5 ms·

Reading both this link and the previous announcement, I don't understand why they are doing this. Leaving the plain UDP port 53 option surely can't be a big bur

Reading both this link and the previous announcement, I don't understand why they are doing this. Leaving the plain UDP port 53 option surely can't be a big burden. Is this because as a VPN they're committed to privacy? If so, I wonder if this is a net privacy gain. Some people will surely switch to the encrypted versions, but others will just go looking for a different dotted quad to drop in, one possibly less secure.

INTPenis 4y ago
I use UncensoredDNS, which is a much smaller project but also a free DNS service like Mullvad's. And they also shut down all of their unencrypted ports earlier this year. Here[1] is their reason; "The reason for this radical change is twofold: 1) I want encourage adoption of encrypted and authenticated DNS, and 2) I am sick of fighting UDP amplification attacks." 1. https://blog.uncensoreddns.org/blog/39-the-unfriendly-internet-turning-off-cleartext-lookups-in-september/ https://blog.uncensoreddns.org/blog/39-the-unfriendly-intern...
- wpietri 4y ago
  Ah, right. I have questions about the first, but the latter makes a ton of sense to me. Thanks!
- Siira 4y ago
  These encrypted DNS services are usually blocked here in Iran. The unencrypted ones are compromised, too. I use self-hosted dnscrypt.
- RobotToaster 4y ago
  Interesting, I use OpenNIC, another free DNS service, and they don't seem to have any problems.
  - pixl97 4y ago
    "Don't have any problems" and "Don't have problems that they are telling you about" are different things. They may have an abuse@opennic address they've never opened. An ignored problem isn't a problem, well until it is. Or they may deal with it and not mention the costs of doing so.
- 1vuio0pswjnm7 4y ago
  Turning off EDNS and DNSSEC would surely reduce if not eliminate the risk of amplification attacks. If anyone has the idea that traditional 512-byte UDP-based DNS is now useless, then I think that's crazy. I still use it all the time, particularly on the home network. I would be willing to bet some (not all) DoH providers are using traditional 512-byte DNS for their backend queries. I use remote DoH heavily outside the browser. I also run DoH servers on local computers.
  - LinuxBender 4y ago
    I would be willing to bet some (not all) DoH providers are using traditional 512-byte DNS for their backend queries. You are correct. In fact they have no choice in this matter unless they are just daisy-chaining to other DoH/DoT servers. The real internet still uses plain unencrypted UDP and there is no guarantee the server one is talking to supports EDNS. The root servers do not support DoT/DoH and most corporate DNS servers do not support DoH/DoT. Some of those also do not support EDNS. A small handful of the paid DNS providers offer DoT but it isn't like clients would know to use that by default. Some cell phones and some browsers are the only clients that to my knowledge will try to enumerate if DoT/DoH is available. Regarding 512 byte queries, EDNS is opportunistic. Not everyone supports it and one can not assume it is supported. That is negotiated. DNS Flag day(s) [1] were supposed to encourage everyone to enable EDNS and standard size limits of 1232. Without EDNS some traffic will revert to TCP and not everyone has that enabled to my surprise. I have a handful of DoT servers and they just talk plain UDP to the root servers. I've thought about making some of them public as a learning exercise to see what riff-raff shows up though I suspect I will be spending some time tuning rate limits and firewall rules. As a side note, I was actually surprised to find that Android figured out I had DoT on my home network and I didn't even git it any hints. Seems it just probed the gateway for 853 and got lucky. [1] - https://www.dnsflagday.net/2020/ https://www.dnsflagday.net/2020/
    - 1vuio0pswjnm7 4y ago
      There is much "probing" from "tech" companies like Google and Apple. You should try running NetGuard on Android, block everything and observe what tries to connect. It is one thing to use DoH if port 53 is being filtered, but that is a relatively small population of internet users. Forcing everyone to use DoH inside an ad-sponsored application like a web browser or a corporate OS like Android, versus providing it as an option, is questionable, IMO. Do you use OpenWRT. OpenWRT routers with mwan3 enabled by default are pinging open resolvers, public DNS caches, like GoogleDNS, Cloudflare and Cisco OpenDNS to check for connectivity. These are considered "reliable IP addresses to ping". https://web.archive.org/web/20220629175529if_/https://github.com/openwrt/packages/blob/master/net/mwan3/files/etc/config/mwan3 https://web.archive.org/web/20220629175529if_/https://github... https://openwrt.org/docs/guide-user/network/wan/multiwan/mwan3 https://openwrt.org/docs/guide-user/network/wan/multiwan/mwa... Why not ping a root server instead. Even a com nameserver is more important than Google LLC. EDNS is opportunistic but we can disable/remove it altogether before compiling our DNS servers. Or we can use DNS software, e.g., djbdns, that will never support it.
