14 ms·

DNS-over-HTTP/3 in Android

165 points by nixcraft 4y ago

StreamBright 4y ago
"To help keep Android users’ DNS queries private, Android supports encrypted DNS." And DNS based ad filtering impossible.
- est31 4y ago
  Yeah this is likely the #1 reason why it's been implemented by Google. It's sad that this is one of the first Rust features. Proprietary and user hostile.
  - staticassertion 4y ago
    It doesn't make DNS based ad filtering impossible unless you're doing that at the router level. You can still do it locally (like via hosts file) or via the DNS resolver itself.
    - est31 4y ago
      Both hosts file and custom DNS resolvers require the device to cooperate.
      - staticassertion 4y ago
        Yes, based on your other comment it sounds like you're concerned about "smart" devices like TVs that are on the internet. It's unfortunate that those devices lock you out but that's kinda on those devices.
    - DownGoat 4y ago
      As I painfully experienced recently, browsers on desktop ignores host file with DoH enabled. Had to create a separate browser profile to get this to work with DoH and other privacy/security settings to work
  - meibo 4y ago
    Could also be that other reason, which might be that you're no longer sending every domain you visit in plaintext over the internet... Not to mention that DNS over HTTP AdBlock is basically just as easy to set up nowadays.
    - throw0101a 4y ago
      > Not to mention that DNS over HTTP AdBlock is basically just as easy to set up nowadays. Only if the device in question uses the ad-blocking DNS servers. Firefox (IIRC) by default does not use the operating system's resolv.conf. Smart TVs (and Chromecast) have also been known to ignore DNS settings from DHCP. * https://labzilla.io/blog/force-dns-pihole https://labzilla.io/blog/force-dns-pihole And since the DNS traffic now looks like HTTP(S) traffic, your only recourse is to block all HTTP access and tunnel it through a proxy. As an IT guy, and the person who runs a home network, this reduces the visibility of what is happening on my network(s). Reduced visibility is bad IMHO.
      - Forbo 4y ago
        You can force Firefox to use use a DNS server of your choosing with a canary domain: https://support.mozilla.org/en-US/kb/canary-domain-use-application-dnsnet https://support.mozilla.org/en-US/kb/canary-domain-use-appli...
        throw0101a 4y ago
        I'd prefer it Firefox was opt-in instead of opt-out, and if they'd just use the OS settings like every other piece of code on my system.
    - jeltz 4y ago
      You will still do so with SNI.
      - est31 4y ago
        Yeah and if you don't use SNI, but the website sits on its own IP, then the website can be found out via the ip, which is transmitted in the clear (unless VPNs/tunneling etc are used).
  - Asooka 4y ago
    If it's user hostile, isn't that against the Rust code of conduct? Can't Google's license to use Rust be revoked in that case?
    - staticassertion 4y ago
      No
- detaro 4y ago
  Isn't DNS based filtering usually done by configuring the device to use a DNS server that filters? (vs intercepting traffic to another server and modifying that)
- darkhorn 4y ago
  Why? Don't you know how to disable or point to your own DoH?
  - est31 4y ago
    If the device e.g. your smart TV, has an option for it, then you can do that. If it hardcodes a bunch of resolvers, you can't do much about it.
    - darkhorn 4y ago
      In Android you can disable it or point it to your own DoH. Classic DNS resolvers can have same "hardcoded" problem.
      - est31 4y ago
        With classic DNS resolvers you can modify the responses on the fly as long as you provide the box its network. Not possible with DoH.
      - iso1631 4y ago
        You just nat UDP/53 traffic and resolve it yourself. Now you have to identify the specific DoH server they're using and block it, and hope it falls back to something you can control.
    - Melatonic 4y ago
      Theoretically you can run a firewall that blocks all common resolvers but its more work
  - WesolyKubeczek 4y ago
    There have been devices that used 8.8.8.8 no matter what your network said. Now, you can obviously make your own 8.8.8.8 for your network, but good luck also supply proper TLS certificates for the encrypted DNS traffic. Yeah, you _still_ can tweak this and you _still_ can configure that, but it’s getting more finicky ever so slightly every time. “Still” is the key, to hint at how volatile it all is.
- stevewatson301 4y ago
  Adding your own DoH server has always been possible, see for example https://developers.cloudflare.com/1.1.1.1/setup/android/ https://developers.cloudflare.com/1.1.1.1/setup/android/ though you can add an adblocking server in its place.
  - kuschku 4y ago
    How do I do that on a Chromecast?
    - jeroenhd 4y ago
      Chromecast doesn't run Android, of course, so I'm not sure how it's relevant to this article. Personally, I've statically routed my Chromecast to forward UDP/53 to my PiHole and it's been very effective so far. Too bad blocking trackers also breaks the applications on Chromecast, making the block effectively useless, but that's the choice I made when I bought one of those things.
  - RF_Savage 4y ago
    But can't the ads in the app also use some known good DoH server?
- ccouzens 4y ago
