4 ms·

This is FUD. This possibility has nothing to do with HTTP vs. [some other DNS-like protocol] sitting on top of an encrypted connection. This possibility is, ho

This is FUD. This possibility has nothing to do with HTTP vs. [some other DNS-like protocol] sitting on top of an encrypted connection. This possibility is, however, enabled by having the application package its own DNS resolution. It's unfortunate that more and more software is doing this with no way to opt out (Chromecast and Nintendo Switch are the worst offenders) -- but the way firefox does it, it is opt-out. I think it's a double edged sword; having in-application DNS as an option has an important advantage of subverting malware as well as public wifi networks configured for surveillance. In an ideal world, we don't have to "subvert malware", but we live in a world where a big chunk of users have some sort of malware installed or in their general proximity. If you want to use DNS over HTTPS as a system-wide daemon, you can use DNSCrypt 2 (https://dnscrypt.info/ https://dnscrypt.info/ ) and disable DoH within Firefox/Chrome.

_jal 5y ago
Software that does its own resolution will not run on my network, and we have banned it by policy at work. Of course it becomes another game of whack-a-mole. My house, my rules; you don't get to subvert my network security and continue to use my network.
- creatonez 5y ago
  Right, and the feature is not designed for you. It's designed for the billions of users who are not on your network, and are sitting in their own home or in a coffee shop where there is no such security policy or skilled network administrator in sight. Aside: If you are using Firefox in an enterprise environment, you should be locking the settings to begin with. If I remember correctly, the Firefox ESR downloads don't even prompt about enabling DoH.
- jeroenhd 5y ago
  That's a perfectly acceptable policy to have, but you'll have to check and monitor that policy like you always have. You can add an A/AAAA record for use-application-dns.net and Firefox won't turn on DoH on your network unless the user overrides it. Chrome's DoH model will use your existing DNS server: if it supports DoH, Chrome switches to DoH, otherwise it'll stick to normal DNS. Do note that malware and even legitimate software (some Android apps, some Windows applications) have been using HTTP(S) based domain lookups for years, though, years before DoH was even proposed. I've used free HTTP proxies over fifteen years ago to bypass school filters, for one, and that's without any infrastructure of my own! You'll have to configure an intercepting proxy to exclusively allow traffic through if you want to catch problematic software in the act, and add some pretty sophisticated filtering. With the modern take on inserting your own certificate authority (certificate pinning, unrooted Android, NodeJS, etc. all avoiding your user certificate store) you'll have to go through great lengths to get that working, though. Truth be told, DNS was never really much of a security measure if you don't have control over what applications do or do not use it.
  - denkmoon 5y ago
    Therefore we should cede more control?
    - jeroenhd 5y ago
      Of course not. That's why you can disable DoH on the software you install, and have the choice (in the EU) to return a product you bought online within 14 days if it doesn't live up to your expectations, or not buy the product at all. However, it should be clear that we're not ceding control, per se, as we have never had control over these closed source devices in the first place! We should instead be working to gain control over our devices through open source efforts so that we can control what our hardware can and cannot do. For what it's worth, there is a thread on XDA about customising Chromecast firmware that should allow you to hack the device to disable any unwanted behaviour, but I can't say if that method still works.
  - creatonez 5y ago
    > You can add an A/AAAA record for use-application-dns.net and Firefox won't turn on DoH on your network unless the user overrides it. Out of curiosity, is there any other software that respects this by default?
    - jeroenhd 5y ago
