3 ms·

You can set a canary domain which currently is used The only other way would be MITM all https traffic and sign with your own certificate, but many iot devices

by iso947 6y ago

You can set a canary domain which currently is used The only other way would be MITM all https traffic and sign with your own certificate, but many iot devices won’t allow you to install a new certificate store.

mulmen 6y ago
I don’t know what a canary domain is. That reddit post isn’t entirely clear but it seems to be some kind of DNS black hole. That would rely on the application using your config. Will a canary domain on an edge device prevent my smart TV from using DoH to get the IP of a tracking server?
- iso947 6y ago
  https://support.mozilla.org/en-US/kb/canary-domain-use-application-dnsnet https://support.mozilla.org/en-US/kb/canary-domain-use-appli... If your smart tv checks to see if it should disable DOH then it would work. I wouldn’t bank on it doing so though. Best to block all iot devices.
  - mulmen 6y ago
    Thanks for clarifying. This only helps for well-behaved applications and is apparently temporary. > The use of this domain is specified by Mozilla, as a limited-time measure until a method for signaling the presence of DNS-based content filtering is defined and adopted by an Internet standards body. More than anything I am disappointed in Mozilla for shipping such a half-baked anti-feature. I can't even trust Firefox to do the right thing anymore.
    - iso947 6y ago
      It’s a temporary feature until there’s a standard to replace it. Intimately DoH isn’t needed to make IoT transparent, an IoT device can establish a TLS tunnel to a CDN, and unless that’s blocked you have no way of knowing what is being sent where. An in-line https proxy is the only solution, if iot devices fail to check certificates (which wouldn’t surprise me) If they do check, and you can’t provide your our root, then you can’t trust them. Read GNU manifesto and realise why it’s important. I am conflicted over DoH. As an end user I want to be protected against rogue networks - especially in hotels. As a network admin I want to be protected against rogue end devices. As both I want to be able to deploy split dns servers due to Nat, not to force users (including me), but to don’t to them where to go. DoH should have been implemented at the OS level and driven by DHCP unless overridden, as with normal DNS.

by iso947 6y ago

mulmen 6y ago

I don’t know what a canary domain is. That reddit post isn’t entirely clear but it seems to be some kind of DNS black hole. That would rely on the application using your config. Will a canary domain on an edge device prevent my smart TV from using DoH to get the IP of a tracking server?

iso947 6y ago
https://support.mozilla.org/en-US/kb/canary-domain-use-application-dnsnet https://support.mozilla.org/en-US/kb/canary-domain-use-appli... If your smart tv checks to see if it should disable DOH then it would work. I wouldn’t bank on it doing so though. Best to block all iot devices.
- mulmen 6y ago
  Thanks for clarifying. This only helps for well-behaved applications and is apparently temporary. > The use of this domain is specified by Mozilla, as a limited-time measure until a method for signaling the presence of DNS-based content filtering is defined and adopted by an Internet standards body. More than anything I am disappointed in Mozilla for shipping such a half-baked anti-feature. I can't even trust Firefox to do the right thing anymore.
  - iso947 6y ago
    It’s a temporary feature until there’s a standard to replace it. Intimately DoH isn’t needed to make IoT transparent, an IoT device can establish a TLS tunnel to a CDN, and unless that’s blocked you have no way of knowing what is being sent where. An in-line https proxy is the only solution, if iot devices fail to check certificates (which wouldn’t surprise me) If they do check, and you can’t provide your our root, then you can’t trust them. Read GNU manifesto and realise why it’s important. I am conflicted over DoH. As an end user I want to be protected against rogue networks - especially in hotels. As a network admin I want to be protected against rogue end devices. As both I want to be able to deploy split dns servers due to Nat, not to force users (including me), but to don’t to them where to go. DoH should have been implemented at the OS level and driven by DHCP unless overridden, as with normal DNS.