3 ms·

> This is a workaround for the fact that many networks are hostile to DNS lookups (injecting ads, tracking, captive portals), and operating systems continue to

> This is a workaround for the fact that many networks are hostile to DNS lookups (injecting ads, tracking, captive portals), and operating systems continue to just default to the ISPs DNS provider, which is often hostile. This workaround is hostile to my own network (home or work) being able to track requests. I control my router / DCHP server, and I should be able to tell devices where to send DNS requests. Anything that does not do what I tell it to do is malware IMHO.

cle 5y ago
You can’t track all requests anyway, as they can be trivially tunneled through encrypted streams with bundled certs. This is the tradeoff of running arbitrary Turing-complete programs. If you don’t like what a program is doing, or that it doesn’t use libc or some standard way to do DNS resolution, your only options are to either change the program to do what you want, or don’t run it.
- throw0101a 5y ago
  > You can’t track all requests anyway, as they can be trivially tunneled through encrypted streams with bundled certs. Previously I can track devices (a) making DNS requests, and then (b) make TCP and/or UDP requests. Anything that made a data request without a DNS request was probably using a hard-coded IP, which would be suspicious. With DoH, it's all-HTTPS all-the-time: > DoH is an over the top bypass of enterprise and other private networks. But DNS is part of the control plane, and network operators must be able to monitor and filter it. Use DoT, never DoH. * https://twitter.com/paulvixie/status/1053886628832382977 https://twitter.com/paulvixie/status/1053886628832382977 > or don’t run it. So Firefox further circles the drain with regards to market share? Is this part of some grand 4D chess plan by Mozilla that is perhaps beyond my intellect?
  - SilverRed 5y ago
    The cat is out of the bag regardless of what Firefox does. Even without firefox any bit of malware could bundle their own DoH library.
danShumway 5y ago
> and I should be able to tell devices where to send DNS requests But you can't. Even if DoH went away today, even if Mozilla and everyone else dropped the technology, you still don't actually have the ability to do that. Devices will still be able to ignore you. It's not DoH's fault if devices on your network don't use your network-wide DNS resolver. IOT devices were going to move in that direction regardless. Increasingly, your smart TVs are going to ignore your network settings. They might not even make DNS requests over the correct port. They might hide them in normal Internet traffic. They might cache them locally. They might make a request for a domain that looks safe, and then use a different IP address that they have cached locally. They might even ship with their own embedded 5G chip and use it for specific exfiltration requests and updates. They might join your local network, read all of your unencrypted traffic, and then use a 5G chip to separately send data out. If you think that blocking DoH will solve these kinds of problems, I feel like you are putting way, way too much faith into your existing DNS setup. > Anything that does not do what I tell it to do is malware IMHO Okay, that seems completely reasonable. However, my perspective is that any network that will MITM my requests or monitor what websites I visit without my permission is malicious IMHO. It sounds like the answer here is to block access to your network for devices that you don't trust, or to try and quarantine them -- not to demand that my personal device stop respecting my own entered DNS settings whenever it joins a new network. To argue that my installation of Firefox or that my OS shouldn't be able to ignore network settings anywhere and that I shouldn't be able to choose how my requests are encrypted, just because it makes it easier for you specifically to enforce your network's security policy without explicit opt-in or consent -- I don't know, it just seems pretty backwards to me from how this kind of security stuff is normally supposed to work. I know that this stuff will make it harder for some network operators to do their jobs but... so did HTTPS. I heard literally the exact same complaints during the early push to get every website encrypted. But we live with it, and now if you want to monitor my unencrypted network traffic, you need to get my permission to install a certificate. Control and consent slowly moves away from networks and onto devices over time, closer to the users themselves.
- throw0101a 5y ago
  > Devices will still be able to ignore you. Yes. But previously by logging requests to port 53 (and 853) I can hunt down those devices quite easy. > However, my perspective is that any network that will MITM my requests or monitor what websites I visit without my permission is malicious IMHO. If you don't like how I've set up my network, blocking your DNS requests, feel free not to use my network. > To argue that my installation of Firefox or that my OS shouldn't be able to ignore network settings anywhere and that I shouldn't be able to choose how my requests are encrypted, just because it makes it easier for you specifically to enforce your network's security policy without explicit opt-in or consent You can set up your devices however you want. But if they're on my network, they play by my rules. > I know that this stuff will make it harder for some network operators to do their jobs but... so did HTTPS. And network owners are free to block port 443 as well. Or any other port. People can choose to use those networks or not.
shawnz 5y ago
DHCP is a mechanism to automatically configure clients with useful defaults, like a DNS server. It's not a system for enforcing network policies. There was never supposed to be any requirement to observe what DHCP tells you.

