4 ms·

Encrypting the SNI is probably a good idea. According to Wikipedia one Russian ISP and China has already blocked ESNI'ed connections, which is probably a good s

Encrypting the SNI is probably a good idea. According to Wikipedia one Russian ISP and China has already blocked ESNI'ed connections, which is probably a good sign that it's doing something. But still, it feels like such a hack throwing this into the DNS records. A mess for server operators to implement if you don't manage your DNS records via an API today (since they'll need to be changed when certs rotate). And I'm guessing that a wast majority of people use the ISP default DNS (or Google/Cloudflare), that brings plenty of privacy problems on its own... Maybe ESNI/ECO is really worth the hassle in a future where the whole Oblivious DNS-thing[0] is widely spread. [0] Someone like Apple would proxy your encrypted (DoH) DNS requests to Cloudflare, so neither Cloudflare nor Apple can see what a specific user is querying

pas 6y ago
There's no obvious place to put it. Conjuring up CertificateTransparency-like public notaries might work, but who would run them? It would basically have the exact same operational requirements as DNS resolvers. Plus DNS is already "inlined" to the process. This suffers from the same problem as the v4-v6 migration. There's simply no good way to solve it other than biting the bullet and laying the new v6 pipes. (Though this is a bit easier, but getting DNSSEC off the ground, the root signed, getting root rollover worked out ... all of that like v6 deployment took more than a decade, and it's just getting mainstream.)
- filleokus 6y ago
  True. I'm just saying that it's a lot of work for a pretty small improvement (as the world looks today). But maybe I'm incorrect, maybe this would solve real world problems today? I'm just thinking that if you don't have encrypted DNS queries, your basically still revealing similar info (at least on first/uncached connections). If you use DoT to your ISP, they will have similar info. If you use DoH to Google/Cloudflare, they will have similar info. How big is the privacy gain over cleartext SNI on first connection + client side caching of certs and encrypted SNI on later connections? Obviously it depends on your threat model, this + DoH/DoT to someone you trust would protect from plenty of things in an environment where a passive attacker can see your network traffic. But the question is who to trust...
  - pas 6y ago
    It's a long term investment. And it helps especially big sites. It's kind of the new RSA/AES/SSL hype (SSL 3.0 released in 1996, IE shipped with Win95 already supported SSL 2, then Win98SE shipped IE 4.01 if I remember correctly, and ... people were amazed. Ecommerce was all the rage, and boom, dot-com boom.) But it's hopefully done properly this time. :) It's the next logical step. There's no rush to implement it, even if it's nice and shiny. Both Firefox and Chrome already has built-in support for DoH. So encrypted DNS is already getting taken care of. There are an increasing number of providers to choose from: https://github.com/curl/curl/wiki/DNS-over-HTTPS https://github.com/curl/curl/wiki/DNS-over-HTTPS And rolling your own is always an option. Info leak, trust a 3rd party, invest your time, pick your poison :) I think the infoleak is not that serious, because in most cases a passive observer will have the IPs you connect to, and currently it's pretty easy to just enumerate the IPs of the "top 1 million websites" (I have no idea if anyone on Earth still uses the Alexa toolbar at all, or if it exists at all, but that list seems eternal somehow). This is basically where the hiding in the noise strategy is made possible "thanks" to CDNs. If there are thousands of sites all hosted on a handful of IPs then correlating who views what is getting increasingly harder. We shall see if this kind of slow but steady activism helps with government censorship on the long term or not.

pas 6y ago

There's no obvious place to put it. Conjuring up CertificateTransparency-like public notaries might work, but who would run them? It would basically have the exact same operational requirements as DNS resolvers. Plus DNS is already "inlined" to the process. This suffers from the same problem as the v4-v6 migration. There's simply no good way to solve it other than biting the bullet and laying the new v6 pipes. (Though this is a bit easier, but getting DNSSEC off the ground, the root signed, getting root rollover worked out ... all of that like v6 deployment took more than a decade, and it's just getting mainstream.)

filleokus 6y ago
True. I'm just saying that it's a lot of work for a pretty small improvement (as the world looks today). But maybe I'm incorrect, maybe this would solve real world problems today? I'm just thinking that if you don't have encrypted DNS queries, your basically still revealing similar info (at least on first/uncached connections). If you use DoT to your ISP, they will have similar info. If you use DoH to Google/Cloudflare, they will have similar info. How big is the privacy gain over cleartext SNI on first connection + client side caching of certs and encrypted SNI on later connections? Obviously it depends on your threat model, this + DoH/DoT to someone you trust would protect from plenty of things in an environment where a passive attacker can see your network traffic. But the question is who to trust...
- pas 6y ago
  It's a long term investment. And it helps especially big sites. It's kind of the new RSA/AES/SSL hype (SSL 3.0 released in 1996, IE shipped with Win95 already supported SSL 2, then Win98SE shipped IE 4.01 if I remember correctly, and ... people were amazed. Ecommerce was all the rage, and boom, dot-com boom.) But it's hopefully done properly this time. :) It's the next logical step. There's no rush to implement it, even if it's nice and shiny. Both Firefox and Chrome already has built-in support for DoH. So encrypted DNS is already getting taken care of. There are an increasing number of providers to choose from: https://github.com/curl/curl/wiki/DNS-over-HTTPS https://github.com/curl/curl/wiki/DNS-over-HTTPS And rolling your own is always an option. Info leak, trust a 3rd party, invest your time, pick your poison :) I think the infoleak is not that serious, because in most cases a passive observer will have the IPs you connect to, and currently it's pretty easy to just enumerate the IPs of the "top 1 million websites" (I have no idea if anyone on Earth still uses the Alexa toolbar at all, or if it exists at all, but that list seems eternal somehow). This is basically where the hiding in the noise strategy is made possible "thanks" to CDNs. If there are thousands of sites all hosted on a handful of IPs then correlating who views what is getting increasingly harder. We shall see if this kind of slow but steady activism helps with government censorship on the long term or not.