6 ms·

That’s annoying yet pretty predictable, at least we’ve still got https://pi-hole.net/ https://pi-hole.net/ as an option until DNS encryption becomes widespread

That’s annoying yet pretty predictable, at least we’ve still got https://pi-hole.net/ https://pi-hole.net/ as an option until DNS encryption becomes widespread :/

buzzerbetrayed 6y ago
Not a pi-hole user, but what is the plan for pi-hole once encrypted dns is everywhere? Will it just be dead? I can’t really think of a way for it not to be.
- blacksmith_tb 6y ago
  Couldn't you host pi-hole on a cheap VM and set it to be your DNS-over-TLS / DNS-over-HTTPS endpoint?
  - Skunkleton 6y ago
    This assumes that your software is doing what you asked it to do, not what some bigco or malware wanted it to do.
    - silon42 6y ago
      firewall anything that doesn't go through your DNS server... at least thay way the malware will be obviously detectable.
      - Spivak 6y ago
        But DoH is just any other HTTP request. This is the downside of networks blocking everything except 80/443 outbound and browsers not supporting SRV records.
    - goatinaboat 6y ago
      If I remember correctly Chrome already ignores your DNS and does it’s own over HTTPS.
      - Xylakant 6y ago
        I think you're misremembering. This is the most official documentation of the rollout plan for DoH that I can quickly ddg: https://www.chromium.org/developers/dns-over-https https://www.chromium.org/developers/dns-over-https - in a gist: If the systems resolver is known to support DoH, the DNS query will get upgraded to DoH. That means chrome will still be using the configured systems resolver, but the connection will be encrypted. I think you're remembering what firefox is rolling out: Firefox will by default, if DoH is enabled for your country by default use a specific provider that subjects to additional privacy controls. However, firefox respects network level settings (for example a specific canary domain that should resolve) and will disable DoH, even if the default is enabled - unless again, the user has overwritten that in a setting. That means that the network owner is still in full control of the network-wide default and PiHole supports this approach. So a stock firefox in a network that uses pi-hole will not use DoH.
        goatinaboat 6y ago
        Thanks for clarifying that!
- 0xCMP 6y ago
  You can always reconfigure your DNS. It's important feature so unlikely they'll get rid of that.
- Skunkleton 6y ago
  DoT isn't a big problem for a pihole, but it doesn't look like things are going that way. DoH can only be blocked by a mitm proxy. You would have to take a pretty serious security hit to do something like that with a pihole.
  - OJFord 6y ago
    Wouldn't pi-hole be the 'resolver' the other end of the request, the party it's encrypted for? Sure, Apple (or whoever) could just bypass it and use something specific, but can already just use an IP, no DNS anyway?
    - Macha 6y ago
      My understanding is the concern would be that closed source applications would use a hardcoded DoH resolver and pinned certs to bypass any unwanted blocks of ads/telemetry which could only be resolved with decompilation and patching with varying degrees of difficulty.
      - gsnedders 6y ago
        Is this much more of a concern than closed source applications that use open DNS but use pinned certs to connect to the resolved host?
      - ardy42 6y ago
        > My understanding is the concern would be that closed source applications would use a hardcoded DoH resolver and pinned certs to bypass any unwanted blocks of ads/telemetry which could only be resolved with decompilation and patching with varying degrees of difficulty. IIRC, the vision with DoH is that eventually even browsers would do DNS as part of a bunch of pipelined HTTP requests. So you call up https://www.example.com/page.html https://www.example.com/page.html and www.example.com resolves img.example.com for you since it's used on the page. The downside is www.example.com could also resolve tracker.adnetwork.com for you, too. IIRC, DoH is there to defeat MITM attacks, but stuff like Pi-Hole is basically a MITM attack, so it's kinda collateral damage. I bet network-level ad-blocking will eventually have to evolve into literal firewall rules on the gateway.
- dwrodri 6y ago
