3 ms·

> which has worked pretty well for the past 30 years? But DNS hasn't worked pretty well for the past 30 years. It's been abused for a pretty long time now, bot

> which has worked pretty well for the past 30 years? But DNS hasn't worked pretty well for the past 30 years. It's been abused for a pretty long time now, both for hijacking requests and for violating privacy. I don't think that DoH advocates looked at a perfectly good system and just decided to replace it. They looked at a system with significant flaws, saw that this system was holding back consumer privacy and security, and proposed an alternative. > but DNS is only a tiny part of that problem [...] If you want to get rid those, then get rid of shitty ISPs. This is throwing out the baby with the bathwater. DNS is a huge part of that problem, because without encrypted DNS most people can't realistically keep their DNS queries private. What we're seeing is that we can do all kinds of fancy stuff around encrypting connections, but the DNS is always going to be a hole, and it's always going to make the other protections much less useful. We want to eventually plug other holes that make websites identifiable. During that process, there are going to be periods where some of the holes are plugged, and some aren't. But that doesn't mean all of the efforts are useless, it means we're in the process of plugging security holes. The fact that we haven't widely deployed SNI encryption or TLS 1.3 does not mean that encrypted DNS is useless, it means that multiple technologies are required to work together to make progress towards meaningfully masking domain names. We still have very hard problems to solve, like IP addresses themselves and statistical analysis of response sizes to determine which pages are being visited. But it's not much use trying to mitigate those problems if we can't even secure DNS resolution. In regards to ISPs, in general (where possible) we like to avoid the model of "everyone is insecure but there are no bad actors." Imagine if we had rejected HTTPS because "this is only really a problem if your router is compromised or the ISPs are snooping." We have a solution now that helps reduce the amount of trust we need for ISPs. That's good, we should deploy it. Even if ISPs weren't a problem, it would be worth deploying. > This will simply lead to ISPs and network operators blocking DoH. And instead of a wonderfully decentralized DNS, we'll end up with centralized DoH in the hands of Cloudflare and their ilk. I don't see a lot of reason to believe this. First, there was nothing preventing ISPs from blocking DNS and forcing you to use their DNS resolvers in the past, so I don't see what DoH changes about that situation -- other than that it's a meaningful privacy increase, which might make bad actors more aggressive about blocking it. But surely we're not claiming that we should abandon meaningful privacy improvements because we're scared of what ISPs might do. Second, DoH is decentralized, you can still use other resolvers other than Cloudflare, and you can still chain resolvers together. For the moment, I happen to recommend Cloudflare because I think it's offering more believable privacy promises than other providers, but I understand the concerns about Cloudflare's centralization. It's valid to use something else. But seriously, what is centralized about DoH that isn't centralized about DNS? The fact that requests can't be hijacked? Did the Internet become centralized specifically because you can't MITM HTTPS requests now? I'm seeing people claim that DoH means every request will go to Cloudflare, and that's just flat out not true: anyone can set up a DoH resolver, even locally on their own network. Okay, granted, not everyone on your network might respect your DoH settings you put on your Piihole or router, but that's not really different from today. Google already doesn't respect network settings for its DNS resolution on Chromecasts (or at least didn't last I checked). My browser already allows me to override my network settings for DNS. DoH changes nothing about that other than that OSes and routers are lagging on implementing network-wide DoH settings. If you think that staying with DNS would mean that IOT devices will perpetually respect your network settings for domain resolution, then I have bad news for you, because they're definitely going to stop doing that in the future regardless of what technology exists, and some of them have already stopped doing that today.

