4 ms·

I use Pi-Hole + Unbound forwarding to Cloudflare/Quad9 over TLS. It would be nice if all servers supported DoT/DoH + DNSSEC and you could roll your own recursi

by Brybry 5y ago

I use Pi-Hole + Unbound forwarding to Cloudflare/Quad9 over TLS. It would be nice if all servers supported DoT/DoH + DNSSEC and you could roll your own recursive DNS server and have more trust in traffic not being intercepted. Post-Snowden revelations I feel pretty confident that DNS requests in the clear are being surveilled. I don't know for sure that requests to Cloudflare or Quad9 are being surveilled.

nobody9999 5y ago
>It would be nice if all servers supported DoT/DoH + DNSSEC and you could roll your own recursive DNS server and have more trust in traffic not being intercepted. I love DNSSEC, but am not in favor of DoH/DoT. Mostly because I can't control DoH/DoT requests emanating from my network, as they're already encrypted and can't be differentiated from standard HTTPS traffic. That's an issue (and will become a much bigger one as time passes) because vendors can use DoH/DoT to bypass local DNS controls like Pi-Hole, and short of blocking TCP/443, there's nothing you can do about it. Which is, IMNSHO, a big reason why DoT/DoH was developed. >Post-Snowden revelations I feel pretty confident that DNS requests in the clear are being surveilled. I don't know for sure that requests to Cloudflare or Quad9 are being surveilled. Your ISP can surveil whatever they want and there isn't much you can do about it unless you use a VPN.
- Forbo 5y ago
  If you can't control where your device is making DNS requests then it's not your device. It's the manufacturer's surveillance capitalist revenue generator. We need more devices that actually respect the user.
- Brybry 5y ago
  I don't think my ISP can easily intercept the content of DoT DNS requests. They would need a valid certificate for 1.1.1.1#cloudflare-dns.com or 9.9.9.9#dns.quad9.net from a trusted (by me) CA, correct? Now obviously that's not impossible but is a VPN any better in that scenario?
  - nobody9999 5y ago
    >I don't think my ISP can easily intercept the content of DoT DNS requests. No. But they can intercept connections to the IP addresses returned by such DNS queries. >They would need a valid certificate for 1.1.1.1#cloudflare-dns.com or 9.9.9.9#dns.quad9.net from a trusted (by me) CA, correct? In order to MiTM such requests, yes. >Now obviously that's not impossible but is a VPN any better in that scenario? You're only considering the DNS queries. Once you've received a response to your DoT/DoH query, presumably you'll want to connect to the returned IP address, right? Your ISP can absolutely capture those packets, and even if the payload is encrypted, the headers are not -- so while they might not be able to access the data, they have full access to the metadata. Unless you use a VPN, which will encapsulate the headers as well. All that said, my issue is with DoH/DoT, since devices can stealthily bypass my DNS controls (including ad/telemetry blockers like Pi-Hole) and unless I block all TLS/HTTPS traffic (making my internet link mostly useless), I can't stop surreptitious connectivity. I'm not as concerned with my ISP as I am with not being able to block ads/tracking/telemetry. Apologies if I wasn't clear about that.
    - radicaldreamer 5y ago
      You can use eero secure+, which will intercept dns requests at the gateway to prevent devices and apps from bypassing the set dns servers. I won't work for apps which hardcore their own DoH/DoT clients and use their own servers, however.
      - nobody9999 5y ago
        >You can use eero secure+, which will intercept dns requests at the gateway to prevent devices and apps from bypassing the set dns servers. I'm not familiar with eero secure+, but why would I want to pay for something like that, when a single firewall egress[0] rule can block outbound DNS requests that come from sources other than the "set dns servers"? Note that I'm not trying to denigrate eero secure+, I don't know anything about it except that it's some sort of cloud-based (read: someone else's servers) security application. I'm merely pointing out that limiting outbound DNS requests to specific hosts is trivial. [0] https://en.wikipedia.org/wiki/Egress_filtering https://en.wikipedia.org/wiki/Egress_filtering
- fragmede 5y ago
  Post-Snowden, the lesson is the NSA is doing their damnedest to watch American's activities online. I would bet money that they're doinf everything they can to watch Cloudflare, despite no direct evidence, because of course they are.