  It puts the device owner in charge rather than the network owner. I've checked, my android gives me the option to reconfigure it including turning it off. It makes DNS based advert adding Impossible. Hopefully this is the end of captive portals.
mimi89999 4y ago
DNS has known privacy issues, but this solution just (conviniently for them) shifts trust and data from the network operator to Google DNS or another central provider
- staticassertion 4y ago
  If you were using Google DNS already this changes nothing. If you aren't using Google DNS, continue to do so.
- josephcsible 4y ago
  For as bad as Google is, I still trust them more than I do Comcast.
  - sliken 4y ago
    Shudder sure. But why not run your own DNS? Pick a desktop, Pi, server or similar and run a full resolver like unbound. You'll never have issues because your ISPs DNS is slow or dead, and you'll be talking to the root servers directly.
    - josephcsible 4y ago
      Because if I do that, then I have to worry about my ISP hijacking the recursive requests it makes.
      - jeroenhd 4y ago
        DNSSEC protects against that for well-configured domains, though you can't assume people put in the effort. You can use ODoH (https://blog.cloudflare.com/oblivious-dns/ https://blog.cloudflare.com/oblivious-dns/) to double-encrypt your DNS requests and forward them through an external server, disconnecting your query from your response, and encrypting your upstream DNS requests. You can pick any relay from this list: https://download.dnscrypt.info/dnscrypt-resolvers/v3/odoh-relays.md https://download.dnscrypt.info/dnscrypt-resolvers/v3/odoh-re... (need to de-base64 them to get the actual domain) and any upstream DOH server you prefer.
pornel 4y ago
DNS-over-HTTP/2 was a step back in efficiency, but with HTTP/3 (QUIC) things finally fall into place. We have UDP back, and it's with proper encryption built-in.
- jeltz 4y ago
  DNS-over-QUIC should be even more efficient. But perhaps easier to detect and block
- pantalaimon 4y ago
  There is also DNS over DTLS which leaves out HTTP entirely and is still encrypted https://datatracker.ietf.org/doc/html/rfc8094 https://datatracker.ietf.org/doc/html/rfc8094
darkhorn 4y ago
I like DoH a lot. Previously if you were on cellular network you could not change your DNS resolver. But now I have option to change it both from Google Chrome and Android settings. My ISP is no longer be able to log my DNS queries. And also now my ISP is not able to block "illegal" web sites like Wikipedia and Youtube, at least in DNS level.
- staticassertion 4y ago
  The ISP could just block the IP address (they're an ISP, they can just figure it out), or inspect he presented certificate.
  - ignoramous 4y ago
    Not if you share the IP space with many other web properties. For an extreme case of this, see Ao1: https://blog.cloudflare.com/addressing-agility/ https://blog.cloudflare.com/addressing-agility/
  - asabla 4y ago
    It's not that hard setting up your own relay on any cheap vps out there. Good luck blocking all those addresses
    - staticassertion 4y ago
      If you're doing that DoH doesn't change anything
      - yakubin 4y ago
        It doesn't change compared to DoT, but it does compared to raw DNS, since raw DNS is trivial for ISP to intercept, regardless of IPs involved.
  - tialaramex 4y ago
    The ISP can indeed block arbitrary IP addresses. As well as the risk of overblocking (and consequent negative consumer experience, oops, we forgot WikiMedia's controversial project X is also on the same servers as their famous encyclopedia so when we blocked the ~1 in a million customers looking at project X we also broke Wikipedia for all our customers) this is a serious administrative hassle. ISPs are for-profit entities so "We can spend $$$ doing this" is only justified if you can show why it increased revenue more than $$$. You can't see "the presented certificate" on a modern web browser visiting most web sites. In TLS 1.3 (offered by > 55% of 135,000 surveyed web sites) every step after Client Hello is encrypted, so the certificate isn't available to snoops. For now, you can see the SNI in that client Hello, telling the server who they wanted to talk to. However ECH (Encrypted Client Hello) is intended to get rid of that too.
ccouzens 4y ago
Is this open source? Does anyone have a link to the code?
- pas 4y ago
  maybe it's this: https://cs.android.com/android/platform/superproject/+/master:packages/modules/DnsResolver/doh/doh.rs https://cs.android.com/android/platform/superproject/+/maste...
  - codewiz 4y ago
    It is, and since DnsResolver is a system module updated via Play Store, the code you see in AOSP is actually what runs on your phone: https://source.android.com/devices/architecture/modular-system/dns-resolver https://source.android.com/devices/architecture/modular-syst...
collsni 4y ago
- netr0ute 4y ago
  Unforgiving Router Firewall Rules: Allow us to introduce ourselves.
- kevincox 4y ago
  I don't think we should shun secure protocols because they make it harder for us to "hack" devices that we don't control. Instead I think we should embrace the secure option and use it as a wake up call that it isn't worth saving $50 for a Smart TV that shows ads and we should choose devices that respect us so that we can be secure and not be abused.
- johndfsgdgdfg 4y ago
  Thank you for posting this. This is just nothing but a ploy for Google to infringe on our privacy and serve ads to make more money.