  The pi-hole software turns the Raspberry Pi into a DNS server, so you can point your own DNS server (i.e. the raspberry pi) at the DNS provider of your choosing so that it can resolve uncached queries. I don't think encryption matters because you control the sender (your PC), the first hop (the pi-hole), and the next resolution destination (Cloudflare/Quad9/Google/OpenDNS/etc.).
  - novok 6y ago
    He is referring to the fact that apps will start ignoring local network DNS config and directly talk to their own hard coded DNS IPs. I'm guessing the solution to that is to firewall various DNS IPs to force the app to use your local DNS. I could forsee apps going to random IPs for DNS and making it look like https, which will be hard to deal with.
    - toast0 6y ago
      > I could forsee apps going to random IPs for DNS and making it look like https, which will be hard to deal with. DoH isn't really going to look like https, the requests and responses are going to be too small. If you're serious about it, you don't allow any random IP connections, only allow connections to IPs that were received by DNS, and only return proxy addresses that you NAT to the real thing. It's more work, but it's still trivial.
      - ignoramous 6y ago
        > ...only allow connections to IPs that were received by DNS Works for a home / office setup. I think the main use of DoH is circumventing government enforced censorships, to an extent that it can. For ISPs to use "packet sizes" they'd need to run stateful firewalls at scale, which is unheard of, and possibly very expensive to run at that scale.
- skykooler 6y ago
  You could have it spoof the keys and add its keys to your OS's key store.
  - layoutIfNeeded 6y ago
    >add its keys to your OS's key store What key store? User-hostile apps (like Chrome) already use their own key store because they know better than the user :^)
- Spivak 6y ago
  You use your pi-hole as your encrypted DNS provider?
  - buzzerbetrayed 6y ago
    > Not a pi-hole user
- rsync 6y ago
  Here is what I did ... First, I created my own recursive resolver in the cloud using 'unbound'. You can do this quickly and easily with an EC2 instance or whatever (mine is a FreeBSD jail on my own server). Second, I got a paid nextdns.io account and enabled the basic blocklists which are, essentially, the same as ublock origin would have locally. Third, I set my recursive resolver to use the nextdns.io endpoint as its upstream source of DNS. Finally, I set all of my networks to assign my personal DNS server (and no others) for all DHCP requests and I hardcoded it into my own machines. So now I control my own dns, globally, and my upstream source of name resolution is "sanitized". Theoretically, I could just remove ublock origin from my browsers now ... Then I
  - ignoramous 6y ago
    > Third, I set my recursive resolver to use the nextdns.io endpoint as its upstream source of DNS. Doesn't that relegate your recursive resolver to a stub? You could run pi-hole on fly.io for free if DoT/DoH is all you need: https://fly.io/blog/stuff-your-pi-hole-from-anywhere/ https://fly.io/blog/stuff-your-pi-hole-from-anywhere/ I run a public DoH resolver with 170+ blocklists on Cloudflare Workers. Might open source it soon.
    - dhaavi 6y ago
      Nice. Do you have any more info on that resolver of yours?
      - deleted 6y ago
        [deleted]
      - deleted 6y ago
        [deleted]
anonymousisme 6y ago
I don't see how pi-hole get affected by DNS via https, unless you are leaving out the part about computers, tablets, and phones using hard-coded DNS servers that use DNS via https. This is a trend, but a very small one right now.
- throwaway2048 6y ago
  You are confusing DNSSEC and DoT/DoH, DNSSEC is not encrypted.
- fanf2 6y ago
  DNSSEC does not do encryption: DNSSEC is about data origin authentication. Encrypted DNS is DoT or DoH, DNS-over-TLS or DNS-over-HTTPS (and maybe in the future DoQ, DNS-over-QUIC)
  - anonymousisme 6y ago
    Of course. I knew what I meant, but used the wrong word.
m463 6y ago
Easy to bypass. Apple will just talk directly to 17.x.y.z or akamai.
heavyset_go 6y ago
I've been using network-level ad blocking with software like Pi Hole for a while now. According to the stats, about a year ago, I used to block around ~40% of traffic via DNS. Recently, it's only about ~10% of traffic that gets blocked. Despite disabling application-level DoH in favor of network-level DoH on every device and app I could, I suspect streaming devices and various Android apps are using DoH at the application-level and are bypassing my DNS entirely.

