5 ms·

"you should probably also not be using its advertised gateway" Why not? Just make sure to use a VPN/etc to access services over the gateway. I mean, this is t

"you should probably also not be using its advertised gateway" Why not? Just make sure to use a VPN/etc to access services over the gateway. I mean, this is the default case for everything going over the internet. Do you trust every router in the path?

iso1631 6y ago
Fine, then set your own DNS server in your network settings.
- kelnos 6y ago
  How do you know the network you're connected to isn't intercepting DNS requests and returning whatever it wants?
  - gsich 6y ago
    Use DNSSEC.
    - tptacek 6y ago
      DNSSEC doesn't do that at all. DNSSEC does no transaction encryption. It allows full recursive resolvers --- the kind virtually nobody runs on their own machines --- to validate signatures on the tiny minority of domains (virtually none of them among the most popular on the Internet) that have opted in to DNSSEC over the last 10 years. Note that even in the unusual corner case where you're looking up a name that's actually signed with a DNS recursor that actually verifies DNSSEC signatures, the network between you can still snoop on all your DNS requests, because DNSSEC is bad. If you're worried that your network upstream is intercepting your DNS requests (and if you're in the US on a mainstream ISP, you should be), this is the problem DoH is designed to solve, and it does so quite effectively.
      - gsich 6y ago
        DoH does not solve the problem that the resolver can just feed you wrong data. So if you want integrity for your DNS records you need DNSSEC. DoH/DoT does not solve that.
        iso1631 6y ago
        DOH to your trusted resolver which you run yourself (which uses DNSSec upstream) Shame that I have 20 applications on several different users on two dozen different machines to configure
        tptacek 6y ago
        DoH deliberately doesn't touch that problem. In 25 years of work, DNSSEC hasn't put a dent in it --- look at the stats on which zones are signed (and note that most of those signatures are security theater, done automatically by registrars). The fact is that there's nothing you can do to authenticate DNS records, and turning some silly "DNSSEC" feature on in your own stack won't do anything but make you feel better, because DNSSEC simply doesn't have meaningful adoption. However, enabling DoH does in fact immediately protect you from attacks that really do happen, like ISPs monetizing your DNS.
        gsich 6y ago
        >DoH deliberately doesn't touch that problem. Exactly. That's what I said. The problem is that DoH is not the solution, as you just change trust from resolver A to resolver B. With no indication that B is better than A. If you fear that your ISP is selling your data you need to change your ISP. The ISP always know what sites you are accessing, regardless of DNS. DNS might be easier than SNI or IP lookups but the danger is still the same. Right now it might actually help but once encrypted DNS gets enough traction those methods will also adapt. (Assuming that ISPs still do that practice)
        tptacek 6y ago
        It's funny that you've managed simultaneously to argue that DNS monetization (which is ubiquitous) is both a reason to immediately change ISPs, and also not a big deal because ISPs can snoop on you anyways. While I have strong normative beliefs here, I'm mostly just posting descriptively. DNSSEC isn't happening. Enabling DNSSEC in your local configuration won't meaningfully protect you, because you depend on the security teams of large companies to also participate in the system, and DNSSEC has been more or less rejected by the market. Meanwhile: there are specific problems that DoH does protect against, it's easy to roll out, and doesn't depend on the Stripe security team changing their mind about DNSSEC --- so DoH is on a path to become universal, even as DNSSEC whithers. (I invite the curious to test my reporting out with the `host -t ds foo.com` command, for arbitrary values of "foo"). I know I sound like a sore winner about this, and I guess I sort of am, but it is a little alarming that there are still currents of sysadmin wisdom telling people to go out of their way to opt into DNSSEC, in the belief that it will somehow protect them from any kind of real attack. In reality: corrupted DNS records overwhelmingly come from phished registrar accounts, not the elaborate, geographically-specific DNS cache corruption attacks DNSSEC was envisaged to deal with. I think it's worth being plain with people about this stuff.
  - iso1631 6y ago
    Set your OS to use your DOH server of choice. Personally when my laptop is connected to a network on a high latency link to the internet, I'd rather it used the local caching server rather than one half a continent away. Clearly if I don't trust that network provided DNS server I'll tunnel everything out to a trusted network, or I could specify a DOH. I have no practical issue with DOH if it were implemented at the OS level and had standards around how to distribute recommended settings (just like my dhcp server distributes a recommended gateway, recommended ntp server, recommended tftp boot server, etc).
johannes1234321 6y ago
Then you need to know your VPN's endpoint's IP address and can take DNS info from your VPN's config.