- K0nserv 4y ago
  You make it sound like the only resolver available is Google's in which case there might be some merit to your comment. In reality you can pick from many resolver's to fit ones preferences, making your point moot. Even if the default resolve is Google's they could've easily set 8.8.8.8 as the default for all Android devices too, that's an orthogonal concern.
- ac29 4y ago
  > Good luck blocking ads on your smart tv now!! Android's support for custom DNS servers in combination with an ad blocking DNS server has been a very effective system level ad blocker for me. No additional software or hacks like on device VPNs needed.
- sliken 4y ago
  Ew, you give your TV an IP? DNS isn't magic, I've seen numerous devices try DNS, but then fall back to IPs. Found out my TV fingerprints what I watch and uploads that to a central server to analyze what I'm watching, even if I'm watching local content. That was the end of my TVs access to the internet. I bought a Roku and the netflix, youtube, and amazon prime clients run WAY better than they did on the TV, nicer remote as well.
jmyeet 4y ago
It's kinda sad how much of the Internet design comes down to "this is why we can't have nice things". Pretty much everything that can be abused, is. Third party cookies, DNS interception by ISPs, monitoring (and selling) your Web activity and so on. You can really see the Internet was designed for simpler, more innocent times. Take the trash fire that is IPv6 with its stupidly large address space (ie 128 bits). Not 48 or even 64 bits. Why? To give users a /64 address space. Why? Because MAC addresses were 48 bits and the IPv6 designers thought they'd "solve" internal network addressing by just using the MAC address in the /64 bit space. Obviously we don't do that because it's a privacy issue. So it's inevitable that DNS goes the SSL route. It's sad that it comes to that but here we are. I really wish IP had a guaranteed connectionless delivery option (ie TCP without the connection handshake). Yeah I know there are hacks to kind of achieve this. Likewise, a lot of CDNs and big sites use extremely short TTLs for load-balancing and other reasons. DNS lookup can significantly degrade application performance to the point people have done research on the speed up benefits of keeping a warm DNS cache. Adding SSL to the mix isn't going to improve things.
- the8472 4y ago
  I don't like the "simpler, more innocent" phrasing, at least if we consider the innocent ~ naive connotations. It obfuscates that not spending resources on attacks and the perpetual defenses that would render the attacks useless make the system multi-agent optimal as long as those actors don't have extreme future discounting - i.e. as long as they don't try to maximize short-term gains at the expense of making the system less valuable for everyone. And the protocols started out in such an environment where it wasn't really "innocent" to not waste huge amounts of engineering on defenses, it was the sensible thing to do.
  - b112 4y ago
    It all comes back to data collection. All of it. No market, means no motive. If absolutely all collection of Pii was made illegal, or perhaps even all sale of any data based upon it, be it anonomized or not, things would rapidly change. Even better to make illegal all targeted marketing, based upon stored data or info about a user. Adtech would still exist. If you visit a reddit about showers, show shower ads. You don't need to know a single thing, except the page currently visited is about showers... so show shower ads. All of it, massive issues with our democracies, with spying, with tracking, with price fixing, all of it comes back to, what is now, a purely evil industry. User tracking. Take the profit away from all collectable data about a user, and watch things improve fast.
sneak 4y ago
This is cool. I wish Kaminsky were still around to see it.
MishaalRahman 4y ago
DNSResolver was made a modular system component in Android 10 technically, which is why DNS-over-HTTP/3 will also be supported on "some Android 10 devices which adopted Google Play system updates early." Although DNS Resolver was one of the original 13 Project Mainline modules introduced in Android 10, it was optional to implement. It was made mandatory for devices upgrading to or launching with Android 11, however. Go to "Private DNS" settings under Network & Internet (on Pixel, could be called something else on other OEM devices), select "Private DNS provider hostname", and enter 'dns.google' or 'cloudflare-dns.com' for Google DNS and Cloudflare DNS respectively. Android will add the https:// https:// and /dns-query parts of the URL for you. And yes those two providers are hardcoded right now: https://cs.android.com/android/platform/superproject/+/master:packages/modules/DnsResolver/PrivateDnsConfiguration.h;l=241?q=https:%2F%2Fdns.google%2Fdns-query&ss=android https://cs.android.com/android/platform/superproject/+/maste... If it doesn't work for you, then DoH support may not have rolled out or be enabled. To check, run this shell command: cmd device_config get netd_native doh If it returns '1', then DoH support is enabled. It's enabled by default for Android 13 devices, but for Android 11-12, DNSResolver checks this flag. If it's '0', then you can try running: cmd device_config put netd_native doh 1 to enable it.
Communitivity 4y ago