That’s annoying yet pretty predictable, at least we’ve still got https://pi-hole.net/ https://pi-hole.net/ as an option until DNS encryption becomes widespread :/

buzzerbetrayed 6y ago

Not a pi-hole user, but what is the plan for pi-hole once encrypted dns is everywhere? Will it just be dead? I can’t really think of a way for it not to be.

blacksmith_tb 6y ago
Couldn't you host pi-hole on a cheap VM and set it to be your DNS-over-TLS / DNS-over-HTTPS endpoint?
- Skunkleton 6y ago
  This assumes that your software is doing what you asked it to do, not what some bigco or malware wanted it to do.
  - silon42 6y ago
    firewall anything that doesn't go through your DNS server... at least thay way the malware will be obviously detectable.
    - Spivak 6y ago
      But DoH is just any other HTTP request. This is the downside of networks blocking everything except 80/443 outbound and browsers not supporting SRV records.
  - goatinaboat 6y ago
    If I remember correctly Chrome already ignores your DNS and does it’s own over HTTPS.
    - Xylakant 6y ago
      I think you're misremembering. This is the most official documentation of the rollout plan for DoH that I can quickly ddg: https://www.chromium.org/developers/dns-over-https https://www.chromium.org/developers/dns-over-https - in a gist: If the systems resolver is known to support DoH, the DNS query will get upgraded to DoH. That means chrome will still be using the configured systems resolver, but the connection will be encrypted. I think you're remembering what firefox is rolling out: Firefox will by default, if DoH is enabled for your country by default use a specific provider that subjects to additional privacy controls. However, firefox respects network level settings (for example a specific canary domain that should resolve) and will disable DoH, even if the default is enabled - unless again, the user has overwritten that in a setting. That means that the network owner is still in full control of the network-wide default and PiHole supports this approach. So a stock firefox in a network that uses pi-hole will not use DoH.
      - goatinaboat 6y ago
        Thanks for clarifying that!
0xCMP 6y ago
You can always reconfigure your DNS. It's important feature so unlikely they'll get rid of that.
Skunkleton 6y ago
DoT isn't a big problem for a pihole, but it doesn't look like things are going that way. DoH can only be blocked by a mitm proxy. You would have to take a pretty serious security hit to do something like that with a pihole.
- OJFord 6y ago
  Wouldn't pi-hole be the 'resolver' the other end of the request, the party it's encrypted for? Sure, Apple (or whoever) could just bypass it and use something specific, but can already just use an IP, no DNS anyway?
  - Macha 6y ago
    My understanding is the concern would be that closed source applications would use a hardcoded DoH resolver and pinned certs to bypass any unwanted blocks of ads/telemetry which could only be resolved with decompilation and patching with varying degrees of difficulty.
    - gsnedders 6y ago
      Is this much more of a concern than closed source applications that use open DNS but use pinned certs to connect to the resolved host?
    - ardy42 6y ago
      > My understanding is the concern would be that closed source applications would use a hardcoded DoH resolver and pinned certs to bypass any unwanted blocks of ads/telemetry which could only be resolved with decompilation and patching with varying degrees of difficulty. IIRC, the vision with DoH is that eventually even browsers would do DNS as part of a bunch of pipelined HTTP requests. So you call up https://www.example.com/page.html https://www.example.com/page.html and www.example.com resolves img.example.com for you since it's used on the page. The downside is www.example.com could also resolve tracker.adnetwork.com for you, too. IIRC, DoH is there to defeat MITM attacks, but stuff like Pi-Hole is basically a MITM attack, so it's kinda collateral damage. I bet network-level ad-blocking will eventually have to evolve into literal firewall rules on the gateway.
dwrodri 6y ago
The pi-hole software turns the Raspberry Pi into a DNS server, so you can point your own DNS server (i.e. the raspberry pi) at the DNS provider of your choosing so that it can resolve uncached queries. I don't think encryption matters because you control the sender (your PC), the first hop (the pi-hole), and the next resolution destination (Cloudflare/Quad9/Google/OpenDNS/etc.).
