6 ms·

> To be clear: DoH and/or DoT would have stopped the gathering of DNS query data in this case. It's simple to set up, and it's just a smart thing to do for anyo

by cbg0 6y ago

> To be clear: DoH and/or DoT would have stopped the gathering of DNS query data in this case. It's simple to set up, and it's just a smart thing to do for anyone concerned about their privacy. Actually, for most people that are not technically savvy this is definitely not an easy thing to set up, nor are they even aware that DoH/DoT exist. Unless this feature starts being turned on by default in routers and popular software, the average user's DNS lookups will not be protected.

sirn 6y ago
> Unless this feature starts being turned on by default in routers and popular software Firefox has DoH turned on by default for US-based users. Unfortunately being US-only, it won't protect Thai users just yet. Especially considering the fact that Thai ISPs have known to be hijacking port 53 and NXDOMAIN since forever[1] with ISP in the article being one of the biggest offender. It might also worth nothing that PDPA, Thailand's equivalent of GDPR, is to become in effective in two days (May 27th) so this incident will be... interesting. [1]: Starting in early 2000s, with NIPA (that I never see anybody uses), who aim to provide IDN-enabled Thai domain names by providing NXDOMAIN-hijacking services to ISP
- blitmap 6y ago
  I recently set up a dns-over-https (doh) proxy on my router to forward dns requests to 5 resolvers, that also use dnssec. I wish Firefox would expose the option from about:config in its user-friendly Preferences page so it will respect the "system default" (the advertised dns server). I am - for no legitimate reasons - avoiding Cloudflare as a resolver. As far as I know Firefox uses Cloudflare.
  - encom 6y ago
    Have you been able to find a trustworthy public DoT resolver? I really want to use uncensoreddns.org, but availability has been a little flaky in the past. I'm not sure about Quad9. Google and CloudFlare are obviously out of the question. What else is there?
    - cbg0 6y ago
      > Have you been able to find a trustworthy public DoT resolver? It really depends what you view as being "trustworthy". Outside of the US good enough? Or do you want non 5/9/14-Eyes? (https://en.wikipedia.org/wiki/UKUSA_Agreement#9_Eyes,_14_Eyes,_and_other_%22third_parties%22 https://en.wikipedia.org/wiki/UKUSA_Agreement#9_Eyes,_14_Eye...)
      - encom 6y ago
        Let's start with "not Google-levels of creepy" and work up from there. I want someone who's not harvesting data, or engaging in censorship.
    - fidelramos 6y ago
      Check out this list in privacytools.io: https://www.privacytools.io/providers/dns/ https://www.privacytools.io/providers/dns/
    - nix23 6y ago
      Yes, well i trust this one: DoT: dns.digitale-gesellschaft.ch DoH: dns.digitale-gesellschaft.ch/dns-query Source: https://de.wikipedia.org/wiki/DNS_over_HTTPS https://de.wikipedia.org/wiki/DNS_over_HTTPS https://de.wikipedia.org/wiki/DNS_over_TLS https://de.wikipedia.org/wiki/DNS_over_TLS https://www.digitale-gesellschaft.ch/dns/ https://www.digitale-gesellschaft.ch/dns/ Sorry, for not being available in the en-wiki
      - encom 6y ago
        Hadn't seem them before, very interesting. Vielen dank.
