4 ms·

>DoH deliberately doesn't touch that problem. Exactly. That's what I said. The problem is that DoH is not the solution, as you just change trust from resolver

by gsich 6y ago

>DoH deliberately doesn't touch that problem. Exactly. That's what I said. The problem is that DoH is not the solution, as you just change trust from resolver A to resolver B. With no indication that B is better than A. If you fear that your ISP is selling your data you need to change your ISP. The ISP always know what sites you are accessing, regardless of DNS. DNS might be easier than SNI or IP lookups but the danger is still the same. Right now it might actually help but once encrypted DNS gets enough traction those methods will also adapt. (Assuming that ISPs still do that practice)

tptacek 6y ago
It's funny that you've managed simultaneously to argue that DNS monetization (which is ubiquitous) is both a reason to immediately change ISPs, and also not a big deal because ISPs can snoop on you anyways. While I have strong normative beliefs here, I'm mostly just posting descriptively. DNSSEC isn't happening. Enabling DNSSEC in your local configuration won't meaningfully protect you, because you depend on the security teams of large companies to also participate in the system, and DNSSEC has been more or less rejected by the market. Meanwhile: there are specific problems that DoH does protect against, it's easy to roll out, and doesn't depend on the Stripe security team changing their mind about DNSSEC --- so DoH is on a path to become universal, even as DNSSEC whithers. (I invite the curious to test my reporting out with the `host -t ds foo.com` command, for arbitrary values of "foo"). I know I sound like a sore winner about this, and I guess I sort of am, but it is a little alarming that there are still currents of sysadmin wisdom telling people to go out of their way to opt into DNSSEC, in the belief that it will somehow protect them from any kind of real attack. In reality: corrupted DNS records overwhelmingly come from phished registrar accounts, not the elaborate, geographically-specific DNS cache corruption attacks DNSSEC was envisaged to deal with. I think it's worth being plain with people about this stuff.
- gsich 6y ago
  >It's funny that you've managed simultaneously to argue that DNS monetization (which is ubiquitous) is both a reason to immediately change ISPs, and also not a big deal because ISPs can snoop on you anyways. Of course. If you know that your ISP is doing that, you change to one that is not doing it. It's not ubiquitous. Besides that, what makes you think that your DoH provider (if not your ISP) is also not selling that data? You think that DoH/DoT is somewhat a replacement for DNSSEC but it's not. Both are independent. Doesn't matter how much domains have it.
  - akerl_ 6y ago
    How do I know if my ISP is doing that? And which ISP do I change to? Where I live, there’s effectively a single available ISP unless I don’t mind dropping down to single digit mbps. Seems more plausible to just run DoH for my DNS and then not worry about my ISP snooping on my DNS requests.

by gsich 6y ago

tptacek 6y ago

It's funny that you've managed simultaneously to argue that DNS monetization (which is ubiquitous) is both a reason to immediately change ISPs, and also not a big deal because ISPs can snoop on you anyways. While I have strong normative beliefs here, I'm mostly just posting descriptively. DNSSEC isn't happening. Enabling DNSSEC in your local configuration won't meaningfully protect you, because you depend on the security teams of large companies to also participate in the system, and DNSSEC has been more or less rejected by the market. Meanwhile: there are specific problems that DoH does protect against, it's easy to roll out, and doesn't depend on the Stripe security team changing their mind about DNSSEC --- so DoH is on a path to become universal, even as DNSSEC whithers. (I invite the curious to test my reporting out with the `host -t ds foo.com` command, for arbitrary values of "foo"). I know I sound like a sore winner about this, and I guess I sort of am, but it is a little alarming that there are still currents of sysadmin wisdom telling people to go out of their way to opt into DNSSEC, in the belief that it will somehow protect them from any kind of real attack. In reality: corrupted DNS records overwhelmingly come from phished registrar accounts, not the elaborate, geographically-specific DNS cache corruption attacks DNSSEC was envisaged to deal with. I think it's worth being plain with people about this stuff.

gsich 6y ago
>It's funny that you've managed simultaneously to argue that DNS monetization (which is ubiquitous) is both a reason to immediately change ISPs, and also not a big deal because ISPs can snoop on you anyways. Of course. If you know that your ISP is doing that, you change to one that is not doing it. It's not ubiquitous. Besides that, what makes you think that your DoH provider (if not your ISP) is also not selling that data? You think that DoH/DoT is somewhat a replacement for DNSSEC but it's not. Both are independent. Doesn't matter how much domains have it.
- akerl_ 6y ago
  How do I know if my ISP is doing that? And which ISP do I change to? Where I live, there’s effectively a single available ISP unless I don’t mind dropping down to single digit mbps. Seems more plausible to just run DoH for my DNS and then not worry about my ISP snooping on my DNS requests.