5 ms·

Software that does its own resolution will not run on my network, and we have banned it by policy at work. Of course it becomes another game of whack-a-mole. M

by _jal 5y ago

Software that does its own resolution will not run on my network, and we have banned it by policy at work. Of course it becomes another game of whack-a-mole. My house, my rules; you don't get to subvert my network security and continue to use my network.

creatonez 5y ago
Right, and the feature is not designed for you. It's designed for the billions of users who are not on your network, and are sitting in their own home or in a coffee shop where there is no such security policy or skilled network administrator in sight. Aside: If you are using Firefox in an enterprise environment, you should be locking the settings to begin with. If I remember correctly, the Firefox ESR downloads don't even prompt about enabling DoH.
jeroenhd 5y ago
That's a perfectly acceptable policy to have, but you'll have to check and monitor that policy like you always have. You can add an A/AAAA record for use-application-dns.net and Firefox won't turn on DoH on your network unless the user overrides it. Chrome's DoH model will use your existing DNS server: if it supports DoH, Chrome switches to DoH, otherwise it'll stick to normal DNS. Do note that malware and even legitimate software (some Android apps, some Windows applications) have been using HTTP(S) based domain lookups for years, though, years before DoH was even proposed. I've used free HTTP proxies over fifteen years ago to bypass school filters, for one, and that's without any infrastructure of my own! You'll have to configure an intercepting proxy to exclusively allow traffic through if you want to catch problematic software in the act, and add some pretty sophisticated filtering. With the modern take on inserting your own certificate authority (certificate pinning, unrooted Android, NodeJS, etc. all avoiding your user certificate store) you'll have to go through great lengths to get that working, though. Truth be told, DNS was never really much of a security measure if you don't have control over what applications do or do not use it.
- denkmoon 5y ago
  Therefore we should cede more control?
  - jeroenhd 5y ago
    Of course not. That's why you can disable DoH on the software you install, and have the choice (in the EU) to return a product you bought online within 14 days if it doesn't live up to your expectations, or not buy the product at all. However, it should be clear that we're not ceding control, per se, as we have never had control over these closed source devices in the first place! We should instead be working to gain control over our devices through open source efforts so that we can control what our hardware can and cannot do. For what it's worth, there is a thread on XDA about customising Chromecast firmware that should allow you to hack the device to disable any unwanted behaviour, but I can't say if that method still works.
- creatonez 5y ago
  > You can add an A/AAAA record for use-application-dns.net and Firefox won't turn on DoH on your network unless the user overrides it. Out of curiosity, is there any other software that respects this by default?
  - jeroenhd 5y ago
    So far, Firefox is the only browser that has announced support for this. Chrome takes another approach, which is to test the system DNS server for DoH capabilities and to switch to DoH when the resolver supports it. Chrome does have a fallback to Google's DNS if it determines that your DNS server is broken, but you should be able to disable that. That means you can secure your network by picking an existing DNS server that also provides a DoH server and Chrome should pick it up by default! I believe Microsoft announced a similar approach to Google, but from what I can find you still need to enable DoH manually anyway. In all cases, the end user can override your domain settings unless your group policies (or similar) lock these settings.
    - lxgr 5y ago
      Does that really work for arbitrary DNS servers? If so, how? I thought there‘s just a short, hardcoded list of known DoH-supporting DNS IPs.
      - jeroenhd 5y ago
        That's the Firefox approach, yes: provide a list of trusted DoH servers and use that to avoid scummy ISP servers that might monitor, intercept, or mess with DNS records. Chrome has a separate list of DNS servers that it knows can also do DoH. It doesn't change the DNS server, it just changes the mechanism in which the server is queried: - https://blog.chromium.org/2020/05/a-safer-and-more-private-browsing-DoH.html https://blog.chromium.org/2020/05/a-safer-and-more-private-b... - https://blog.chromium.org/2020/09/a-safer-and-more-private-browsing.html https://blog.chromium.org/2020/09/a-safer-and-more-private-b... I believe their intent was to auto upgrade existing all DNS servers if they support DoH, but I'm not so sure anymore; perhaps some other product was doing that instead. In theory it shouldn't be too difficult: send a TLS request to dns.server:443, extract the hostname from the TLS handshake, and do a lookup through https://hostname/dns-query https://hostname/dns-query (with the IP address hardcoded for the socket to prevent redirect attacks).
- girvo 5y ago
  > I've used free HTTP proxies over fifteen years ago to bypass school filters, for one, and that's without any infrastructure of my own! I did the same, back in the early-mid 2000s. My favourite were the ones that used ROT13 to get around school filtering of domain names (and banned words in them). Was very cute.
tptacek 5y ago
This is simple: people like you are best served by a policy that manages this kind of policy at the system or network layer. But most people aren't. For most people, the managers of their networks are adversaries. Firefox should, by default, serve most people --- not just nerds like us with strong opinions about the "system resolver". There is no moral authority to the system resolver. It's a convenience, not a contract.
josephcsible 5y ago
You should not get to censor people's view of the Internet just because you're providing the connection, just like the gas/electric company doesn't get to decide what you can and can't cook on your stove even though they provide the energy it uses to work. And if you really only mean your own devices, then enforce your policy on the endpoints instead.