cle 5y ago

You can’t track all requests anyway, as they can be trivially tunneled through encrypted streams with bundled certs. This is the tradeoff of running arbitrary Turing-complete programs. If you don’t like what a program is doing, or that it doesn’t use libc or some standard way to do DNS resolution, your only options are to either change the program to do what you want, or don’t run it.

throw0101a 5y ago
> You can’t track all requests anyway, as they can be trivially tunneled through encrypted streams with bundled certs. Previously I can track devices (a) making DNS requests, and then (b) make TCP and/or UDP requests. Anything that made a data request without a DNS request was probably using a hard-coded IP, which would be suspicious. With DoH, it's all-HTTPS all-the-time: > DoH is an over the top bypass of enterprise and other private networks. But DNS is part of the control plane, and network operators must be able to monitor and filter it. Use DoT, never DoH. * https://twitter.com/paulvixie/status/1053886628832382977 https://twitter.com/paulvixie/status/1053886628832382977 > or don’t run it. So Firefox further circles the drain with regards to market share? Is this part of some grand 4D chess plan by Mozilla that is perhaps beyond my intellect?
- SilverRed 5y ago
  The cat is out of the bag regardless of what Firefox does. Even without firefox any bit of malware could bundle their own DoH library.

danShumway 5y ago

> and I should be able to tell devices where to send DNS requests But you can't. Even if DoH went away today, even if Mozilla and everyone else dropped the technology, you still don't actually have the ability to do that. Devices will still be able to ignore you. It's not DoH's fault if devices on your network don't use your network-wide DNS resolver. IOT devices were going to move in that direction regardless. Increasingly, your smart TVs are going to ignore your network settings. They might not even make DNS requests over the correct port. They might hide them in normal Internet traffic. They might cache them locally. They might make a request for a domain that looks safe, and then use a different IP address that they have cached locally. They might even ship with their own embedded 5G chip and use it for specific exfiltration requests and updates. They might join your local network, read all of your unencrypted traffic, and then use a 5G chip to separately send data out. If you think that blocking DoH will solve these kinds of problems, I feel like you are putting way, way too much faith into your existing DNS setup. > Anything that does not do what I tell it to do is malware IMHO Okay, that seems completely reasonable. However, my perspective is that any network that will MITM my requests or monitor what websites I visit without my permission is malicious IMHO. It sounds like the answer here is to block access to your network for devices that you don't trust, or to try and quarantine them -- not to demand that my personal device stop respecting my own entered DNS settings whenever it joins a new network. To argue that my installation of Firefox or that my OS shouldn't be able to ignore network settings anywhere and that I shouldn't be able to choose how my requests are encrypted, just because it makes it easier for you specifically to enforce your network's security policy without explicit opt-in or consent -- I don't know, it just seems pretty backwards to me from how this kind of security stuff is normally supposed to work. I know that this stuff will make it harder for some network operators to do their jobs but... so did HTTPS. I heard literally the exact same complaints during the early push to get every website encrypted. But we live with it, and now if you want to monitor my unencrypted network traffic, you need to get my permission to install a certificate. Control and consent slowly moves away from networks and onto devices over time, closer to the users themselves.

throw0101a 5y ago
> Devices will still be able to ignore you. Yes. But previously by logging requests to port 53 (and 853) I can hunt down those devices quite easy. > However, my perspective is that any network that will MITM my requests or monitor what websites I visit without my permission is malicious IMHO. If you don't like how I've set up my network, blocking your DNS requests, feel free not to use my network. > To argue that my installation of Firefox or that my OS shouldn't be able to ignore network settings anywhere and that I shouldn't be able to choose how my requests are encrypted, just because it makes it easier for you specifically to enforce your network's security policy without explicit opt-in or consent You can set up your devices however you want. But if they're on my network, they play by my rules. > I know that this stuff will make it harder for some network operators to do their jobs but... so did HTTPS. And network owners are free to block port 443 as well. Or any other port. People can choose to use those networks or not.

shawnz 5y ago

DHCP is a mechanism to automatically configure clients with useful defaults, like a DNS server. It's not a system for enforcing network policies. There was never supposed to be any requirement to observe what DHCP tells you.