iso1631 6y ago

Fine, then set your own DNS server in your network settings.

kelnos 6y ago
How do you know the network you're connected to isn't intercepting DNS requests and returning whatever it wants?
- gsich 6y ago
  Use DNSSEC.
  - tptacek 6y ago
    DNSSEC doesn't do that at all. DNSSEC does no transaction encryption. It allows full recursive resolvers --- the kind virtually nobody runs on their own machines --- to validate signatures on the tiny minority of domains (virtually none of them among the most popular on the Internet) that have opted in to DNSSEC over the last 10 years. Note that even in the unusual corner case where you're looking up a name that's actually signed with a DNS recursor that actually verifies DNSSEC signatures, the network between you can still snoop on all your DNS requests, because DNSSEC is bad. If you're worried that your network upstream is intercepting your DNS requests (and if you're in the US on a mainstream ISP, you should be), this is the problem DoH is designed to solve, and it does so quite effectively.
    - gsich 6y ago
      DoH does not solve the problem that the resolver can just feed you wrong data. So if you want integrity for your DNS records you need DNSSEC. DoH/DoT does not solve that.
      - iso1631 6y ago
        DOH to your trusted resolver which you run yourself (which uses DNSSec upstream) Shame that I have 20 applications on several different users on two dozen different machines to configure
      - tptacek 6y ago
        DoH deliberately doesn't touch that problem. In 25 years of work, DNSSEC hasn't put a dent in it --- look at the stats on which zones are signed (and note that most of those signatures are security theater, done automatically by registrars). The fact is that there's nothing you can do to authenticate DNS records, and turning some silly "DNSSEC" feature on in your own stack won't do anything but make you feel better, because DNSSEC simply doesn't have meaningful adoption. However, enabling DoH does in fact immediately protect you from attacks that really do happen, like ISPs monetizing your DNS.
        gsich 6y ago
        >DoH deliberately doesn't touch that problem. Exactly. That's what I said. The problem is that DoH is not the solution, as you just change trust from resolver A to resolver B. With no indication that B is better than A. If you fear that your ISP is selling your data you need to change your ISP. The ISP always know what sites you are accessing, regardless of DNS. DNS might be easier than SNI or IP lookups but the danger is still the same. Right now it might actually help but once encrypted DNS gets enough traction those methods will also adapt. (Assuming that ISPs still do that practice)
        tptacek 6y ago
        It's funny that you've managed simultaneously to argue that DNS monetization (which is ubiquitous) is both a reason to immediately change ISPs, and also not a big deal because ISPs can snoop on you anyways. While I have strong normative beliefs here, I'm mostly just posting descriptively. DNSSEC isn't happening. Enabling DNSSEC in your local configuration won't meaningfully protect you, because you depend on the security teams of large companies to also participate in the system, and DNSSEC has been more or less rejected by the market. Meanwhile: there are specific problems that DoH does protect against, it's easy to roll out, and doesn't depend on the Stripe security team changing their mind about DNSSEC --- so DoH is on a path to become universal, even as DNSSEC whithers. (I invite the curious to test my reporting out with the `host -t ds foo.com` command, for arbitrary values of "foo"). I know I sound like a sore winner about this, and I guess I sort of am, but it is a little alarming that there are still currents of sysadmin wisdom telling people to go out of their way to opt into DNSSEC, in the belief that it will somehow protect them from any kind of real attack. In reality: corrupted DNS records overwhelmingly come from phished registrar accounts, not the elaborate, geographically-specific DNS cache corruption attacks DNSSEC was envisaged to deal with. I think it's worth being plain with people about this stuff.
- iso1631 6y ago
  Set your OS to use your DOH server of choice. Personally when my laptop is connected to a network on a high latency link to the internet, I'd rather it used the local caching server rather than one half a continent away. Clearly if I don't trust that network provided DNS server I'll tunnel everything out to a trusted network, or I could specify a DOH. I have no practical issue with DOH if it were implemented at the OS level and had standards around how to distribute recommended settings (just like my dhcp server distributes a recommended gateway, recommended ntp server, recommended tftp boot server, etc).

johannes1234321 6y ago

Then you need to know your VPN's endpoint's IP address and can take DNS info from your VPN's config.