by Brybry 5y ago

nobody9999 5y ago

>It would be nice if all servers supported DoT/DoH + DNSSEC and you could roll your own recursive DNS server and have more trust in traffic not being intercepted. I love DNSSEC, but am not in favor of DoH/DoT. Mostly because I can't control DoH/DoT requests emanating from my network, as they're already encrypted and can't be differentiated from standard HTTPS traffic. That's an issue (and will become a much bigger one as time passes) because vendors can use DoH/DoT to bypass local DNS controls like Pi-Hole, and short of blocking TCP/443, there's nothing you can do about it. Which is, IMNSHO, a big reason why DoT/DoH was developed. >Post-Snowden revelations I feel pretty confident that DNS requests in the clear are being surveilled. I don't know for sure that requests to Cloudflare or Quad9 are being surveilled. Your ISP can surveil whatever they want and there isn't much you can do about it unless you use a VPN.

Forbo 5y ago
If you can't control where your device is making DNS requests then it's not your device. It's the manufacturer's surveillance capitalist revenue generator. We need more devices that actually respect the user.
Brybry 5y ago
I don't think my ISP can easily intercept the content of DoT DNS requests. They would need a valid certificate for 1.1.1.1#cloudflare-dns.com or 9.9.9.9#dns.quad9.net from a trusted (by me) CA, correct? Now obviously that's not impossible but is a VPN any better in that scenario?
- nobody9999 5y ago
  >I don't think my ISP can easily intercept the content of DoT DNS requests. No. But they can intercept connections to the IP addresses returned by such DNS queries. >They would need a valid certificate for 1.1.1.1#cloudflare-dns.com or 9.9.9.9#dns.quad9.net from a trusted (by me) CA, correct? In order to MiTM such requests, yes. >Now obviously that's not impossible but is a VPN any better in that scenario? You're only considering the DNS queries. Once you've received a response to your DoT/DoH query, presumably you'll want to connect to the returned IP address, right? Your ISP can absolutely capture those packets, and even if the payload is encrypted, the headers are not -- so while they might not be able to access the data, they have full access to the metadata. Unless you use a VPN, which will encapsulate the headers as well. All that said, my issue is with DoH/DoT, since devices can stealthily bypass my DNS controls (including ad/telemetry blockers like Pi-Hole) and unless I block all TLS/HTTPS traffic (making my internet link mostly useless), I can't stop surreptitious connectivity. I'm not as concerned with my ISP as I am with not being able to block ads/tracking/telemetry. Apologies if I wasn't clear about that.
  - radicaldreamer 5y ago
    You can use eero secure+, which will intercept dns requests at the gateway to prevent devices and apps from bypassing the set dns servers. I won't work for apps which hardcore their own DoH/DoT clients and use their own servers, however.
    - nobody9999 5y ago
      >You can use eero secure+, which will intercept dns requests at the gateway to prevent devices and apps from bypassing the set dns servers. I'm not familiar with eero secure+, but why would I want to pay for something like that, when a single firewall egress[0] rule can block outbound DNS requests that come from sources other than the "set dns servers"? Note that I'm not trying to denigrate eero secure+, I don't know anything about it except that it's some sort of cloud-based (read: someone else's servers) security application. I'm merely pointing out that limiting outbound DNS requests to specific hosts is trivial. [0] https://en.wikipedia.org/wiki/Egress_filtering https://en.wikipedia.org/wiki/Egress_filtering
fragmede 5y ago
Post-Snowden, the lesson is the NSA is doing their damnedest to watch American's activities online. I would bet money that they're doinf everything they can to watch Cloudflare, despite no direct evidence, because of course they are.