by _jal 5y ago

creatonez 5y ago

Right, and the feature is not designed for you. It's designed for the billions of users who are not on your network, and are sitting in their own home or in a coffee shop where there is no such security policy or skilled network administrator in sight. Aside: If you are using Firefox in an enterprise environment, you should be locking the settings to begin with. If I remember correctly, the Firefox ESR downloads don't even prompt about enabling DoH.

jeroenhd 5y ago

That's a perfectly acceptable policy to have, but you'll have to check and monitor that policy like you always have. You can add an A/AAAA record for use-application-dns.net and Firefox won't turn on DoH on your network unless the user overrides it. Chrome's DoH model will use your existing DNS server: if it supports DoH, Chrome switches to DoH, otherwise it'll stick to normal DNS. Do note that malware and even legitimate software (some Android apps, some Windows applications) have been using HTTP(S) based domain lookups for years, though, years before DoH was even proposed. I've used free HTTP proxies over fifteen years ago to bypass school filters, for one, and that's without any infrastructure of my own! You'll have to configure an intercepting proxy to exclusively allow traffic through if you want to catch problematic software in the act, and add some pretty sophisticated filtering. With the modern take on inserting your own certificate authority (certificate pinning, unrooted Android, NodeJS, etc. all avoiding your user certificate store) you'll have to go through great lengths to get that working, though. Truth be told, DNS was never really much of a security measure if you don't have control over what applications do or do not use it.

denkmoon 5y ago
Therefore we should cede more control?
- jeroenhd 5y ago
  Of course not. That's why you can disable DoH on the software you install, and have the choice (in the EU) to return a product you bought online within 14 days if it doesn't live up to your expectations, or not buy the product at all. However, it should be clear that we're not ceding control, per se, as we have never had control over these closed source devices in the first place! We should instead be working to gain control over our devices through open source efforts so that we can control what our hardware can and cannot do. For what it's worth, there is a thread on XDA about customising Chromecast firmware that should allow you to hack the device to disable any unwanted behaviour, but I can't say if that method still works.
creatonez 5y ago
> You can add an A/AAAA record for use-application-dns.net and Firefox won't turn on DoH on your network unless the user overrides it. Out of curiosity, is there any other software that respects this by default?
- jeroenhd 5y ago
  So far, Firefox is the only browser that has announced support for this. Chrome takes another approach, which is to test the system DNS server for DoH capabilities and to switch to DoH when the resolver supports it. Chrome does have a fallback to Google's DNS if it determines that your DNS server is broken, but you should be able to disable that. That means you can secure your network by picking an existing DNS server that also provides a DoH server and Chrome should pick it up by default! I believe Microsoft announced a similar approach to Google, but from what I can find you still need to enable DoH manually anyway. In all cases, the end user can override your domain settings unless your group policies (or similar) lock these settings.
  - lxgr 5y ago
    Does that really work for arbitrary DNS servers? If so, how? I thought there‘s just a short, hardcoded list of known DoH-supporting DNS IPs.
    - jeroenhd 5y ago
      That's the Firefox approach, yes: provide a list of trusted DoH servers and use that to avoid scummy ISP servers that might monitor, intercept, or mess with DNS records. Chrome has a separate list of DNS servers that it knows can also do DoH. It doesn't change the DNS server, it just changes the mechanism in which the server is queried: - https://blog.chromium.org/2020/05/a-safer-and-more-private-browsing-DoH.html https://blog.chromium.org/2020/05/a-safer-and-more-private-b... - https://blog.chromium.org/2020/09/a-safer-and-more-private-browsing.html https://blog.chromium.org/2020/09/a-safer-and-more-private-b... I believe their intent was to auto upgrade existing all DNS servers if they support DoH, but I'm not so sure anymore; perhaps some other product was doing that instead. In theory it shouldn't be too difficult: send a TLS request to dns.server:443, extract the hostname from the TLS handshake, and do a lookup through https://hostname/dns-query https://hostname/dns-query (with the IP address hardcoded for the socket to prevent redirect attacks).
girvo 5y ago
> I've used free HTTP proxies over fifteen years ago to bypass school filters, for one, and that's without any infrastructure of my own! I did the same, back in the early-mid 2000s. My favourite were the ones that used ROT13 to get around school filtering of domain names (and banned words in them). Was very cute.

tptacek 5y ago

This is simple: people like you are best served by a policy that manages this kind of policy at the system or network layer. But most people aren't. For most people, the managers of their networks are adversaries. Firefox should, by default, serve most people --- not just nerds like us with strong opinions about the "system resolver". There is no moral authority to the system resolver. It's a convenience, not a contract.

josephcsible 5y ago

You should not get to censor people's view of the Internet just because you're providing the connection, just like the gas/electric company doesn't get to decide what you can and can't cook on your stove even though they provide the energy it uses to work. And if you really only mean your own devices, then enforce your policy on the endpoints instead.