6 ms·

> There's a lot of lament that this bypasses the operating system level config, but I feel like we wouldn't be here if the operating system had stepped up their

> There's a lot of lament that this bypasses the operating system level config, but I feel like we wouldn't be here if the operating system had stepped up their DNS any time in the last several years. OSes are relegated to support myriad environments with adhoc yet byzantine configuration. A browser's primary objective is to be a "user-agent" (as opposed to, say, subscribing to the whims of ISPs / Governments / anti-digital-rights-companies-masking-as-cyber-security-firms). > For the techie user who's running PiHole or some custom local DNS, yeah this will be annoying, but for the average user who's just delegating to their ISP that is then tracking their DNS lookups and injecting ads if they mistype a domain, this is a win. Internet censorship, which most of the population in the West isn't subject to or even aware of, is the primary reason DoH-in-a-browser is widely lauded. It just works, and thwarts all cheaper attempts at surveillance and censorship. Though, the likely effect would be, deep-packet-inspection becomes common place, but the imminent ESNI standard has that one covered, too. As someone who builds and maintains an open-source DoH resolver, I have come to fully appreciate the control and power a resolver running over HTTP/S puts in the hands of the users, both in the client and on the resolver-side.

Hizonner 5y ago
> the imminent ESNI standard has that one covered, too. Too slow, I'm afraid. Word on the street is that any hello containing ESNI will be blocked from day one in too many places for it to ever get traction, including all of China. I believe draft ESNI is blocked by the GFOC today. To even have a chance of making ESNI/ECH widespread, you'd have to make it mandatory for all TLS. That wouldn't fly politically in the working group, because the "enterprise" people have at least some influence there, and they want to do exactly the same kinds of DPI that North Korea would want to do. Even if it came out mandatory on the standards track, it would probably still fail at this point. It might have worked if it'd been mandatory in TLS 1.2 or even TLS 1.3, but it seems too late now. We'll see if they also disrupt DoH to the point of making it unusable. I bet they at least give it a try.
- josephcsible 5y ago
  If Microsoft, Apple, and Google all agreed to make ECH mandatory on the same future date, wouldn't that basically force the hands of every other enterprise?
- zarzavat 5y ago
  The goal of ESNI is not to bypass China's intranet. The goal is to say to DPI countries such as the UK: either you implement a China-style great firewall or you implement a free internet. There is no middle ground where you can spy on people without it being obvious.
- tialaramex 5y ago
  > That wouldn't fly politically in the working group, because the "enterprise" people have at least some influence there, and they want to do exactly the same kinds of DPI that North Korea would want to do. If this was true, TLS 1.3 would have RSA kex. The "enterprise" people (specifically in fact EDCO, the Enterprise Data Centre Operators, Nalini Elkins' group) really wanted to keep RSA kex. It was removed in TLS 1.3 anyway because it's a bad idea. In practice the intention is that ECH will be GREASEd, so yes, it will go from being nowhere to being apparently everywhere almost overnight. It's not specifically intended that GREASing ECH will defy the Great Firewall, but it's a possible outcome. China can decide its own policies without help from us. For EDCO and similar outfits, ECH changes nothing.
  - Hizonner 5y ago
    > If this was true, TLS 1.3 would have RSA kex. I hope you're right... > In practice the intention is that ECH will be GREASEd If even fake ECH extensions get rejected, then it's hard to deploy the whole GREASy burrito. > China can decide its own policies without help from us. ... but China can make it uncomfortable to support ECH worldwide. It's not a free action for a service to risk being blocked in China, or for client software to accept being unreliable or unusable in China. That affects deployment in the rest of the world. We'll see who wins the war of wills, but I'm afraid that the "Western" entities that have the most control over what's widely deployed are not going to have will enough.
    - pas 5y ago
      Any "service" that wants to support China needs to have serious presence there anyway.
- shawnz 5y ago
  They actually are recommending for everyone to add fake ESNI/ECH data even if you don't intend to use ESNI/ECH. See: https://datatracker.ietf.org/doc/html/draft-ietf-tls-esni#section-10.9.4 https://datatracker.ietf.org/doc/html/draft-ietf-tls-esni#se...
elric 5y ago
I'm afraid browsers stopped being "user agents" a long time ago. It's one of my pet peeves. They're agents of whichever company rolls them out. Basically Google or Mozilla. And they defer to the whims of whoever built the website you're visiting for a good chunk of their (insane) behaviour. If they were actual user agents, you would still have control over a lot of behaviour that's now been removed. Like actually remembering form fields you want to remember (instead, some websites tell the browser that it can't remember the user name, and the brower foolishly obeys). Or like copy/pasting text. Or like using the right mouse button (some websites disable it). Or like having control over keyboard shortcuts, which some websites override and which can't trivially be fixed. In my book, a user agent acts in my interests and on my behest. Sure, most of these behaviours can be corrected using browser extensions, but requiring a boatload of extensions to have an actual "user agent" doesn't make me happy.

