5 ms·

DoH does not fix the security issues with DNS. My ISP hijacks it and sends you to a page full of ads when you visit a missing domain just like older DNS. The br

by swiley 6y ago

DoH does not fix the security issues with DNS. My ISP hijacks it and sends you to a page full of ads when you visit a missing domain just like older DNS. The browser vendors even provide explicit instructions for this. Literally all this does is break things.

MaxBarraclough 6y ago
How does your ISP hijack an HTTPS connection? Are you using your ISP's DNS service?
- swiley 6y ago
  They don’t hijack https they hijack DoH. The point behind this is to protect the average user but they’re just going to get the recursive resolver from dhcp. People who bother to use something are the same ones who will tunnel traffic or run their own resolver.
  - MaxBarraclough 6y ago
    > They don’t hijack https they hijack DoH DoH stands for DNS-over-HTTPS. You cannot hijack DoH without hijacking an HTTPS connection. > they’re just going to get the recursive resolver from dhcp In answer to my earlier question then, you're using your ISP's DoH DNS service, correct? If that's the case, there's no hijacking going on. > People who bother to use something are the same ones who will tunnel traffic or run their own resolver. This is the reason Firefox went with CloudFlare's DoH. Resisting ISPs' bullshit is much of the point.
    - withinboredom 6y ago
      > You cannot hijack DoH without hijacking an HTTPS connection. Not true. An ISP can always reroute packets where ever they want. Want to reroute from a trusted resolver to your own, which is bootstrapped over regular DNS? No problem. Client checks it? No problem, it will fallback to regular DNS.
      - MaxBarraclough 6y ago
        > Client checks it? No problem, it will fallback to regular DNS. That's a good point, I'd missed that. I'd hope the browser would show a warning in this case though. I don't imagine there'd be any point redirecting a DoH request rather than just blocking it outright though. No serious DoH implementation is going to fail to check the cert.
      - valenciarose 6y ago
        Unless you have trusted a CA from your ISP, they won't have a valid cert. They can divert the packETS, but their response will be invalid (fail when the client checks the cert).
        MaxBarraclough 6y ago
        I addressed this in my response. You're right that redirection does little more than just blocking the traffic, on account of the certificate check, but if the attacker can force a fallback to regular DNS, that's a problem.
      - tptacek 6y ago
        Every browser DoH implementation checks certificates.
    - swiley 6y ago
      Nope. All you have to do is block the ones the two border vendors use as defaults and you’re back to square one.
      - MaxBarraclough 6y ago
        Right, as withinboredom said. I don't know if ISPs are likely to be so brazen though.

by swiley 6y ago

MaxBarraclough 6y ago

How does your ISP hijack an HTTPS connection? Are you using your ISP's DNS service?

swiley 6y ago
They don’t hijack https they hijack DoH. The point behind this is to protect the average user but they’re just going to get the recursive resolver from dhcp. People who bother to use something are the same ones who will tunnel traffic or run their own resolver.
- MaxBarraclough 6y ago
  > They don’t hijack https they hijack DoH DoH stands for DNS-over-HTTPS. You cannot hijack DoH without hijacking an HTTPS connection. > they’re just going to get the recursive resolver from dhcp In answer to my earlier question then, you're using your ISP's DoH DNS service, correct? If that's the case, there's no hijacking going on. > People who bother to use something are the same ones who will tunnel traffic or run their own resolver. This is the reason Firefox went with CloudFlare's DoH. Resisting ISPs' bullshit is much of the point.
  - withinboredom 6y ago
    > You cannot hijack DoH without hijacking an HTTPS connection. Not true. An ISP can always reroute packets where ever they want. Want to reroute from a trusted resolver to your own, which is bootstrapped over regular DNS? No problem. Client checks it? No problem, it will fallback to regular DNS.
    - MaxBarraclough 6y ago
      > Client checks it? No problem, it will fallback to regular DNS. That's a good point, I'd missed that. I'd hope the browser would show a warning in this case though. I don't imagine there'd be any point redirecting a DoH request rather than just blocking it outright though. No serious DoH implementation is going to fail to check the cert.
    - valenciarose 6y ago
      Unless you have trusted a CA from your ISP, they won't have a valid cert. They can divert the packETS, but their response will be invalid (fail when the client checks the cert).
      - MaxBarraclough 6y ago
        I addressed this in my response. You're right that redirection does little more than just blocking the traffic, on account of the certificate check, but if the attacker can force a fallback to regular DNS, that's a problem.
    - tptacek 6y ago
      Every browser DoH implementation checks certificates.
  - swiley 6y ago
    Nope. All you have to do is block the ones the two border vendors use as defaults and you’re back to square one.
    - MaxBarraclough 6y ago
      Right, as withinboredom said. I don't know if ISPs are likely to be so brazen though.