I haven't looked into DNS-over-HTTP/3 (DoH), but there's a secure-ish DNS mechanism already: DNS over Distributed TLS (DoT) [1]. The main criticisms of DoT are that it's hard to analyze for cybersecurity purposes. Except DoT is not encrypted end-to-end but only encrypted hop-to-hop. This means you can put a proxy checking for cybersecurity threats in front of your DoT traffic into or out of your network, if you need to. DoT can also be peer to peer, which can leverage a lot of benefits. DoH is client-server. DoH has all the problems that come with HTTP/s and seems a good way to break one of the most relatively reliable systems of the Internet, in the name of convenience. [1] https://datatracker.ietf.org/doc/html/rfc8094 https://datatracker.ietf.org/doc/html/rfc8094
- tptacek 4y ago
  No, the main criticism of DoT is that it's trivial for network operators to block, because it runs on its own port. The entire reason DoH exists is to get past middleboxes.
- codewiz 4y ago
  DoT is simply DNS-over-TLS (never heard of Distributed TLS). The article linked by this post explains that Android supported DoT since Android 9, but it was problematic because it required frequent TCP handshakes and TLS handshakes. Plus, it could be easily blocked by middle boxes.
  - Melatonic 4y ago
    I think Tmobile is blocking DoT specifically
    - codewiz 4y ago
      Dammit, I use T-Mobile. But they can't easily block DoH, since it looks like regular HTTP/3 traffic on UDP port 443.
  - Communitivity 4y ago
    Ah, thank you. Then DoT is not really what I meant. Distributed TLS, aka Datagram TLS, aka DLTS, is TLS security mechanisms adapted for use with UDP [1]. [1] https://developer.mozilla.org/en-US/docs/Glossary/DTLS https://developer.mozilla.org/en-US/docs/Glossary/DTLS
throw7 4y ago
This is gonna be great for c2 bots.
- detaro 4y ago
  Why would c2 bots care about Android supporting it?
Harvesterify 4y ago
Apparently it is not possible for the moment to specify a custom suffix to the complete URL of a DoH server (for example, with a AdGuard server, I cannot append a client identifier such as dns.contoso.com/dns-query/my-client, while dns.contoso.com is working fine). Will stick to DoT for the moment :) EDIT : ok so only 'dns.google' or 'cloudflare-dns.com' are supported right now, other domains are still using DoT. Pretty useless feature then :(
- codewiz 4y ago
  The problem is that the settings UI only allows typing a hostname, not a full URL. The Settings app is heavily customized by Android vendors and can't be updated on all devices in lockstep with the DnsResolver module. Hopefully it will be fixed starting from Android 13.
leshow 4y ago
They said they implemented the query engine in tokio, a popular async runtime in Rust, but quiche is blocking AFAIK. I wonder how they integrated the two.
- codewiz 4y ago
  No, quiche is agnostic to the event framework used by the application: you have to handle socket I/O externally and hand the data you receive to the quiche connection objects which keep track of protocol state and tell you what to send back. The sample HTTP/3 client and server included with quiche use mio, a simple crate implementing an event model similar to POSIX's poll(): https://github.com/cloudflare/quiche/blob/master/apps/src/client.rs#L267 https://github.com/cloudflare/quiche/blob/master/apps/src/cl...
neodypsis 4y ago
Does it mean that network blockers like piHole can now be bypassed by Android devices? Does Android support "canary domains" like Firefox does (https://support.mozilla.org/en-US/kb/canary-domain-use-application-dnsnet https://support.mozilla.org/en-US/kb/canary-domain-use-appli...) ?
- randomperson_24 4y ago
  You could already use nextdns.io for ad blocking on android phones via DNS over TLS.
  - neodypsis 4y ago
    I doubt that just using nextdns could help in that. Couldn't they just hardcode and make requests to, say 8.8.8.8 or an unknown address, to resolve their DNS-over-HTTP domains?
    - Melatonic 4y ago
      Yes they can. You need to additionally run a firewall on your mobile device (and/or a firewall on your home network) and block all of the common DNS IP. Then only NextDNS or your choice of DNS is available (and encrypted) Google just wants you to use them for DNS so they can still see where you are going :-)
      - SahAssar 4y ago
        Any app that really wants to can just make a request to a plain IP, or have their own DoT/DoH resolver. DNS-based blocking will never block a determined tracker.
- topranks 4y ago
  They already do with DoT. You can always block UDP 443 to stop this, given it’s over QUIC.
  - 4y ago
flakiness 4y ago
I hope they provide HTTP/3 API for app developers :-/ (I know Cronet [1] is an option, but still.) [1] https://developer.android.com/guide/topics/connectivity/cronet https://developer.android.com/guide/topics/connectivity/cron...
codewiz 4y ago
- codewiz 4y ago
  How come these two posts were not auto-merged? The urls are identical.
codewiz 4y ago
Source code of Android's DoH3 client: https://cs.android.com/android/platform/superproject/+/master:packages/modules/DnsResolver/doh/;bpv=1;bpt=0 https://cs.android.com/android/platform/superproject/+/maste...
- PowerfulWizard 4y ago
  Thanks I was looking for this.
casta 4y ago
Thank you https://news.ycombinator.com/user?id=codewiz https://news.ycombinator.com/user?id=codewiz for pushing for this before leaving Google. :)