Hizonner 5y ago

> the imminent ESNI standard has that one covered, too. Too slow, I'm afraid. Word on the street is that any hello containing ESNI will be blocked from day one in too many places for it to ever get traction, including all of China. I believe draft ESNI is blocked by the GFOC today. To even have a chance of making ESNI/ECH widespread, you'd have to make it mandatory for all TLS. That wouldn't fly politically in the working group, because the "enterprise" people have at least some influence there, and they want to do exactly the same kinds of DPI that North Korea would want to do. Even if it came out mandatory on the standards track, it would probably still fail at this point. It might have worked if it'd been mandatory in TLS 1.2 or even TLS 1.3, but it seems too late now. We'll see if they also disrupt DoH to the point of making it unusable. I bet they at least give it a try.

josephcsible 5y ago
If Microsoft, Apple, and Google all agreed to make ECH mandatory on the same future date, wouldn't that basically force the hands of every other enterprise?
zarzavat 5y ago
The goal of ESNI is not to bypass China's intranet. The goal is to say to DPI countries such as the UK: either you implement a China-style great firewall or you implement a free internet. There is no middle ground where you can spy on people without it being obvious.
tialaramex 5y ago
> That wouldn't fly politically in the working group, because the "enterprise" people have at least some influence there, and they want to do exactly the same kinds of DPI that North Korea would want to do. If this was true, TLS 1.3 would have RSA kex. The "enterprise" people (specifically in fact EDCO, the Enterprise Data Centre Operators, Nalini Elkins' group) really wanted to keep RSA kex. It was removed in TLS 1.3 anyway because it's a bad idea. In practice the intention is that ECH will be GREASEd, so yes, it will go from being nowhere to being apparently everywhere almost overnight. It's not specifically intended that GREASing ECH will defy the Great Firewall, but it's a possible outcome. China can decide its own policies without help from us. For EDCO and similar outfits, ECH changes nothing.
- Hizonner 5y ago
  > If this was true, TLS 1.3 would have RSA kex. I hope you're right... > In practice the intention is that ECH will be GREASEd If even fake ECH extensions get rejected, then it's hard to deploy the whole GREASy burrito. > China can decide its own policies without help from us. ... but China can make it uncomfortable to support ECH worldwide. It's not a free action for a service to risk being blocked in China, or for client software to accept being unreliable or unusable in China. That affects deployment in the rest of the world. We'll see who wins the war of wills, but I'm afraid that the "Western" entities that have the most control over what's widely deployed are not going to have will enough.
  - pas 5y ago
    Any "service" that wants to support China needs to have serious presence there anyway.
shawnz 5y ago
They actually are recommending for everyone to add fake ESNI/ECH data even if you don't intend to use ESNI/ECH. See: https://datatracker.ietf.org/doc/html/draft-ietf-tls-esni#section-10.9.4 https://datatracker.ietf.org/doc/html/draft-ietf-tls-esni#se...

elric 5y ago

I'm afraid browsers stopped being "user agents" a long time ago. It's one of my pet peeves. They're agents of whichever company rolls them out. Basically Google or Mozilla. And they defer to the whims of whoever built the website you're visiting for a good chunk of their (insane) behaviour. If they were actual user agents, you would still have control over a lot of behaviour that's now been removed. Like actually remembering form fields you want to remember (instead, some websites tell the browser that it can't remember the user name, and the brower foolishly obeys). Or like copy/pasting text. Or like using the right mouse button (some websites disable it). Or like having control over keyboard shortcuts, which some websites override and which can't trivially be fixed. In my book, a user agent acts in my interests and on my behest. Sure, most of these behaviours can be corrected using browser extensions, but requiring a boatload of extensions to have an actual "user agent" doesn't make me happy.