5 ms·

DNS over HTTPS is useful tool that gives users agency instead of being subjected to the system administrator's DNS policy. It means that in many cases I don't n

by easrng 5y ago

DNS over HTTPS is useful tool that gives users agency instead of being subjected to the system administrator's DNS policy. It means that in many cases I don't need to use Tor or a VPN to get around network blocks, except on networks with Fortinet. Fortinet even tries to block Tor, but I made a little tool[1] that tunnels BridgeDB requests over docs.google.com so I don't need to worry about that anymore. [1]: data:text/html,<script>google={visualization:{Query:{setResponse:o=>document.write(atob(o.table.rows.map(e=>e.c[0].v).join("")))}}}</script><script src="https://docs.google.com/spreadsheets/d/1SOK9rEPrVLId1NR4KM-mgDO7tlmRk2K5nNi0tv-9gCY/gviz/tq?tqx=out:json"></script>

easrng 5y ago
For example, my school laptop had Cisco Umbrella forcing DNS connections to itself, but half the time it never responded. Firefox DoH still worked because it didn't rely on the system DNS setting, which needs admin perms to change. Eventually I fixed the problem entirely by escalating to admin with PrintNightmare and deleting Cisco Umbrella altogether.
freedomben 5y ago
As a user it's pretty easy to ignore the DNS settings in DHCP and use whatever you want. An aggressive network admin can identify packets headed to outbound 53 on tcp/udp and block them (or reroute them to the preferred DNS) but they could also block known DoH endpoints. As soon as enterprises realize that DoH is happening, they will definitely do that.
- easrng 5y ago
  But sometimes you're on a device where you can run binaries but don't have admin access. Firefox lets you use a custom DoH server regardless of the DNS settings set by the admin.
  - jeroenhd 5y ago
    If your admin has set up the necessary policies, you won't be able to configure a custom DoH server in Firefox either! That doesn't work for personal devices, of course, but DoH is explicitly not intended to work around system administrators' configuration.
    - easrng 5y ago
      I'm lucky in that my admins are VERY hands-off (I've had a local admin account for months now that they haven't noticed) so that wasn't an issue. Worst case scenario I could probably build or patch Firefox to ignore Group Policy.
      - iJohnDoe 5y ago
        Just wait until you ransomware the whole company and you’ll regret being so smug about about your access.
        easrng 5y ago
        It's a school and my domain account doesn't have access to any other computers. We use GSuite for file sharing.
autoexec 5y ago
> DNS over HTTPS is useful tool that gives users agency instead of being subjected to the system administrator's DNS policy. Seems like in this case it just subjects you to cloudflare's DNS policy (or that of their other "trusted partners")
- josephcsible 5y ago
  Cloudflare has a track record of not tampering with DNS results, unlike a lot of networks' local resolvers.

by easrng 5y ago

easrng 5y ago

For example, my school laptop had Cisco Umbrella forcing DNS connections to itself, but half the time it never responded. Firefox DoH still worked because it didn't rely on the system DNS setting, which needs admin perms to change. Eventually I fixed the problem entirely by escalating to admin with PrintNightmare and deleting Cisco Umbrella altogether.

freedomben 5y ago

As a user it's pretty easy to ignore the DNS settings in DHCP and use whatever you want. An aggressive network admin can identify packets headed to outbound 53 on tcp/udp and block them (or reroute them to the preferred DNS) but they could also block known DoH endpoints. As soon as enterprises realize that DoH is happening, they will definitely do that.

easrng 5y ago
But sometimes you're on a device where you can run binaries but don't have admin access. Firefox lets you use a custom DoH server regardless of the DNS settings set by the admin.
- jeroenhd 5y ago
  If your admin has set up the necessary policies, you won't be able to configure a custom DoH server in Firefox either! That doesn't work for personal devices, of course, but DoH is explicitly not intended to work around system administrators' configuration.
  - easrng 5y ago
    I'm lucky in that my admins are VERY hands-off (I've had a local admin account for months now that they haven't noticed) so that wasn't an issue. Worst case scenario I could probably build or patch Firefox to ignore Group Policy.
    - iJohnDoe 5y ago
      Just wait until you ransomware the whole company and you’ll regret being so smug about about your access.
      - easrng 5y ago
        It's a school and my domain account doesn't have access to any other computers. We use GSuite for file sharing.

autoexec 5y ago

> DNS over HTTPS is useful tool that gives users agency instead of being subjected to the system administrator's DNS policy. Seems like in this case it just subjects you to cloudflare's DNS policy (or that of their other "trusted partners")

josephcsible 5y ago
Cloudflare has a track record of not tampering with DNS results, unlike a lot of networks' local resolvers.