165 points by nixcraft 4y ago

"To help keep Android users’ DNS queries private, Android supports encrypted DNS." And DNS based ad filtering impossible.

est31 4y ago
Yeah this is likely the #1 reason why it's been implemented by Google. It's sad that this is one of the first Rust features. Proprietary and user hostile.
- staticassertion 4y ago
  It doesn't make DNS based ad filtering impossible unless you're doing that at the router level. You can still do it locally (like via hosts file) or via the DNS resolver itself.
  - est31 4y ago
    Both hosts file and custom DNS resolvers require the device to cooperate.
    - staticassertion 4y ago
      Yes, based on your other comment it sounds like you're concerned about "smart" devices like TVs that are on the internet. It's unfortunate that those devices lock you out but that's kinda on those devices.
  - DownGoat 4y ago
    As I painfully experienced recently, browsers on desktop ignores host file with DoH enabled. Had to create a separate browser profile to get this to work with DoH and other privacy/security settings to work
- meibo 4y ago
  Could also be that other reason, which might be that you're no longer sending every domain you visit in plaintext over the internet... Not to mention that DNS over HTTP AdBlock is basically just as easy to set up nowadays.
  - throw0101a 4y ago
    > Not to mention that DNS over HTTP AdBlock is basically just as easy to set up nowadays. Only if the device in question uses the ad-blocking DNS servers. Firefox (IIRC) by default does not use the operating system's resolv.conf. Smart TVs (and Chromecast) have also been known to ignore DNS settings from DHCP. * https://labzilla.io/blog/force-dns-pihole https://labzilla.io/blog/force-dns-pihole And since the DNS traffic now looks like HTTP(S) traffic, your only recourse is to block all HTTP access and tunnel it through a proxy. As an IT guy, and the person who runs a home network, this reduces the visibility of what is happening on my network(s). Reduced visibility is bad IMHO.
    - Forbo 4y ago
      You can force Firefox to use use a DNS server of your choosing with a canary domain: https://support.mozilla.org/en-US/kb/canary-domain-use-application-dnsnet https://support.mozilla.org/en-US/kb/canary-domain-use-appli...
      - throw0101a 4y ago
        I'd prefer it Firefox was opt-in instead of opt-out, and if they'd just use the OS settings like every other piece of code on my system.
  - jeltz 4y ago
    You will still do so with SNI.
    - est31 4y ago
      Yeah and if you don't use SNI, but the website sits on its own IP, then the website can be found out via the ip, which is transmitted in the clear (unless VPNs/tunneling etc are used).
- Asooka 4y ago
  If it's user hostile, isn't that against the Rust code of conduct? Can't Google's license to use Rust be revoked in that case?
  - staticassertion 4y ago
    No
detaro 4y ago
Isn't DNS based filtering usually done by configuring the device to use a DNS server that filters? (vs intercepting traffic to another server and modifying that)
darkhorn 4y ago
Why? Don't you know how to disable or point to your own DoH?
- est31 4y ago
  If the device e.g. your smart TV, has an option for it, then you can do that. If it hardcodes a bunch of resolvers, you can't do much about it.
  - darkhorn 4y ago
    In Android you can disable it or point it to your own DoH. Classic DNS resolvers can have same "hardcoded" problem.
    - est31 4y ago
      With classic DNS resolvers you can modify the responses on the fly as long as you provide the box its network. Not possible with DoH.
    - iso1631 4y ago
      You just nat UDP/53 traffic and resolve it yourself. Now you have to identify the specific DoH server they're using and block it, and hope it falls back to something you can control.
  - Melatonic 4y ago
    Theoretically you can run a firewall that blocks all common resolvers but its more work
- WesolyKubeczek 4y ago
  There have been devices that used 8.8.8.8 no matter what your network said. Now, you can obviously make your own 8.8.8.8 for your network, but good luck also supply proper TLS certificates for the encrypted DNS traffic. Yeah, you _still_ can tweak this and you _still_ can configure that, but it’s getting more finicky ever so slightly every time. “Still” is the key, to hint at how volatile it all is.
stevewatson301 4y ago
Adding your own DoH server has always been possible, see for example https://developers.cloudflare.com/1.1.1.1/setup/android/ https://developers.cloudflare.com/1.1.1.1/setup/android/ though you can add an adblocking server in its place.
- kuschku 4y ago
  How do I do that on a Chromecast?
  - jeroenhd 4y ago
    Chromecast doesn't run Android, of course, so I'm not sure how it's relevant to this article. Personally, I've statically routed my Chromecast to forward UDP/53 to my PiHole and it's been very effective so far. Too bad blocking trackers also breaks the applications on Chromecast, making the block effectively useless, but that's the choice I made when I bought one of those things.
- RF_Savage 4y ago
  But can't the ads in the app also use some known good DoH server?
ccouzens 4y ago
It puts the device owner in charge rather than the network owner. I've checked, my android gives me the option to reconfigure it including turning it off. It makes DNS based advert adding Impossible. Hopefully this is the end of captive portals.