jeroenhd 4y ago
DoT and DoH are traditionally available over TCP (or reworked versions of TCP like QUIC), which have built in protections against address spoofing. Opening port 53 means having to set up a system to prevent abuse. Multiplication attacks through DNS are still as common as ever and mitigation can be incredibly difficult if a botnet is attacking a wide range of IP addresses. Putting everything behind encryption not only makes life just a tad more private (especially when using ODoH, using which your DNS server can't even know what domains your IP is visiting, though I'm not sure if they support that) while also reducing the complexity of the service they're running. There are downsides for sure, but I think they don't outweigh the benefits.
- 0xbadcafebee 4y ago
  Only the UDP version of DNS is open to amplification attacks. The TCP version of DNS (which has been supported for 30+ years) should work fine, but some shitty firewalls block it, so people have not relied upon it, and as a result it's not very reliable to use TCP DNS everywhere. Rather than deal with the problem and make UDP-based DNS obsolete ("but UDP is faster!" + "but middleboxes!" is the reason nobody wants to deal with it), people are instead pushing DoH, which just shoves DNS over an HTTPS connection. It's like, if in response to cars on a certain stretch of road hitting bicycles, you know building a protected bike lane is the best solution. But it's expensive, and it may limit parking, or the amount of lanes for cars, or their max speed. So instead you require everyone to put their bicycle in a car, or just bike on the street and risk being hit. Nobody wants to deal with the real problem, so we instead institute hacks and try to ignore the problem as long as we can. Anything to avoid expense, cooperation, re-building.
  - alexiaa 4y ago
    you may have a point about amplification attacks, but that's not the main reason DoH/DoT exists. simply using legacy DNS over TCP will not magically make it encrypted.
  - jedisct1 4y ago
    DNSCrypt mainly uses UDP, doesn't allow amplification, allows client IP anonymization.
alangibson 4y ago
> Is this because as a VPN they're committed to privacy? Almost certainly. Mullvad is way out there when it comes to privacy. They recently got rid of recurring subscriptions because they said they didn't want to store any PII.
- tpmx 4y ago
  Just to clarify: Saying no to recurring subscriptions is a BFD. They are what drive the revenue growth of every SaaS. Getting rid of them means they will earn less money in the short term (the next few years). It's very unusual. The vast majority focus primarily on getting this to work as friction-less as possible.
  - quickthrower2 4y ago
    BFD?
    - tpmx 4y ago
      Sorry. Big Fucking Deal.
- alexiaa 4y ago
  > They recently got rid of recurring subscriptions because they said they didn't want to store any PII. as much as this may be a noble goal, as a user i want to have the option of a recurring subscription, especially if i pay monthly (which i prefer to, unless i'm really committed to a service or the yearly subscription is cheap enough that i'm sure i won't regret it). if it's just one or two services doing this it's not a huge deal, but imagine getting emails from tens of different services each month to renew, especially if you have to log in and enter your credit/debit card details on each one separately. is there a reason they can't simply store a token from stripe/paypal/etc, or is that still considered PII?
  - jontas 4y ago
    It sounds like you are not their target audience, which is fine, it just means a different service would be a better option for the way you value convenience vs privacy.
josephcsible 4y ago
> Leaving the plain UDP port 53 option surely can't be a big burden. Is this because as a VPN they're committed to privacy? You're right. They are doing this to better protect their users, just like when they stopped accepting recurring payments. > Some people will surely switch to the encrypted versions, but others will just go looking for a different dotted quad to drop in, one possibly less secure. I feel like almost everyone who already went out of their way to use Mullvad in the first place will do the former.