Hizonner 5y ago
> Second, DoH is decentralized, you can still use other resolvers other than Cloudflare, and you can still chain resolvers together. ... but in practice almost all Firefox users will end up using one of the very few designated Mozilla TRRs. That's an increase in centralization, as measured on the ground. Social and behavioral effects count. You can't claim one minute that "we're doing this to take care of naive users who can't protect themselves", and the next minute that "users can set up any arcane configuration they want". In the end, you screw the naive users by increasing their practical centralization, and you screw the sophisticated users by adding complexity, breaking whatever protections they already have in place, and making it impossible for them to secure all of the applications on their systems at the same time. Oh, and on edit, I guess I should address "first" as well as "second": Nothing was stopping ISPs from blocking alternative DNS before... but very few people were using alternative DNS before, so it didn't have a lot of impact on ISPs' priorities. If you suddenly take away the ISPs' visibility into many people's DNS, then the ISPs get a reason to care. All kinds of things skate under the radar if they're not deployed at scale, but provoke responses when they get big enough to be threatening.
- danShumway 5y ago
  > ... but in practice almost all Firefox users will end up using one of the very few designated Mozilla TRRs. That's an increase in centralization, as measured on the ground. Social and behavioral effects count. If we're going to go down this road and talk about defaults as they exist on the ground, then the reality is that most nontechnical users should be using Cloudflare's DoH resolver at the moment. Are there concerns about centralization? Yeah, of course. I'm as worried as anyone else about Cloudflare controlling the Internet, they are fundamentally a dangerous company. Being big, on its own, makes Cloudflare untrustworthy. But I'm also looking at Cloudflare's actions in the real world today, and they still have a better privacy record and are currently more trustworthy than any ISP in the US. Choosing them as a default in the US was the correct choice for Mozilla to make if you care about people's actual privacy in the real world today. Mozilla's defaults here are also not set in stone. As network operators catch up with the technologies they've been ignoring, we'll get better OS and network integration for DoH settings. And as more providers start offering DoH, the defaults can change. Cloudflare is the default right now not because of a conspiracy but because regardless of how nervous they make us, and regardless of whether it's a good idea in theory in the future to have so much traffic routed through them, currently on the ground right now they are the best choice for most nontechnical users. Additionally, currently on the ground there are few companies that are doing more than Cloudflare to decentralize DoH and improve its technical privacy guarantees instead of just asking people to trust them. Oblivious DoH[0] is an interesting proposal in that direction, there's also a decent amount of work (which Cloudflare is supportive of) going into research about by-default splitting DoH requests across multiple entities, so no single provider would get all of your queries. There are some obvious issues there to overcome regarding privacy, but it's still a somewhat promising proposal. From a technical perspective, there is nothing about DoH that is centralized, and no part of the technology would force it to be centralized. There's no consumer lock-in, and there's no browser lock-in. Configuring DoH is not an "arcane configuration", it's just as easy as any DNS setup in your browser, even easier because there's less network interference and it's easier to debug. But from a practical perspective right now on the ground, while I share concerns about Cloudflare overall and while I share concerns that Cloudflare consolidating power is problematic, I don't think it's accurate or reasonable to claim that DoH is a power grab. By default, Cloudflare isn't the provider in Canada. In the US, they have temporarily been chosen by the default by Mozilla because they are currently offering the best service. But anyone else could step into that position if they care to, there's no blocking or gatekeeping going on. And frankly, if the only reason that DNS is decentralized is because most people's devices don't use a consistent resolver and just naively trust whatever network is were on, if the only reason why DNS is decentralized is because everyone's ISP sets it in the background without their knowledge, then in my opinion that's just a ridiculous way to guarantee provider diversity, and we should absolutely overhaul that system. Any system where my DNS provider changes behind my back when I connect to the wifi at a coffee shop is broken, and that is the experience that most nontechnical users have with DNS today. It is frighteningly insecure. > You can't claim one minute that "we're doing this to take care of naive users who can't protect themselves", and the next minute that "users can set up any arcane configuration they want". I don't think I do claim this. What I claim is that Cloudflare is an obvious default for nontechnical users, and I claim that DNS is susceptible to all of the same centralization concerns as DoH, and I cliam that changing a DoH provider in Firefox for most end users is no more difficult than it would be to change a DNS provider. Most users won't change their DNS provider, which is why it makes sense to use a secure default rather than to let every random network in the wild decide. But if you are the type of person who wasn't just trusting network DNS, then DoH is not going to be a problem for you. It especially won't be a problem for you once OS manufacturers start allowing system-wide configs. > If you suddenly take away the ISPs' visibility into many people's DNS, then the ISPs get a reason to care. I buy this theory, I think you're very likely correct. But I don't think it's a compelling argument. If what you're saying is correct, then literally any privacy initiative that threatened ISPs in any way would be blocked. What's the takeaway from that, we should abandon efforts that threaten ISPs? We are seeing a large amount of pushback from ISPs, from network operators, and from governments themselves over DoH. This does not suggest that the proposal is dead on arrival, or that it's just going to be globally blocked. If DoH didn't have teeth, we would not be seeing this reaction. So what your argument is saying is that DNS skated under the radar largely because it wasn't helping anyone, and ISPs didn't feel threatened by it. But I'd rather throw my weight behind a technology that they do feel threatened by, rather than behind one that they don't care about. A world where we have to fight about DoH being blocked is still strictly better than a world where we don't have to fight because there's nothing to fight over and the majority of people are using a system that is trivially attackable. [0]: https://blog.cloudflare.com/oblivious-dns/ https://blog.cloudflare.com/oblivious-dns/

Hizonner 5y ago

> Second, DoH is decentralized, you can still use other resolvers other than Cloudflare, and you can still chain resolvers together. ... but in practice almost all Firefox users will end up using one of the very few designated Mozilla TRRs. That's an increase in centralization, as measured on the ground. Social and behavioral effects count. You can't claim one minute that "we're doing this to take care of naive users who can't protect themselves", and the next minute that "users can set up any arcane configuration they want". In the end, you screw the naive users by increasing their practical centralization, and you screw the sophisticated users by adding complexity, breaking whatever protections they already have in place, and making it impossible for them to secure all of the applications on their systems at the same time. Oh, and on edit, I guess I should address "first" as well as "second": Nothing was stopping ISPs from blocking alternative DNS before... but very few people were using alternative DNS before, so it didn't have a lot of impact on ISPs' priorities. If you suddenly take away the ISPs' visibility into many people's DNS, then the ISPs get a reason to care. All kinds of things skate under the radar if they're not deployed at scale, but provoke responses when they get big enough to be threatening.