      So far, Firefox is the only browser that has announced support for this. Chrome takes another approach, which is to test the system DNS server for DoH capabilities and to switch to DoH when the resolver supports it. Chrome does have a fallback to Google's DNS if it determines that your DNS server is broken, but you should be able to disable that. That means you can secure your network by picking an existing DNS server that also provides a DoH server and Chrome should pick it up by default! I believe Microsoft announced a similar approach to Google, but from what I can find you still need to enable DoH manually anyway. In all cases, the end user can override your domain settings unless your group policies (or similar) lock these settings.
      - 5y ago
- tptacek 5y ago
  This is simple: people like you are best served by a policy that manages this kind of policy at the system or network layer. But most people aren't. For most people, the managers of their networks are adversaries. Firefox should, by default, serve most people --- not just nerds like us with strong opinions about the "system resolver". There is no moral authority to the system resolver. It's a convenience, not a contract.
- josephcsible 5y ago
  You should not get to censor people's view of the Internet just because you're providing the connection, just like the gas/electric company doesn't get to decide what you can and can't cook on your stove even though they provide the energy it uses to work. And if you really only mean your own devices, then enforce your policy on the endpoints instead.
jeena 5y ago
I have one specific problem but I'm not sure if this is connected. I have a home assistant on a raspberry pi at my parents house. From outside of the network there is no problem, they have a dynamic DNS pointing to their IP address and then port forwarding so that they can access the home assistant UI from the internet. But they also need to access it from home when they're on the WiFi. Because their router doesn't do this NAT Loopback so that they need to access it via the IP address which is very cumbersome. What I did was that I set up a DNS server which would resolve the dynamic DNS domain to the raspberry pi and pointed the router to use this DNS server. This way they were able to use the same domain in and outside of the network. I understand that Firefox falls back on the old way of DNS, but I have to assume that Chromecast and Google Assistant will not and therefor it will fail to play local media or show the home assistant UI? Somehow this fucks up local networks and assumes everything is on the Internet, doesn't it?
- jeroenhd 5y ago
  In this case using an IPv6 address might work (if your ISPs aren't behind on rolling out IPv6). Alternatively you could tunnel the connection through something intended to break through problematic NAT setups like ngrok (or its alternatives: https://github.com/anderspitman/awesome-tunneling https://github.com/anderspitman/awesome-tunneling). I've run a split horizon DNS configuration for years and I've got to say that it caused more problems for me than it solves. Luckily, you can just turn off DoH if it causes problems for you. In my experience, the Chromecast and Google Assistant functionality isn't related to your DNS setup. Chromecast should work through broadcast or through an active request from HASS itself, and the Google integration has always gone through the cloud as far as I know. Perhaps your setup is different than mine, but I don't think these issues are necessarily DNS related, unless Google's servers are getting your local IP when they query for the HASS domain.
  - jeena 5y ago
    Sadly Google Assistant does need to use the DNS setup because I play local media for announcements on it and every time the DNS is broken it stops working and doesn't play any local media anymore. Basically home assistant media player plays a mp3 which is stored on the raspberry pi on the Google Assistant, for example when someone opens the out door it plays a chime on all Google Assistants in the whole house so that my parents know that someone opened the door downstairs. The url will be https://myparentshouse.duckdns.org/local/open-door.mp3 https://myparentshouse.duckdns.org/local/open-door.mp3 so if the Google Assistant doesn't use the local DNS it can't resolve the domain to the local raspberry pi, and instead resolves it to the public IP address which then without the Loopback NAT doesn't go anywhere. I understand that I should then instead of using Google Assistant for that to use something else, but I haven't found any free hardware which would have the functionality of good microphones and working speech to text yet.

