3 ms·

I dont use my ISP as my DNS provider, I have a custom setup using PiHole and other methods to provide secure DNS Resolution Firefox should not be forcing this

by syshum 7y ago

I dont use my ISP as my DNS provider, I have a custom setup using PiHole and other methods to provide secure DNS Resolution Firefox should not be forcing this shit on me, time to search for yet another browser that will respect users. Mozilla is clearly more interested in commercial viability via their partnerships with large corporations (like CloudFlare) then in protecting Users

zamalek 7y ago
The only way to solve the ISP DNS inspection problem is by one of: * Using DoH. For this to work with PiHole, you need to have a DoH resolver on the device, and then instruct the PiHole to recurse to that resolver instead - possibly your own in a VM somewhere? * Using a permanent encrypted VPN to your own machine in the cloud and routing all DNS through that, then recursing to some DNS that you trust. * Write your own encrypted protocol that communicates with some machine in the cloud. Anything else and your ISP/evil-state-actor is able to to see your DNS traffic in plain-text. PiHole and DoH approach the problem at different OSI layers, you ideally need both.
- alwillis 7y ago
  DNS over TSL (DoT) is a much better alternative to DoH, at least when it comes to the ability to be tracked. For example, because it’s not using HTTP, there are no cookies or SNI to worry about. More at https://news.ycombinator.com/item?id=22418005 https://news.ycombinator.com/item?id=22418005.
  - growse 7y ago
    > DNS over TSL (DoT) is a much better alternative to DoH, at least when it comes to the ability to be tracked. > For example, because it’s not using HTTP, there are no cookies or SNI to worry about. > More at https://news.ycombinator.com/item?id=22418005 https://news.ycombinator.com/item?id=22418005. The fact that it can be trivially blocked by anyone on the network path does not make it "much better".
    - alwillis 7y ago
      The fact that it can be trivially blocked by anyone on the network path does not make it "much better". Of course anyone on the "network path" can block almost any protocol; DoT isn’t unique in that regard. The concern is many large businesses block port 853 but that's because prior to the development of DoT, there was no reason for IT departments to configure firewalls to enable it. Most organizations only have a handful of ports available, including 443, which is what HTTPS uses and therefore DoH works as a result. I've been running DNS over TLS using the Unbound [1] resolver for my home LAN on a spare laptop for a few weeks now and it’s been great. Given the privacy trade-offs between privacy and security, many IT departments would opt to make port 853 available for DoT rather than increasing the ability for their users to be tracked. As I mentioned elsewhere in this thread, the article Centralised DoH is bad for Privacy, in 2019 and beyond [2] clearly describes the issues with DoH: DNS over HTTPS opens up DNS to all the tracking possibilities present in HTTPS and TLS. As it stands, DNS over UDP almost always gets some free privacy by mixing all devices on a network together – an outside snooper sees a stream of queries coming from a household, a coffeeshop or even an entire office building, with no way to tie a query to any specific device or user. Such mixing of queries provides an imperfect but useful modicum of privacy. DNS over HTTPS however neatly separates out each device (and even each individual application on that device) to a separate query stream. This alone is worrying, as we now have individual users’ queries, but the TLS that underlies HTTPS also typically uses TLS Resumption which offers even further tracking capabilities. [1]: https://www.ctrl.blog/entry/unbound-tls-forwarding.html https://www.ctrl.blog/entry/unbound-tls-forwarding.html [2]: https://labs.ripe.net/Members/bert_hubert/centralised-doh-is-bad-for-privacy-in-2019-and-beyond https://labs.ripe.net/Members/bert_hubert/centralised-doh-is...
  - zamalek 7y ago
    DoT only solves the SNI problem during the DNS request itself. It doesn't do a thing about the SNI during the request to the actual website, which is where all the privacy concerns are.
    - alwillis 7y ago
      DoT only solves the SNI problem during the DNS request itself. It doesn't do a thing about the SNI during the request to the actual website, which is where all the privacy concerns are. Sure, but until we have encrypted SNI, which is in draft, meta data is going to leak, but that's a separate issue from either DoT or DoH. But because DoT doesn't use HTTPS, you don't get some of its downsides like using cookies for tracking, for example.
      - zamalek 7y ago
        DoH (edit from DoT) doesn't use cookies, it is stateless. But your original comment didn't mention that anyway, it only mentioned SNI.
        alwillis 7y ago
        From "The Big DNS Privacy Debate" [1]: DoH shares the benefits and downsides of HTTPS. It sends out more trackable data than regular DNS, simply because HTTP supports things like headers and cookies. TLS session resumption functions as another tracking mechanism. There’s a draft RFC [2] to address these and other privacy issues that weren't specified in the original RFC for DoH. [1]: https://labs.ripe.net/Members/bert_hubert/the-big-dns-privacy-debate https://labs.ripe.net/Members/bert_hubert/the-big-dns-privac... [2]: https://www.ietf.org/archive/id/draft-dickinson-doh-dohpe-00.txt https://www.ietf.org/archive/id/draft-dickinson-doh-dohpe-00...
- syshum 7y ago
  >>Anything else and your ISP/evil-state-actor is able to to see your DNS traffic in plain-text and you believe CloudFlare is not a "evil state actor" or has not been compromised or never will be compromised by an "evil state actor" Wow your faith in CloudFlare is much much higher than mine Personally I trust my current ISP (which is not one of the big boys) more than I trust CloudFlare. I do not trust cloudflare at all and believe they are the are one of the biggest threats to the future of open web there is today.
  - zamalek 7y ago
    Cloudflare aren't the only people running a DoH endpoint

