3 ms·
> Furthermore, if there’s any hiccup with the DNS-over-HTTPS connection, Chrome will fall back to the regular DNS service of the user’s current provider by defa
by Gaelan 6y ago
> Furthermore, if there’s any hiccup with the DNS-over-HTTPS connection, Chrome will fall back to the regular DNS service of the user’s current provider by default, in order to avoid any disruption, while periodically retrying to secure the DNS communication
Doesn't that make this pretty trivial to defeat? Just drop the DoH packets and boom, you've got unencrypted DNS again.
- jefftk 6y agoIt means you need an active attacker instead of a passive one, so it still does improve security in practice.
- corford 6y agoPretty marginal gains at the expense of eventually centralising most of the world's DNS lookups through a handful of FAANGs.
- peterwwillis 6y agoI think this is phase 1, where phase 2 or 3 is "enabled by default and don't fall back to plain DNS". So it's trivial to defeat until they change a setting. But that's not even the big problem here. The big problem is how big an impact this will be on less-than-perfect networks. The internet feels "snappy" because of DNS's speed and connectionless nature (and a buttload of DNS caching). Once it relies on a connection-oriented protocol, a lot of people's internet experience is going to start sucking badly, and they'll have to modify more of the common internet protocols to make it suck less again.
- new_realist 6y agoWon’t Chrome keep a single connection open for the lifetime of the browser?
- tialaramex 6y agoConveniently DoH servers didn't exist years ago, so any that you're talking to will be new. But new servers have no reason not to implement TLS 1.3, as does Chrome. In TLS 1.3 you can choose to avoid the handshake roundtrip but then you're subject to a replay attack in which any request side effects happen again because your legitimate request was replayed. The bad guys don't get to understand the request or the answer, they just get to perform it, maybe against a different node of a distributed system or in a different timeframe. Conveniently DNS lookups are side effect free so this doesn't matter. So that really cuts down on the potential additional latency compared to even an HTTP GET.
- tptacek 6y agoThe immediate adversary DoH faces down is major US ISPs, most (all?) of whom monetize passive DNS. DoH breaks the tooling ISPs use to track their users. ISPs could escalate, but it would be expensive and legally questionable. In reality, DoH will probably permanently break ISP DNS adtech. There are more exotic adversaries for a DNS lookup system, and against them you'd want something more rigorous than an immediate DNS fallback. But the short-term win is major.
- Gaelan 6y agoTouché. Totally agree that DoH is a win, and "DoH that doesn't protect against some attacks" is more of a win than no DoH that protects against no attacks.