        nix23 6y ago
        Just a year old and located in Zurich,
    - whoopdedo 6y ago
      OpenNIC has a few servers supporting either DoH or DoT or both.
shp0ngle 6y ago
DoH just moves the logging from Thai telecom and moves it to Cloudflare (or, whoever you set up as your DoH server, but most likely Cloudflare), no? I trust CF much more than my ISP, but it makes the potential leak much worse... edit: On the other hand, DoH makes DNS requests independent of ISP, which is nice. ISPs are often monopoly by nature.
- cbg0 6y ago
  Cloudflare has a privacy policy https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver/ https://developers.cloudflare.com/1.1.1.1/privacy/public-dns... Obviously, for Thai users this is a reasonable option, but I would understand why American users would not want to use Cloudflare, Google or even Quad9, as these are all US-based.
  - arminiusreturns 6y ago
    I thought quad9 was UK based?
    - cbg0 6y ago
      Bottom of quad9.net says: HQ 1442 A Walnut Street Suite 501 Berkeley CA 94709
      - arminiusreturns 6y ago
        Aha, figured out I was confused because I read about their membership in the Global Cyber Alliance which includes members such as the London Police and the NYPD. Bonus if you are interested: forum thread where Quad9's director of the board comments about DNS are surprisingly informational. https://www.snbforums.com/threads/cloud9-dns.56918/ https://www.snbforums.com/threads/cloud9-dns.56918/
  - belorn 6y ago
    The netflow data from cloudflare, which is 0.05% of all traffic, is retained for 60 days according do the compliance report. 8.3B log entries is a lot, but I suspect that given how large market share cloudflare has, 0.05% over 60 days is also not a small data set. My intuition with probability calculus make me suspect that given normal internet usage over 60 days, a person is more likely than not to end up in cloudflares netflow log.
nix23 6y ago
Well in Firefox you can turn it on: about:preferences#general >> Network Settings >> Settings...
- koheripbal 6y ago
  Where is the setting in Chrome? It's not on by default in the latest version, and not available in the flags/settings...
swiley 6y ago
Most malicious ISPs disable DoH (ex: Verizon) so it likely wouldn’t have solved this. If you want it solved find a protocol that can be used in the libc resolver and make it ubiquitous rather than goofing around with browser defaults.
- microcolonel 6y ago
  How do they disable DoH? They block TLS over that port?
  - nix23 6y ago
    Thats DoT, DoH ist just a dns query over https(443)
    - microcolonel 6y ago
      Alright, I repeat my question, since it's almost identical: how do they block that? HTTPS starts with opening a TLS socket, how do they reliably determine that they can drop that traffic?
      - cbg0 6y ago
        I don't know if Verizon is actively doing it, but since most providers that offer DoH have well-known IPs, like 8.8.8.8, 1.1.1.1, 9.9.9.9, they could easily just block traffic heading in that direction.
        deleted 6y ago
        [deleted]
        o-__-o 6y ago
        This follows along with what I read, at first it’s easy to block but it’s a losing proposition because anyone can stand up a doh server (which is also a network security nightmare)