mimi89999 4y ago

DNS has known privacy issues, but this solution just (conviniently for them) shifts trust and data from the network operator to Google DNS or another central provider

staticassertion 4y ago
If you were using Google DNS already this changes nothing. If you aren't using Google DNS, continue to do so.
josephcsible 4y ago
For as bad as Google is, I still trust them more than I do Comcast.
- sliken 4y ago
  Shudder sure. But why not run your own DNS? Pick a desktop, Pi, server or similar and run a full resolver like unbound. You'll never have issues because your ISPs DNS is slow or dead, and you'll be talking to the root servers directly.
  - josephcsible 4y ago
    Because if I do that, then I have to worry about my ISP hijacking the recursive requests it makes.
    - jeroenhd 4y ago
      DNSSEC protects against that for well-configured domains, though you can't assume people put in the effort. You can use ODoH (https://blog.cloudflare.com/oblivious-dns/ https://blog.cloudflare.com/oblivious-dns/) to double-encrypt your DNS requests and forward them through an external server, disconnecting your query from your response, and encrypting your upstream DNS requests. You can pick any relay from this list: https://download.dnscrypt.info/dnscrypt-resolvers/v3/odoh-relays.md https://download.dnscrypt.info/dnscrypt-resolvers/v3/odoh-re... (need to de-base64 them to get the actual domain) and any upstream DOH server you prefer.

pornel 4y ago

DNS-over-HTTP/2 was a step back in efficiency, but with HTTP/3 (QUIC) things finally fall into place. We have UDP back, and it's with proper encryption built-in.

jeltz 4y ago
DNS-over-QUIC should be even more efficient. But perhaps easier to detect and block
pantalaimon 4y ago
There is also DNS over DTLS which leaves out HTTP entirely and is still encrypted https://datatracker.ietf.org/doc/html/rfc8094 https://datatracker.ietf.org/doc/html/rfc8094

darkhorn 4y ago

I like DoH a lot. Previously if you were on cellular network you could not change your DNS resolver. But now I have option to change it both from Google Chrome and Android settings. My ISP is no longer be able to log my DNS queries. And also now my ISP is not able to block "illegal" web sites like Wikipedia and Youtube, at least in DNS level.

staticassertion 4y ago
The ISP could just block the IP address (they're an ISP, they can just figure it out), or inspect he presented certificate.
- ignoramous 4y ago
  Not if you share the IP space with many other web properties. For an extreme case of this, see Ao1: https://blog.cloudflare.com/addressing-agility/ https://blog.cloudflare.com/addressing-agility/
- asabla 4y ago
  It's not that hard setting up your own relay on any cheap vps out there. Good luck blocking all those addresses
  - staticassertion 4y ago
    If you're doing that DoH doesn't change anything
    - yakubin 4y ago
      It doesn't change compared to DoT, but it does compared to raw DNS, since raw DNS is trivial for ISP to intercept, regardless of IPs involved.
- tialaramex 4y ago
  The ISP can indeed block arbitrary IP addresses. As well as the risk of overblocking (and consequent negative consumer experience, oops, we forgot WikiMedia's controversial project X is also on the same servers as their famous encyclopedia so when we blocked the ~1 in a million customers looking at project X we also broke Wikipedia for all our customers) this is a serious administrative hassle. ISPs are for-profit entities so "We can spend $$$ doing this" is only justified if you can show why it increased revenue more than $$$. You can't see "the presented certificate" on a modern web browser visiting most web sites. In TLS 1.3 (offered by > 55% of 135,000 surveyed web sites) every step after Client Hello is encrypted, so the certificate isn't available to snoops. For now, you can see the SNI in that client Hello, telling the server who they wanted to talk to. However ECH (Encrypted Client Hello) is intended to get rid of that too.

ccouzens 4y ago

Is this open source? Does anyone have a link to the code?

pas 4y ago
maybe it's this: https://cs.android.com/android/platform/superproject/+/master:packages/modules/DnsResolver/doh/doh.rs https://cs.android.com/android/platform/superproject/+/maste...
- codewiz 4y ago
  It is, and since DnsResolver is a system module updated via Play Store, the code you see in AOSP is actually what runs on your phone: https://source.android.com/devices/architecture/modular-system/dns-resolver https://source.android.com/devices/architecture/modular-syst...