by syshum 7y ago

zamalek 7y ago

The only way to solve the ISP DNS inspection problem is by one of: * Using DoH. For this to work with PiHole, you need to have a DoH resolver on the device, and then instruct the PiHole to recurse to that resolver instead - possibly your own in a VM somewhere? * Using a permanent encrypted VPN to your own machine in the cloud and routing all DNS through that, then recursing to some DNS that you trust. * Write your own encrypted protocol that communicates with some machine in the cloud. Anything else and your ISP/evil-state-actor is able to to see your DNS traffic in plain-text. PiHole and DoH approach the problem at different OSI layers, you ideally need both.

alwillis 7y ago
DNS over TSL (DoT) is a much better alternative to DoH, at least when it comes to the ability to be tracked. For example, because it’s not using HTTP, there are no cookies or SNI to worry about. More at https://news.ycombinator.com/item?id=22418005 https://news.ycombinator.com/item?id=22418005.
- growse 7y ago
  > DNS over TSL (DoT) is a much better alternative to DoH, at least when it comes to the ability to be tracked. > For example, because it’s not using HTTP, there are no cookies or SNI to worry about. > More at https://news.ycombinator.com/item?id=22418005 https://news.ycombinator.com/item?id=22418005. The fact that it can be trivially blocked by anyone on the network path does not make it "much better".
  - alwillis 7y ago
    The fact that it can be trivially blocked by anyone on the network path does not make it "much better". Of course anyone on the "network path" can block almost any protocol; DoT isn’t unique in that regard. The concern is many large businesses block port 853 but that's because prior to the development of DoT, there was no reason for IT departments to configure firewalls to enable it. Most organizations only have a handful of ports available, including 443, which is what HTTPS uses and therefore DoH works as a result. I've been running DNS over TLS using the Unbound [1] resolver for my home LAN on a spare laptop for a few weeks now and it’s been great. Given the privacy trade-offs between privacy and security, many IT departments would opt to make port 853 available for DoT rather than increasing the ability for their users to be tracked. As I mentioned elsewhere in this thread, the article Centralised DoH is bad for Privacy, in 2019 and beyond [2] clearly describes the issues with DoH: DNS over HTTPS opens up DNS to all the tracking possibilities present in HTTPS and TLS. As it stands, DNS over UDP almost always gets some free privacy by mixing all devices on a network together – an outside snooper sees a stream of queries coming from a household, a coffeeshop or even an entire office building, with no way to tie a query to any specific device or user. Such mixing of queries provides an imperfect but useful modicum of privacy. DNS over HTTPS however neatly separates out each device (and even each individual application on that device) to a separate query stream. This alone is worrying, as we now have individual users’ queries, but the TLS that underlies HTTPS also typically uses TLS Resumption which offers even further tracking capabilities. [1]: https://www.ctrl.blog/entry/unbound-tls-forwarding.html https://www.ctrl.blog/entry/unbound-tls-forwarding.html [2]: https://labs.ripe.net/Members/bert_hubert/centralised-doh-is-bad-for-privacy-in-2019-and-beyond https://labs.ripe.net/Members/bert_hubert/centralised-doh-is...
- zamalek 7y ago
  DoT only solves the SNI problem during the DNS request itself. It doesn't do a thing about the SNI during the request to the actual website, which is where all the privacy concerns are.
  - alwillis 7y ago
    DoT only solves the SNI problem during the DNS request itself. It doesn't do a thing about the SNI during the request to the actual website, which is where all the privacy concerns are. Sure, but until we have encrypted SNI, which is in draft, meta data is going to leak, but that's a separate issue from either DoT or DoH. But because DoT doesn't use HTTPS, you don't get some of its downsides like using cookies for tracking, for example.
    - zamalek 7y ago
      DoH (edit from DoT) doesn't use cookies, it is stateless. But your original comment didn't mention that anyway, it only mentioned SNI.
      - alwillis 7y ago
        From "The Big DNS Privacy Debate" [1]: DoH shares the benefits and downsides of HTTPS. It sends out more trackable data than regular DNS, simply because HTTP supports things like headers and cookies. TLS session resumption functions as another tracking mechanism. There’s a draft RFC [2] to address these and other privacy issues that weren't specified in the original RFC for DoH. [1]: https://labs.ripe.net/Members/bert_hubert/the-big-dns-privacy-debate https://labs.ripe.net/Members/bert_hubert/the-big-dns-privac... [2]: https://www.ietf.org/archive/id/draft-dickinson-doh-dohpe-00.txt https://www.ietf.org/archive/id/draft-dickinson-doh-dohpe-00...
syshum 7y ago
>>Anything else and your ISP/evil-state-actor is able to to see your DNS traffic in plain-text and you believe CloudFlare is not a "evil state actor" or has not been compromised or never will be compromised by an "evil state actor" Wow your faith in CloudFlare is much much higher than mine Personally I trust my current ISP (which is not one of the big boys) more than I trust CloudFlare. I do not trust cloudflare at all and believe they are the are one of the biggest threats to the future of open web there is today.
- zamalek 7y ago
  Cloudflare aren't the only people running a DoH endpoint