4 ms·

That's what I've figured out too. A while ago I started blocking port 443 to known DoH servers to prevent any machine from internal network bypassing the pihole

by pimeys 6y ago

That's what I've figured out too. A while ago I started blocking port 443 to known DoH servers to prevent any machine from internal network bypassing the pihole. I expect televisions, smart lights and many other IoT devices to start using DoH to be able to track the users with pihole installed...

Datenstrom 6y ago
Is there a comprehensive list to block somewhere? I would like to do the same.
- LinuxBender 6y ago
  Comprehensive, no. There are growing numbers of git repos of DoH names. [1] [2] [1] - https://github.com/bambenek/block-doh https://github.com/bambenek/block-doh [2] - https://github.com/Sekhan/TheGreatWall https://github.com/Sekhan/TheGreatWall
  - deleted 6y ago
    [deleted]
shawnz 6y ago
Do you also block plain old third-party unencrypted DNS servers? Because those could also trivially be used to bypass content filtering on your local resolver, no DoH required. In fact some web appliances like the Chromecast already do exactly this without having to use any kind of technology like DoH. The problem you are describing is nothing to do with DoH, it is simply a consequence of the fact that DNS is not meant to provide access control. It is not an endpoint security management solution.
- LinuxBender 6y ago
  I do. I have always intercepted 53 and 853 and route them to my Unbound DNS recursive server. Unbound caches requests, blocks known malicious domains, then forwards the requests over a vpn mesh to other unbound servers that talk to the root name servers. The weakest link of course is that the root servers do not talk TLS yet. DNSSEC can be useful for zones that are signed.
  - shawnz 6y ago
    Now consider you are visiting a friend's house and you find out they have such a setup on their network... you wouldn't be bothered to learn that all the domain names you visit, even over TLS, are being processed by the homeowner and could be logged?
    - LinuxBender 6y ago
      At a friends house, my laptop will join my private VPN mesh and my DNS lookups will still use my servers. This does assume they allow outbound connectivity to more than 80/443. I have found places that do not allow this. I could run tinc [1] on 443, but if UDP is blocked, the VPN will be slower. That said, in fairness, not everyone sets up their own VPN mesh. Some people use commercial VPN providers. So in that case, it would assume my friend does not block access to that VPN provider. [1] - http://tinc-vpn.org/ http://tinc-vpn.org/
      - shawnz 6y ago
        So, don't you think it would be more hospitable to just allow privacy technologies to be used on your network without forcing your guests to buy a VPN?
        LinuxBender 6y ago
        Maybe so, but that is my choice. It is my home and my network. I can choose to protect my guests and they can choose to get a VPN. I would not subject them to my ISP's DNS, nor would I subject them to centralized DNS. Both are equally dangerous in my view. I would always disclose to my guests what they are using, how to use it and what choices they have. The people implementing DoH in the browser are taking that choice away, so now my only option is to play the never ending game of whack-a-mole with the centralized DoH servers.
        shawnz 6y ago
        I do not think that it is fair to say that changing a default is equivalent to taking a choice away. They are only moving the choice from the network operator's hands directly into the user's hands, which is where I think it belongs (and where it really was in the first place). In the hands of the user whose device is actually establishing the connection. You could block your guest's VPN connections, but you don't do that.. why not? Aren't they subverting your protection by using VPNs? > nor would I subject them to centralized DNS. Both are equally dangerous in my view. I would argue that large providers like Cloudflare are the only ones who realistically have the resources to stand up to threats like government intervention (where it is possible). They have strong legal and financial incentives to maintain their privacy guarantees which smaller providers don't have. Also you have the advantage of your data "hiding in plain sight" due to the high volume they deal with. I certainly wish there were more providers available than just Cloudflare and Google though.

by pimeys 6y ago

Datenstrom 6y ago

Is there a comprehensive list to block somewhere? I would like to do the same.

LinuxBender 6y ago
Comprehensive, no. There are growing numbers of git repos of DoH names. [1] [2] [1] - https://github.com/bambenek/block-doh https://github.com/bambenek/block-doh [2] - https://github.com/Sekhan/TheGreatWall https://github.com/Sekhan/TheGreatWall
- deleted 6y ago
  [deleted]

shawnz 6y ago

Do you also block plain old third-party unencrypted DNS servers? Because those could also trivially be used to bypass content filtering on your local resolver, no DoH required. In fact some web appliances like the Chromecast already do exactly this without having to use any kind of technology like DoH. The problem you are describing is nothing to do with DoH, it is simply a consequence of the fact that DNS is not meant to provide access control. It is not an endpoint security management solution.

LinuxBender 6y ago
I do. I have always intercepted 53 and 853 and route them to my Unbound DNS recursive server. Unbound caches requests, blocks known malicious domains, then forwards the requests over a vpn mesh to other unbound servers that talk to the root name servers. The weakest link of course is that the root servers do not talk TLS yet. DNSSEC can be useful for zones that are signed.
- shawnz 6y ago
  Now consider you are visiting a friend's house and you find out they have such a setup on their network... you wouldn't be bothered to learn that all the domain names you visit, even over TLS, are being processed by the homeowner and could be logged?
  - LinuxBender 6y ago
    At a friends house, my laptop will join my private VPN mesh and my DNS lookups will still use my servers. This does assume they allow outbound connectivity to more than 80/443. I have found places that do not allow this. I could run tinc [1] on 443, but if UDP is blocked, the VPN will be slower. That said, in fairness, not everyone sets up their own VPN mesh. Some people use commercial VPN providers. So in that case, it would assume my friend does not block access to that VPN provider. [1] - http://tinc-vpn.org/ http://tinc-vpn.org/
    - shawnz 6y ago
      So, don't you think it would be more hospitable to just allow privacy technologies to be used on your network without forcing your guests to buy a VPN?
      - LinuxBender 6y ago
        Maybe so, but that is my choice. It is my home and my network. I can choose to protect my guests and they can choose to get a VPN. I would not subject them to my ISP's DNS, nor would I subject them to centralized DNS. Both are equally dangerous in my view. I would always disclose to my guests what they are using, how to use it and what choices they have. The people implementing DoH in the browser are taking that choice away, so now my only option is to play the never ending game of whack-a-mole with the centralized DoH servers.
        shawnz 6y ago
        I do not think that it is fair to say that changing a default is equivalent to taking a choice away. They are only moving the choice from the network operator's hands directly into the user's hands, which is where I think it belongs (and where it really was in the first place). In the hands of the user whose device is actually establishing the connection. You could block your guest's VPN connections, but you don't do that.. why not? Aren't they subverting your protection by using VPNs? > nor would I subject them to centralized DNS. Both are equally dangerous in my view. I would argue that large providers like Cloudflare are the only ones who realistically have the resources to stand up to threats like government intervention (where it is possible). They have strong legal and financial incentives to maintain their privacy guarantees which smaller providers don't have. Also you have the advantage of your data "hiding in plain sight" due to the high volume they deal with. I certainly wish there were more providers available than just Cloudflare and Google though.