- novok 6y ago
  He is referring to the fact that apps will start ignoring local network DNS config and directly talk to their own hard coded DNS IPs. I'm guessing the solution to that is to firewall various DNS IPs to force the app to use your local DNS. I could forsee apps going to random IPs for DNS and making it look like https, which will be hard to deal with.
  - toast0 6y ago
    > I could forsee apps going to random IPs for DNS and making it look like https, which will be hard to deal with. DoH isn't really going to look like https, the requests and responses are going to be too small. If you're serious about it, you don't allow any random IP connections, only allow connections to IPs that were received by DNS, and only return proxy addresses that you NAT to the real thing. It's more work, but it's still trivial.
    - ignoramous 6y ago
      > ...only allow connections to IPs that were received by DNS Works for a home / office setup. I think the main use of DoH is circumventing government enforced censorships, to an extent that it can. For ISPs to use "packet sizes" they'd need to run stateful firewalls at scale, which is unheard of, and possibly very expensive to run at that scale.
skykooler 6y ago
You could have it spoof the keys and add its keys to your OS's key store.
- layoutIfNeeded 6y ago
  >add its keys to your OS's key store What key store? User-hostile apps (like Chrome) already use their own key store because they know better than the user :^)
Spivak 6y ago
You use your pi-hole as your encrypted DNS provider?
- buzzerbetrayed 6y ago
  > Not a pi-hole user
rsync 6y ago
Here is what I did ... First, I created my own recursive resolver in the cloud using 'unbound'. You can do this quickly and easily with an EC2 instance or whatever (mine is a FreeBSD jail on my own server). Second, I got a paid nextdns.io account and enabled the basic blocklists which are, essentially, the same as ublock origin would have locally. Third, I set my recursive resolver to use the nextdns.io endpoint as its upstream source of DNS. Finally, I set all of my networks to assign my personal DNS server (and no others) for all DHCP requests and I hardcoded it into my own machines. So now I control my own dns, globally, and my upstream source of name resolution is "sanitized". Theoretically, I could just remove ublock origin from my browsers now ... Then I
- ignoramous 6y ago
  > Third, I set my recursive resolver to use the nextdns.io endpoint as its upstream source of DNS. Doesn't that relegate your recursive resolver to a stub? You could run pi-hole on fly.io for free if DoT/DoH is all you need: https://fly.io/blog/stuff-your-pi-hole-from-anywhere/ https://fly.io/blog/stuff-your-pi-hole-from-anywhere/ I run a public DoH resolver with 170+ blocklists on Cloudflare Workers. Might open source it soon.
  - dhaavi 6y ago
    Nice. Do you have any more info on that resolver of yours?
    - deleted 6y ago
      [deleted]
    - deleted 6y ago
      [deleted]

anonymousisme 6y ago

I don't see how pi-hole get affected by DNS via https, unless you are leaving out the part about computers, tablets, and phones using hard-coded DNS servers that use DNS via https. This is a trend, but a very small one right now.

throwaway2048 6y ago
You are confusing DNSSEC and DoT/DoH, DNSSEC is not encrypted.
fanf2 6y ago
DNSSEC does not do encryption: DNSSEC is about data origin authentication. Encrypted DNS is DoT or DoH, DNS-over-TLS or DNS-over-HTTPS (and maybe in the future DoQ, DNS-over-QUIC)
- anonymousisme 6y ago
  Of course. I knew what I meant, but used the wrong word.

m463 6y ago

Easy to bypass. Apple will just talk directly to 17.x.y.z or akamai.

heavyset_go 6y ago

I've been using network-level ad blocking with software like Pi Hole for a while now. According to the stats, about a year ago, I used to block around ~40% of traffic via DNS. Recently, it's only about ~10% of traffic that gets blocked. Despite disabling application-level DoH in favor of network-level DoH on every device and app I could, I suspect streaming devices and various Android apps are using DoH at the application-level and are bypassing my DNS entirely.