3 ms·

If you are going to that level of effort then why not just block the IPs of the marketing servers themselves?

by shawnz 7y ago

JohnFen 7y ago
That is an ineffective approach for a number of reasons. This is essentially a blacklist approach, and blacklist approaches are very weak. The number of such servers is in the several thousands, at least. They also move and new ones spin up, requiring constant updating of the blacklist. It's much more effective to take a whitelist approach or, what I do, just block the DNS lookups for them all. (That said, I do keep such a blacklist, as one small part of my multilayered security approach.)
- shawnz 7y ago
  Don't those disadvantages apply just the same to your blacklisting of marketers' DNS servers?
  - JohnFen 7y ago
    Indeed they do, which is why that's not a sufficient defense all by itself. The next level up is to block the DNS lookups that happen when the spies are trying to find their servers. That's what DoH prevents.
    - shawnz 7y ago
      I think maybe you misunderstood what I'm asking. Why couldn't such a spy just hardcode their own DNS server IP address, rather than using your network provided DNS server? If the answer is that you'll blacklist the spy's DNS servers, then how is that any different than the situation with DoH? DoH isn't adding any value for the spy unless you are doing deep packet inspection of any packet that contains DNS data.
      - JohnFen 7y ago
        > If the answer is that you'll blacklist the spy's DNS servers, then how is that any different than the situation with DoH? There are two differences that DoH brings up about this. The first is that because mainstream DNS providers are beginning to support DoH, there is no need for anyone to set up their own private DNS server. In fact, they wouldn't want to -- much better to use a real one that can't be blocked without causing unacceptable collateral damage. The second is that DoH hides the entire interaction from me (unless I do what I did -- implement a MITM proxy to decrypt all HTTPS traffic). > DoH isn't adding any value for the spy unless you are doing deep packet inspection of any packet that contains DNS data. Sure it is. It effectively disables a layer of defenses from the spies.
        shawnz 7y ago
        > The first is that because mainstream DNS providers are beginning to support DoH, there is no need for anyone to set up their own private DNS server. That was already true though, because they could have used those mainstream providers' unencrypted DNS servers too. > Sure it is. It effectively disables a layer of defenses from the spies. But why would any spy rely on such a layer when you've left the front door (unencrypted DNS) wide open?

If you are going to that level of effort then why not just block the IPs of the marketing servers themselves?

by shawnz 7y ago

If you are going to that level of effort then why not just block the IPs of the marketing servers themselves?

That is an ineffective approach for a number of reasons. This is essentially a blacklist approach, and blacklist approaches are very weak. The number of such servers is in the several thousands, at least. They also move and new ones spin up, requiring constant updating of the blacklist. It's much more effective to take a whitelist approach or, what I do, just block the DNS lookups for them all. (That said, I do keep such a blacklist, as one small part of my multilayered security approach.)

shawnz 7y ago
Don't those disadvantages apply just the same to your blacklisting of marketers' DNS servers?
- JohnFen 7y ago
  Indeed they do, which is why that's not a sufficient defense all by itself. The next level up is to block the DNS lookups that happen when the spies are trying to find their servers. That's what DoH prevents.
  - shawnz 7y ago
    I think maybe you misunderstood what I'm asking. Why couldn't such a spy just hardcode their own DNS server IP address, rather than using your network provided DNS server? If the answer is that you'll blacklist the spy's DNS servers, then how is that any different than the situation with DoH? DoH isn't adding any value for the spy unless you are doing deep packet inspection of any packet that contains DNS data.
    - JohnFen 7y ago
      > If the answer is that you'll blacklist the spy's DNS servers, then how is that any different than the situation with DoH? There are two differences that DoH brings up about this. The first is that because mainstream DNS providers are beginning to support DoH, there is no need for anyone to set up their own private DNS server. In fact, they wouldn't want to -- much better to use a real one that can't be blocked without causing unacceptable collateral damage. The second is that DoH hides the entire interaction from me (unless I do what I did -- implement a MITM proxy to decrypt all HTTPS traffic). > DoH isn't adding any value for the spy unless you are doing deep packet inspection of any packet that contains DNS data. Sure it is. It effectively disables a layer of defenses from the spies.
      - shawnz 7y ago
        > The first is that because mainstream DNS providers are beginning to support DoH, there is no need for anyone to set up their own private DNS server. That was already true though, because they could have used those mainstream providers' unencrypted DNS servers too. > Sure it is. It effectively disables a layer of defenses from the spies. But why would any spy rely on such a layer when you've left the front door (unencrypted DNS) wide open?