - JoshTriplett 7y ago
    > First, I don't think this is actually a "safer infrastructure" compared with other DNS encryption schemes, because it opens a new hole. Browsers are completely correct to treat the network as hostile in their default configurations, unless explicitly configured to trust something. More prevalent end-to-end encryption is a good thing. And DoH makes it easier to get encrypted DNS requests through without having them blocked by hostile networks who want to intercept those DNS requests. If an encrypted DNS scheme is blockable by you, it's blockable by an ISP. There will not be an uproar about it, any more than there's currently an uproar about ISP's selling DNS-based browsing information about their users. It will simply fail.
    - JohnFen 7y ago
      > More prevalent end-to-end encryption is a good thing. I agree -- I am not arguing against more prevalent e2e crypto at all. > If an encrypted DNS scheme is blockable by you, it's blockable by an ISP. Perhaps, but it's also possible (unless you're using DoH) to evade those blocks without a great deal of difficulty. I'm not arguing with anything you've said here, really. I'm just pointing out that the way that DoH works means that there is a security hole that makes it very easy for marketers and other spies to evade your protections against them. So yes, DoH brings some security gains. But at the same time, it also brings some security losses. Whether that tradeoff is good for you should be a decision you can make -- but again, due to the way DoH works, you no longer have that choice available to you without going to extreme measures like I have.