danShumway 5y ago
> ... but in practice almost all Firefox users will end up using one of the very few designated Mozilla TRRs. That's an increase in centralization, as measured on the ground. Social and behavioral effects count. If we're going to go down this road and talk about defaults as they exist on the ground, then the reality is that most nontechnical users should be using Cloudflare's DoH resolver at the moment. Are there concerns about centralization? Yeah, of course. I'm as worried as anyone else about Cloudflare controlling the Internet, they are fundamentally a dangerous company. Being big, on its own, makes Cloudflare untrustworthy. But I'm also looking at Cloudflare's actions in the real world today, and they still have a better privacy record and are currently more trustworthy than any ISP in the US. Choosing them as a default in the US was the correct choice for Mozilla to make if you care about people's actual privacy in the real world today. Mozilla's defaults here are also not set in stone. As network operators catch up with the technologies they've been ignoring, we'll get better OS and network integration for DoH settings. And as more providers start offering DoH, the defaults can change. Cloudflare is the default right now not because of a conspiracy but because regardless of how nervous they make us, and regardless of whether it's a good idea in theory in the future to have so much traffic routed through them, currently on the ground right now they are the best choice for most nontechnical users. Additionally, currently on the ground there are few companies that are doing more than Cloudflare to decentralize DoH and improve its technical privacy guarantees instead of just asking people to trust them. Oblivious DoH[0] is an interesting proposal in that direction, there's also a decent amount of work (which Cloudflare is supportive of) going into research about by-default splitting DoH requests across multiple entities, so no single provider would get all of your queries. There are some obvious issues there to overcome regarding privacy, but it's still a somewhat promising proposal. From a technical perspective, there is nothing about DoH that is centralized, and no part of the technology would force it to be centralized. There's no consumer lock-in, and there's no browser lock-in. Configuring DoH is not an "arcane configuration", it's just as easy as any DNS setup in your browser, even easier because there's less network interference and it's easier to debug. But from a practical perspective right now on the ground, while I share concerns about Cloudflare overall and while I share concerns that Cloudflare consolidating power is problematic, I don't think it's accurate or reasonable to claim that DoH is a power grab. By default, Cloudflare isn't the provider in Canada. In the US, they have temporarily been chosen by the default by Mozilla because they are currently offering the best service. But anyone else could step into that position if they care to, there's no blocking or gatekeeping going on. And frankly, if the only reason that DNS is decentralized is because most people's devices don't use a consistent resolver and just naively trust whatever network is were on, if the only reason why DNS is decentralized is because everyone's ISP sets it in the background without their knowledge, then in my opinion that's just a ridiculous way to guarantee provider diversity, and we should absolutely overhaul that system. Any system where my DNS provider changes behind my back when I connect to the wifi at a coffee shop is broken, and that is the experience that most nontechnical users have with DNS today. It is frighteningly insecure. > You can't claim one minute that "we're doing this to take care of naive users who can't protect themselves", and the next minute that "users can set up any arcane configuration they want". I don't think I do claim this. What I claim is that Cloudflare is an obvious default for nontechnical users, and I claim that DNS is susceptible to all of the same centralization concerns as DoH, and I cliam that changing a DoH provider in Firefox for most end users is no more difficult than it would be to change a DNS provider. Most users won't change their DNS provider, which is why it makes sense to use a secure default rather than to let every random network in the wild decide. But if you are the type of person who wasn't just trusting network DNS, then DoH is not going to be a problem for you. It especially won't be a problem for you once OS manufacturers start allowing system-wide configs. > If you suddenly take away the ISPs' visibility into many people's DNS, then the ISPs get a reason to care. I buy this theory, I think you're very likely correct. But I don't think it's a compelling argument. If what you're saying is correct, then literally any privacy initiative that threatened ISPs in any way would be blocked. What's the takeaway from that, we should abandon efforts that threaten ISPs? We are seeing a large amount of pushback from ISPs, from network operators, and from governments themselves over DoH. This does not suggest that the proposal is dead on arrival, or that it's just going to be globally blocked. If DoH didn't have teeth, we would not be seeing this reaction. So what your argument is saying is that DNS skated under the radar largely because it wasn't helping anyone, and ISPs didn't feel threatened by it. But I'd rather throw my weight behind a technology that they do feel threatened by, rather than behind one that they don't care about. A world where we have to fight about DoH being blocked is still strictly better than a world where we don't have to fight because there's nothing to fight over and the majority of people are using a system that is trivially attackable. [0]: https://blog.cloudflare.com/oblivious-dns/ https://blog.cloudflare.com/oblivious-dns/