collsni 4y ago

netr0ute 4y ago
Unforgiving Router Firewall Rules: Allow us to introduce ourselves.
kevincox 4y ago
I don't think we should shun secure protocols because they make it harder for us to "hack" devices that we don't control. Instead I think we should embrace the secure option and use it as a wake up call that it isn't worth saving $50 for a Smart TV that shows ads and we should choose devices that respect us so that we can be secure and not be abused.
johndfsgdgdfg 4y ago
Thank you for posting this. This is just nothing but a ploy for Google to infringe on our privacy and serve ads to make more money.
K0nserv 4y ago
You make it sound like the only resolver available is Google's in which case there might be some merit to your comment. In reality you can pick from many resolver's to fit ones preferences, making your point moot. Even if the default resolve is Google's they could've easily set 8.8.8.8 as the default for all Android devices too, that's an orthogonal concern.
ac29 4y ago
> Good luck blocking ads on your smart tv now!! Android's support for custom DNS servers in combination with an ad blocking DNS server has been a very effective system level ad blocker for me. No additional software or hacks like on device VPNs needed.
sliken 4y ago
Ew, you give your TV an IP? DNS isn't magic, I've seen numerous devices try DNS, but then fall back to IPs. Found out my TV fingerprints what I watch and uploads that to a central server to analyze what I'm watching, even if I'm watching local content. That was the end of my TVs access to the internet. I bought a Roku and the netflix, youtube, and amazon prime clients run WAY better than they did on the TV, nicer remote as well.

jmyeet 4y ago

It's kinda sad how much of the Internet design comes down to "this is why we can't have nice things". Pretty much everything that can be abused, is. Third party cookies, DNS interception by ISPs, monitoring (and selling) your Web activity and so on. You can really see the Internet was designed for simpler, more innocent times. Take the trash fire that is IPv6 with its stupidly large address space (ie 128 bits). Not 48 or even 64 bits. Why? To give users a /64 address space. Why? Because MAC addresses were 48 bits and the IPv6 designers thought they'd "solve" internal network addressing by just using the MAC address in the /64 bit space. Obviously we don't do that because it's a privacy issue. So it's inevitable that DNS goes the SSL route. It's sad that it comes to that but here we are. I really wish IP had a guaranteed connectionless delivery option (ie TCP without the connection handshake). Yeah I know there are hacks to kind of achieve this. Likewise, a lot of CDNs and big sites use extremely short TTLs for load-balancing and other reasons. DNS lookup can significantly degrade application performance to the point people have done research on the speed up benefits of keeping a warm DNS cache. Adding SSL to the mix isn't going to improve things.

the8472 4y ago
I don't like the "simpler, more innocent" phrasing, at least if we consider the innocent ~ naive connotations. It obfuscates that not spending resources on attacks and the perpetual defenses that would render the attacks useless make the system multi-agent optimal as long as those actors don't have extreme future discounting - i.e. as long as they don't try to maximize short-term gains at the expense of making the system less valuable for everyone. And the protocols started out in such an environment where it wasn't really "innocent" to not waste huge amounts of engineering on defenses, it was the sensible thing to do.
- b112 4y ago
  It all comes back to data collection. All of it. No market, means no motive. If absolutely all collection of Pii was made illegal, or perhaps even all sale of any data based upon it, be it anonomized or not, things would rapidly change. Even better to make illegal all targeted marketing, based upon stored data or info about a user. Adtech would still exist. If you visit a reddit about showers, show shower ads. You don't need to know a single thing, except the page currently visited is about showers... so show shower ads. All of it, massive issues with our democracies, with spying, with tracking, with price fixing, all of it comes back to, what is now, a purely evil industry. User tracking. Take the profit away from all collectable data about a user, and watch things improve fast.

sneak 4y ago

This is cool. I wish Kaminsky were still around to see it.

MishaalRahman 4y ago

DNSResolver was made a modular system component in Android 10 technically, which is why DNS-over-HTTP/3 will also be supported on "some Android 10 devices which adopted Google Play system updates early." Although DNS Resolver was one of the original 13 Project Mainline modules introduced in Android 10, it was optional to implement. It was made mandatory for devices upgrading to or launching with Android 11, however. Go to "Private DNS" settings under Network & Internet (on Pixel, could be called something else on other OEM devices), select "Private DNS provider hostname", and enter 'dns.google' or 'cloudflare-dns.com' for Google DNS and Cloudflare DNS respectively. Android will add the https:// https:// and /dns-query parts of the URL for you. And yes those two providers are hardcoded right now: https://cs.android.com/android/platform/superproject/+/master:packages/modules/DnsResolver/PrivateDnsConfiguration.h;l=241?q=https:%2F%2Fdns.google%2Fdns-query&ss=android https://cs.android.com/android/platform/superproject/+/maste... If it doesn't work for you, then DoH support may not have rolled out or be enabled. To check, run this shell command: cmd device_config get netd_native doh If it returns '1', then DoH support is enabled. It's enabled by default for Android 13 devices, but for Android 11-12, DNSResolver checks this flag. If it's '0', then you can try running: cmd device_config put netd_native doh 1 to enable it.

