5 ms·

> 5) Privacy is already solved using "DNS over https". Both yes and no. It shields the user from ISP's DNS-based invigilation but at the same time it hides app

> 5) Privacy is already solved using "DNS over https". Both yes and no. It shields the user from ISP's DNS-based invigilation but at the same time it hides application requests from the user, renders user's own DNS-based filtering (pihole and such) useless and can just transfer spying ability from local ISP to big corp. Probably an unpopular opinion but personally, I don't consider DoH as an upgrade but a deprivation of user's control. I see its theoretical benefits for less technical users who haven't heard of pihole or even problems that it solves. Just theoretical, because what benefits the user is often in opposition to what benefits the corporation.

piaste 4y ago
I imagine the GNU answer would be that you shouldn't run hostile / nonfree software on your machines, and you should simply be able to tell your software not to contact undesired servers (via configuration or, worst case scenario, recompilation). Having recently fully de-Big-Teched all my devices, I have the luxury of agreeing with that philosophy. As a slightly less harsh compromise, even if you run hostile apps you should be able to install a personal root certificate on your devices and MITM their traffic. Still, I imagine most IoT devices don't give you any way to do so, so you should avoid them or keep them disconnected from the wider Internet if they're still useful otherwise. Either way, the pihole corner case is not a very good argument against DoH, which is far more often a security improvement. A better argument is the big corp one, since DoH indirectly boosts their power (because a self-hosted site becomes less anonymous than one hosted on a shared AWS IP).
- folkrav 4y ago
  > Having recently fully de-Big-Teched all my devices, I have the luxury of agreeing with that philosophy. I'm curious as to what this entailed for you. To me this sounds like I'd cut off contact with over half my family. The social media I could get around/ignore altogether, but I never figured out how I'd manage the messaging situation.
  - piaste 4y ago
    I was inaccurate, sorry. My devices only run either Linux or rooted LineageOS, but I do run some hostile Big Tech apps on them like WhatsApp or Tinder. However, I use tools like TrackerControl and Insular to prevent them from calling hosts other than those I have explicitly whitelisted, or from accessing data they shouldn't. I still avoid installing them when possible. Facebook, Airbnb, and many others work just fine via their websites.
  - NullPrefix 4y ago
    Is anything wrong with Matrix?
    - folkrav 4y ago
      Honestly just never explored it much, but my whole family and friend circle is on Facebook Messenger. Does this work through Matrix in some way?
NoGravitas 4y ago
It solves the problem of your ISP's DNS resolver being hostile in one way or another. But you still have to have complete trust in the resolver you choose. Which is not great if most people choose $BIGCORP's resolver.
jeroenhd 4y ago
In my opinion, most of DoH's protocol problems (and implicated problems) have been solved by oblivious DoH. We still need more ODoH proxies for me to completely trust the system, but any ISP could set those up if they wanted to. There's probably some information that can be extracted from the encrypted DoH request, but I don't think it's anywhere close to the problem DoH posed when it was first introduced (and more importantly, the problems caused by the way it was introduced in Firefox). I think the benefits massively outweigh the disadvantages. Leveraging alternative protocols for DNS has always been an option and always will be. Apps and IoT have been doing this for years. Any application that cares about being blocked can trivially work around DNS problems with their own HTTPS-derived protocol and some do. What's left to block are the companies that won't deal with DoH problems anyway. The control DNS interception provides is mostly an illusion. Kids at high school know how to bypass DNS blocks; application developers can be even harder to block. The only solution is to not run untrusted software in your network, or work with a traffic whitelist for hardware and software you can't control.
tptacek 4y ago
You can simply run your own DoH endpoint, or use the endpoint of someone you trust.
- hericium 4y ago
  What about software that could query another endpoint without my knowledge? Even early Google Chrome shat on OS DNS settings and was querying 8.8.8.8 but that could be filtered.
  - tptacek 4y ago
    What about it? If you can't trust it, you can't trust it. You either control it, don't control it and don't care, or don't control and it's a moot point. Nothing you deploy even needs to use "real DNS" to look things up; it could just set up a TLS channel with an IPv4 rendezvous. The idea that everyone else should have to use a DNS transport that ISPs can filter to downgrade back to being snoopable just so you can feel better about what your Chromecast or Amazon Stick or whatever does on your network doesn't make a whole lot of sense. I don't mean to put a bunch of stuff on you that you didn't say, but this is a very common pushback to DoH, and it makes no sense.
    - hericium 4y ago
      > The idea that everyone else should have to use a DNS transport that ISPs can filter to downgrade back to being snoopable just so you can feel better You're imagining things.
      - tptacek 4y ago
        That ISPs are blocking DoT so they can continue monetizing DNS metrics? No, that's happening.
raverbashing 4y ago
> but at the same time it hides application requests from the user, renders user's own DNS-based filtering (pihole and such) useless Can't you proxy it over a local DNS-over-https server that will provide filtering/caching and then have it query the upstream server?
- hericium 4y ago
  I cannot trust non-free software to use OS DNS settings (Chrome taught me that). I wouldn't want to proxy all HTTPS traffic (may not be possible if software ignores system-wide TLS CAs and uses bundled trust chain). DoH introduces bunch new problems without solving any that I had.
kevin_thibedeau 4y ago
There's no reason that DoH couldn't be a shared OS service.