by cbg0 6y ago

sirn 6y ago

> Unless this feature starts being turned on by default in routers and popular software Firefox has DoH turned on by default for US-based users. Unfortunately being US-only, it won't protect Thai users just yet. Especially considering the fact that Thai ISPs have known to be hijacking port 53 and NXDOMAIN since forever[1] with ISP in the article being one of the biggest offender. It might also worth nothing that PDPA, Thailand's equivalent of GDPR, is to become in effective in two days (May 27th) so this incident will be... interesting. [1]: Starting in early 2000s, with NIPA (that I never see anybody uses), who aim to provide IDN-enabled Thai domain names by providing NXDOMAIN-hijacking services to ISP

blitmap 6y ago
I recently set up a dns-over-https (doh) proxy on my router to forward dns requests to 5 resolvers, that also use dnssec. I wish Firefox would expose the option from about:config in its user-friendly Preferences page so it will respect the "system default" (the advertised dns server). I am - for no legitimate reasons - avoiding Cloudflare as a resolver. As far as I know Firefox uses Cloudflare.
- encom 6y ago
  Have you been able to find a trustworthy public DoT resolver? I really want to use uncensoreddns.org, but availability has been a little flaky in the past. I'm not sure about Quad9. Google and CloudFlare are obviously out of the question. What else is there?
  - cbg0 6y ago
    > Have you been able to find a trustworthy public DoT resolver? It really depends what you view as being "trustworthy". Outside of the US good enough? Or do you want non 5/9/14-Eyes? (https://en.wikipedia.org/wiki/UKUSA_Agreement#9_Eyes,_14_Eyes,_and_other_%22third_parties%22 https://en.wikipedia.org/wiki/UKUSA_Agreement#9_Eyes,_14_Eye...)
    - encom 6y ago
      Let's start with "not Google-levels of creepy" and work up from there. I want someone who's not harvesting data, or engaging in censorship.
  - fidelramos 6y ago
    Check out this list in privacytools.io: https://www.privacytools.io/providers/dns/ https://www.privacytools.io/providers/dns/
  - nix23 6y ago
    Yes, well i trust this one: DoT: dns.digitale-gesellschaft.ch DoH: dns.digitale-gesellschaft.ch/dns-query Source: https://de.wikipedia.org/wiki/DNS_over_HTTPS https://de.wikipedia.org/wiki/DNS_over_HTTPS https://de.wikipedia.org/wiki/DNS_over_TLS https://de.wikipedia.org/wiki/DNS_over_TLS https://www.digitale-gesellschaft.ch/dns/ https://www.digitale-gesellschaft.ch/dns/ Sorry, for not being available in the en-wiki
    - encom 6y ago
      Hadn't seem them before, very interesting. Vielen dank.
      - nix23 6y ago
        Just a year old and located in Zurich,
  - whoopdedo 6y ago
    OpenNIC has a few servers supporting either DoH or DoT or both.

shp0ngle 6y ago

DoH just moves the logging from Thai telecom and moves it to Cloudflare (or, whoever you set up as your DoH server, but most likely Cloudflare), no? I trust CF much more than my ISP, but it makes the potential leak much worse... edit: On the other hand, DoH makes DNS requests independent of ISP, which is nice. ISPs are often monopoly by nature.

cbg0 6y ago
Cloudflare has a privacy policy https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver/ https://developers.cloudflare.com/1.1.1.1/privacy/public-dns... Obviously, for Thai users this is a reasonable option, but I would understand why American users would not want to use Cloudflare, Google or even Quad9, as these are all US-based.
- arminiusreturns 6y ago
  I thought quad9 was UK based?
  - cbg0 6y ago
    Bottom of quad9.net says: HQ 1442 A Walnut Street Suite 501 Berkeley CA 94709
    - arminiusreturns 6y ago
      Aha, figured out I was confused because I read about their membership in the Global Cyber Alliance which includes members such as the London Police and the NYPD. Bonus if you are interested: forum thread where Quad9's director of the board comments about DNS are surprisingly informational. https://www.snbforums.com/threads/cloud9-dns.56918/ https://www.snbforums.com/threads/cloud9-dns.56918/
- belorn 6y ago
  The netflow data from cloudflare, which is 0.05% of all traffic, is retained for 60 days according do the compliance report. 8.3B log entries is a lot, but I suspect that given how large market share cloudflare has, 0.05% over 60 days is also not a small data set. My intuition with probability calculus make me suspect that given normal internet usage over 60 days, a person is more likely than not to end up in cloudflares netflow log.

nix23 6y ago

Well in Firefox you can turn it on: about:preferences#general >> Network Settings >> Settings...

koheripbal 6y ago
Where is the setting in Chrome? It's not on by default in the latest version, and not available in the flags/settings...

swiley 6y ago

Most malicious ISPs disable DoH (ex: Verizon) so it likely wouldn’t have solved this. If you want it solved find a protocol that can be used in the libc resolver and make it ubiquitous rather than goofing around with browser defaults.

microcolonel 6y ago
How do they disable DoH? They block TLS over that port?
- nix23 6y ago
  Thats DoT, DoH ist just a dns query over https(443)
  - microcolonel 6y ago
    Alright, I repeat my question, since it's almost identical: how do they block that? HTTPS starts with opening a TLS socket, how do they reliably determine that they can drop that traffic?
    - cbg0 6y ago
      I don't know if Verizon is actively doing it, but since most providers that offer DoH have well-known IPs, like 8.8.8.8, 1.1.1.1, 9.9.9.9, they could easily just block traffic heading in that direction.
      - deleted 6y ago
        [deleted]
      - o-__-o 6y ago
        This follows along with what I read, at first it’s easy to block but it’s a losing proposition because anyone can stand up a doh server (which is also a network security nightmare)