Communitivity 4y ago

I haven't looked into DNS-over-HTTP/3 (DoH), but there's a secure-ish DNS mechanism already: DNS over Distributed TLS (DoT) [1]. The main criticisms of DoT are that it's hard to analyze for cybersecurity purposes. Except DoT is not encrypted end-to-end but only encrypted hop-to-hop. This means you can put a proxy checking for cybersecurity threats in front of your DoT traffic into or out of your network, if you need to. DoT can also be peer to peer, which can leverage a lot of benefits. DoH is client-server. DoH has all the problems that come with HTTP/s and seems a good way to break one of the most relatively reliable systems of the Internet, in the name of convenience. [1] https://datatracker.ietf.org/doc/html/rfc8094 https://datatracker.ietf.org/doc/html/rfc8094

tptacek 4y ago
No, the main criticism of DoT is that it's trivial for network operators to block, because it runs on its own port. The entire reason DoH exists is to get past middleboxes.
codewiz 4y ago
DoT is simply DNS-over-TLS (never heard of Distributed TLS). The article linked by this post explains that Android supported DoT since Android 9, but it was problematic because it required frequent TCP handshakes and TLS handshakes. Plus, it could be easily blocked by middle boxes.
- Melatonic 4y ago
  I think Tmobile is blocking DoT specifically
  - codewiz 4y ago
    Dammit, I use T-Mobile. But they can't easily block DoH, since it looks like regular HTTP/3 traffic on UDP port 443.
- Communitivity 4y ago
  Ah, thank you. Then DoT is not really what I meant. Distributed TLS, aka Datagram TLS, aka DLTS, is TLS security mechanisms adapted for use with UDP [1]. [1] https://developer.mozilla.org/en-US/docs/Glossary/DTLS https://developer.mozilla.org/en-US/docs/Glossary/DTLS

throw7 4y ago

This is gonna be great for c2 bots.

detaro 4y ago
Why would c2 bots care about Android supporting it?

Harvesterify 4y ago

Apparently it is not possible for the moment to specify a custom suffix to the complete URL of a DoH server (for example, with a AdGuard server, I cannot append a client identifier such as dns.contoso.com/dns-query/my-client, while dns.contoso.com is working fine). Will stick to DoT for the moment :) EDIT : ok so only 'dns.google' or 'cloudflare-dns.com' are supported right now, other domains are still using DoT. Pretty useless feature then :(

codewiz 4y ago
The problem is that the settings UI only allows typing a hostname, not a full URL. The Settings app is heavily customized by Android vendors and can't be updated on all devices in lockstep with the DnsResolver module. Hopefully it will be fixed starting from Android 13.

leshow 4y ago

They said they implemented the query engine in tokio, a popular async runtime in Rust, but quiche is blocking AFAIK. I wonder how they integrated the two.

codewiz 4y ago
No, quiche is agnostic to the event framework used by the application: you have to handle socket I/O externally and hand the data you receive to the quiche connection objects which keep track of protocol state and tell you what to send back. The sample HTTP/3 client and server included with quiche use mio, a simple crate implementing an event model similar to POSIX's poll(): https://github.com/cloudflare/quiche/blob/master/apps/src/client.rs#L267 https://github.com/cloudflare/quiche/blob/master/apps/src/cl...

neodypsis 4y ago

Does it mean that network blockers like piHole can now be bypassed by Android devices? Does Android support "canary domains" like Firefox does (https://support.mozilla.org/en-US/kb/canary-domain-use-application-dnsnet https://support.mozilla.org/en-US/kb/canary-domain-use-appli...) ?

randomperson_24 4y ago
You could already use nextdns.io for ad blocking on android phones via DNS over TLS.
- neodypsis 4y ago
  I doubt that just using nextdns could help in that. Couldn't they just hardcode and make requests to, say 8.8.8.8 or an unknown address, to resolve their DNS-over-HTTP domains?
  - Melatonic 4y ago
    Yes they can. You need to additionally run a firewall on your mobile device (and/or a firewall on your home network) and block all of the common DNS IP. Then only NextDNS or your choice of DNS is available (and encrypted) Google just wants you to use them for DNS so they can still see where you are going :-)
    - SahAssar 4y ago
      Any app that really wants to can just make a request to a plain IP, or have their own DoT/DoH resolver. DNS-based blocking will never block a determined tracker.
topranks 4y ago
They already do with DoT. You can always block UDP 443 to stop this, given it’s over QUIC.
- 4y ago

flakiness 4y ago

I hope they provide HTTP/3 API for app developers :-/ (I know Cronet [1] is an option, but still.) [1] https://developer.android.com/guide/topics/connectivity/cronet https://developer.android.com/guide/topics/connectivity/cron...

codewiz 4y ago

codewiz 4y ago
How come these two posts were not auto-merged? The urls are identical.

codewiz 4y ago

Source code of Android's DoH3 client: https://cs.android.com/android/platform/superproject/+/master:packages/modules/DnsResolver/doh/;bpv=1;bpt=0 https://cs.android.com/android/platform/superproject/+/maste...

PowerfulWizard 4y ago
Thanks I was looking for this.

casta 4y ago

Thank you https://news.ycombinator.com/user?id=codewiz https://news.ycombinator.com/user?id=codewiz for pushing for this before leaving Google. :)