piaste 4y ago

I imagine the GNU answer would be that you shouldn't run hostile / nonfree software on your machines, and you should simply be able to tell your software not to contact undesired servers (via configuration or, worst case scenario, recompilation). Having recently fully de-Big-Teched all my devices, I have the luxury of agreeing with that philosophy. As a slightly less harsh compromise, even if you run hostile apps you should be able to install a personal root certificate on your devices and MITM their traffic. Still, I imagine most IoT devices don't give you any way to do so, so you should avoid them or keep them disconnected from the wider Internet if they're still useful otherwise. Either way, the pihole corner case is not a very good argument against DoH, which is far more often a security improvement. A better argument is the big corp one, since DoH indirectly boosts their power (because a self-hosted site becomes less anonymous than one hosted on a shared AWS IP).

folkrav 4y ago
> Having recently fully de-Big-Teched all my devices, I have the luxury of agreeing with that philosophy. I'm curious as to what this entailed for you. To me this sounds like I'd cut off contact with over half my family. The social media I could get around/ignore altogether, but I never figured out how I'd manage the messaging situation.
- piaste 4y ago
  I was inaccurate, sorry. My devices only run either Linux or rooted LineageOS, but I do run some hostile Big Tech apps on them like WhatsApp or Tinder. However, I use tools like TrackerControl and Insular to prevent them from calling hosts other than those I have explicitly whitelisted, or from accessing data they shouldn't. I still avoid installing them when possible. Facebook, Airbnb, and many others work just fine via their websites.
- NullPrefix 4y ago
  Is anything wrong with Matrix?
  - folkrav 4y ago
    Honestly just never explored it much, but my whole family and friend circle is on Facebook Messenger. Does this work through Matrix in some way?

NoGravitas 4y ago

It solves the problem of your ISP's DNS resolver being hostile in one way or another. But you still have to have complete trust in the resolver you choose. Which is not great if most people choose $BIGCORP's resolver.

jeroenhd 4y ago

In my opinion, most of DoH's protocol problems (and implicated problems) have been solved by oblivious DoH. We still need more ODoH proxies for me to completely trust the system, but any ISP could set those up if they wanted to. There's probably some information that can be extracted from the encrypted DoH request, but I don't think it's anywhere close to the problem DoH posed when it was first introduced (and more importantly, the problems caused by the way it was introduced in Firefox). I think the benefits massively outweigh the disadvantages. Leveraging alternative protocols for DNS has always been an option and always will be. Apps and IoT have been doing this for years. Any application that cares about being blocked can trivially work around DNS problems with their own HTTPS-derived protocol and some do. What's left to block are the companies that won't deal with DoH problems anyway. The control DNS interception provides is mostly an illusion. Kids at high school know how to bypass DNS blocks; application developers can be even harder to block. The only solution is to not run untrusted software in your network, or work with a traffic whitelist for hardware and software you can't control.

tptacek 4y ago

You can simply run your own DoH endpoint, or use the endpoint of someone you trust.

hericium 4y ago
What about software that could query another endpoint without my knowledge? Even early Google Chrome shat on OS DNS settings and was querying 8.8.8.8 but that could be filtered.
- tptacek 4y ago
  What about it? If you can't trust it, you can't trust it. You either control it, don't control it and don't care, or don't control and it's a moot point. Nothing you deploy even needs to use "real DNS" to look things up; it could just set up a TLS channel with an IPv4 rendezvous. The idea that everyone else should have to use a DNS transport that ISPs can filter to downgrade back to being snoopable just so you can feel better about what your Chromecast or Amazon Stick or whatever does on your network doesn't make a whole lot of sense. I don't mean to put a bunch of stuff on you that you didn't say, but this is a very common pushback to DoH, and it makes no sense.
  - hericium 4y ago
    > The idea that everyone else should have to use a DNS transport that ISPs can filter to downgrade back to being snoopable just so you can feel better You're imagining things.
    - tptacek 4y ago
      That ISPs are blocking DoT so they can continue monetizing DNS metrics? No, that's happening.

raverbashing 4y ago

> but at the same time it hides application requests from the user, renders user's own DNS-based filtering (pihole and such) useless Can't you proxy it over a local DNS-over-https server that will provide filtering/caching and then have it query the upstream server?

hericium 4y ago
I cannot trust non-free software to use OS DNS settings (Chrome taught me that). I wouldn't want to proxy all HTTPS traffic (may not be possible if software ignores system-wide TLS CAs and uses bundled trust chain). DoH introduces bunch new problems without solving any that I had.

kevin_thibedeau 4y ago

There's no reason that DoH couldn't be a shared OS service.