_jal 5y ago

Software that does its own resolution will not run on my network, and we have banned it by policy at work. Of course it becomes another game of whack-a-mole. My house, my rules; you don't get to subvert my network security and continue to use my network.

creatonez 5y ago
Right, and the feature is not designed for you. It's designed for the billions of users who are not on your network, and are sitting in their own home or in a coffee shop where there is no such security policy or skilled network administrator in sight. Aside: If you are using Firefox in an enterprise environment, you should be locking the settings to begin with. If I remember correctly, the Firefox ESR downloads don't even prompt about enabling DoH.
jeroenhd 5y ago
That's a perfectly acceptable policy to have, but you'll have to check and monitor that policy like you always have. You can add an A/AAAA record for use-application-dns.net and Firefox won't turn on DoH on your network unless the user overrides it. Chrome's DoH model will use your existing DNS server: if it supports DoH, Chrome switches to DoH, otherwise it'll stick to normal DNS. Do note that malware and even legitimate software (some Android apps, some Windows applications) have been using HTTP(S) based domain lookups for years, though, years before DoH was even proposed. I've used free HTTP proxies over fifteen years ago to bypass school filters, for one, and that's without any infrastructure of my own! You'll have to configure an intercepting proxy to exclusively allow traffic through if you want to catch problematic software in the act, and add some pretty sophisticated filtering. With the modern take on inserting your own certificate authority (certificate pinning, unrooted Android, NodeJS, etc. all avoiding your user certificate store) you'll have to go through great lengths to get that working, though. Truth be told, DNS was never really much of a security measure if you don't have control over what applications do or do not use it.
- denkmoon 5y ago
  Therefore we should cede more control?
  - jeroenhd 5y ago
    Of course not. That's why you can disable DoH on the software you install, and have the choice (in the EU) to return a product you bought online within 14 days if it doesn't live up to your expectations, or not buy the product at all. However, it should be clear that we're not ceding control, per se, as we have never had control over these closed source devices in the first place! We should instead be working to gain control over our devices through open source efforts so that we can control what our hardware can and cannot do. For what it's worth, there is a thread on XDA about customising Chromecast firmware that should allow you to hack the device to disable any unwanted behaviour, but I can't say if that method still works.
- creatonez 5y ago
  > You can add an A/AAAA record for use-application-dns.net and Firefox won't turn on DoH on your network unless the user overrides it. Out of curiosity, is there any other software that respects this by default?
  - jeroenhd 5y ago
    So far, Firefox is the only browser that has announced support for this. Chrome takes another approach, which is to test the system DNS server for DoH capabilities and to switch to DoH when the resolver supports it. Chrome does have a fallback to Google's DNS if it determines that your DNS server is broken, but you should be able to disable that. That means you can secure your network by picking an existing DNS server that also provides a DoH server and Chrome should pick it up by default! I believe Microsoft announced a similar approach to Google, but from what I can find you still need to enable DoH manually anyway. In all cases, the end user can override your domain settings unless your group policies (or similar) lock these settings.
    - 5y ago
tptacek 5y ago
This is simple: people like you are best served by a policy that manages this kind of policy at the system or network layer. But most people aren't. For most people, the managers of their networks are adversaries. Firefox should, by default, serve most people --- not just nerds like us with strong opinions about the "system resolver". There is no moral authority to the system resolver. It's a convenience, not a contract.
josephcsible 5y ago
You should not get to censor people's view of the Internet just because you're providing the connection, just like the gas/electric company doesn't get to decide what you can and can't cook on your stove even though they provide the energy it uses to work. And if you really only mean your own devices, then enforce your policy on the endpoints instead.

jeena 5y ago

I have one specific problem but I'm not sure if this is connected. I have a home assistant on a raspberry pi at my parents house. From outside of the network there is no problem, they have a dynamic DNS pointing to their IP address and then port forwarding so that they can access the home assistant UI from the internet. But they also need to access it from home when they're on the WiFi. Because their router doesn't do this NAT Loopback so that they need to access it via the IP address which is very cumbersome. What I did was that I set up a DNS server which would resolve the dynamic DNS domain to the raspberry pi and pointed the router to use this DNS server. This way they were able to use the same domain in and outside of the network. I understand that Firefox falls back on the old way of DNS, but I have to assume that Chromecast and Google Assistant will not and therefor it will fail to play local media or show the home assistant UI? Somehow this fucks up local networks and assumes everything is on the Internet, doesn't it?

jeroenhd 5y ago
In this case using an IPv6 address might work (if your ISPs aren't behind on rolling out IPv6). Alternatively you could tunnel the connection through something intended to break through problematic NAT setups like ngrok (or its alternatives: https://github.com/anderspitman/awesome-tunneling https://github.com/anderspitman/awesome-tunneling). I've run a split horizon DNS configuration for years and I've got to say that it caused more problems for me than it solves. Luckily, you can just turn off DoH if it causes problems for you. In my experience, the Chromecast and Google Assistant functionality isn't related to your DNS setup. Chromecast should work through broadcast or through an active request from HASS itself, and the Google integration has always gone through the cloud as far as I know. Perhaps your setup is different than mine, but I don't think these issues are necessarily DNS related, unless Google's servers are getting your local IP when they query for the HASS domain.
- jeena 5y ago
  Sadly Google Assistant does need to use the DNS setup because I play local media for announcements on it and every time the DNS is broken it stops working and doesn't play any local media anymore. Basically home assistant media player plays a mp3 which is stored on the raspberry pi on the Google Assistant, for example when someone opens the out door it plays a chime on all Google Assistants in the whole house so that my parents know that someone opened the door downstairs. The url will be https://myparentshouse.duckdns.org/local/open-door.mp3 https://myparentshouse.duckdns.org/local/open-door.mp3 so if the Google Assistant doesn't use the local DNS it can't resolve the domain to the local raspberry pi, and instead resolves it to the public IP address which then without the Loopback NAT doesn't go anywhere. I understand that I should then instead of using Google Assistant for that to use something else, but I haven't found any free hardware which would have the functionality of good microphones and working speech to text yet.