INTPenis 4y ago

I use UncensoredDNS, which is a much smaller project but also a free DNS service like Mullvad's. And they also shut down all of their unencrypted ports earlier this year. Here[1] is their reason; "The reason for this radical change is twofold: 1) I want encourage adoption of encrypted and authenticated DNS, and 2) I am sick of fighting UDP amplification attacks." 1. https://blog.uncensoreddns.org/blog/39-the-unfriendly-internet-turning-off-cleartext-lookups-in-september/ https://blog.uncensoreddns.org/blog/39-the-unfriendly-intern...

wpietri 4y ago
Ah, right. I have questions about the first, but the latter makes a ton of sense to me. Thanks!
Siira 4y ago
These encrypted DNS services are usually blocked here in Iran. The unencrypted ones are compromised, too. I use self-hosted dnscrypt.
RobotToaster 4y ago
Interesting, I use OpenNIC, another free DNS service, and they don't seem to have any problems.
- pixl97 4y ago
  "Don't have any problems" and "Don't have problems that they are telling you about" are different things. They may have an abuse@opennic address they've never opened. An ignored problem isn't a problem, well until it is. Or they may deal with it and not mention the costs of doing so.
1vuio0pswjnm7 4y ago
Turning off EDNS and DNSSEC would surely reduce if not eliminate the risk of amplification attacks. If anyone has the idea that traditional 512-byte UDP-based DNS is now useless, then I think that's crazy. I still use it all the time, particularly on the home network. I would be willing to bet some (not all) DoH providers are using traditional 512-byte DNS for their backend queries. I use remote DoH heavily outside the browser. I also run DoH servers on local computers.
- LinuxBender 4y ago
  I would be willing to bet some (not all) DoH providers are using traditional 512-byte DNS for their backend queries. You are correct. In fact they have no choice in this matter unless they are just daisy-chaining to other DoH/DoT servers. The real internet still uses plain unencrypted UDP and there is no guarantee the server one is talking to supports EDNS. The root servers do not support DoT/DoH and most corporate DNS servers do not support DoH/DoT. Some of those also do not support EDNS. A small handful of the paid DNS providers offer DoT but it isn't like clients would know to use that by default. Some cell phones and some browsers are the only clients that to my knowledge will try to enumerate if DoT/DoH is available. Regarding 512 byte queries, EDNS is opportunistic. Not everyone supports it and one can not assume it is supported. That is negotiated. DNS Flag day(s) [1] were supposed to encourage everyone to enable EDNS and standard size limits of 1232. Without EDNS some traffic will revert to TCP and not everyone has that enabled to my surprise. I have a handful of DoT servers and they just talk plain UDP to the root servers. I've thought about making some of them public as a learning exercise to see what riff-raff shows up though I suspect I will be spending some time tuning rate limits and firewall rules. As a side note, I was actually surprised to find that Android figured out I had DoT on my home network and I didn't even git it any hints. Seems it just probed the gateway for 853 and got lucky. [1] - https://www.dnsflagday.net/2020/ https://www.dnsflagday.net/2020/
  - 1vuio0pswjnm7 4y ago
    There is much "probing" from "tech" companies like Google and Apple. You should try running NetGuard on Android, block everything and observe what tries to connect. It is one thing to use DoH if port 53 is being filtered, but that is a relatively small population of internet users. Forcing everyone to use DoH inside an ad-sponsored application like a web browser or a corporate OS like Android, versus providing it as an option, is questionable, IMO. Do you use OpenWRT. OpenWRT routers with mwan3 enabled by default are pinging open resolvers, public DNS caches, like GoogleDNS, Cloudflare and Cisco OpenDNS to check for connectivity. These are considered "reliable IP addresses to ping". https://web.archive.org/web/20220629175529if_/https://github.com/openwrt/packages/blob/master/net/mwan3/files/etc/config/mwan3 https://web.archive.org/web/20220629175529if_/https://github... https://openwrt.org/docs/guide-user/network/wan/multiwan/mwan3 https://openwrt.org/docs/guide-user/network/wan/multiwan/mwa... Why not ping a root server instead. Even a com nameserver is more important than Google LLC. EDNS is opportunistic but we can disable/remove it altogether before compiling our DNS servers. Or we can use DNS software, e.g., djbdns, that will never support it.

jeroenhd 4y ago

DoT and DoH are traditionally available over TCP (or reworked versions of TCP like QUIC), which have built in protections against address spoofing. Opening port 53 means having to set up a system to prevent abuse. Multiplication attacks through DNS are still as common as ever and mitigation can be incredibly difficult if a botnet is attacking a wide range of IP addresses. Putting everything behind encryption not only makes life just a tad more private (especially when using ODoH, using which your DNS server can't even know what domains your IP is visiting, though I'm not sure if they support that) while also reducing the complexity of the service they're running. There are downsides for sure, but I think they don't outweigh the benefits.

0xbadcafebee 4y ago
Only the UDP version of DNS is open to amplification attacks. The TCP version of DNS (which has been supported for 30+ years) should work fine, but some shitty firewalls block it, so people have not relied upon it, and as a result it's not very reliable to use TCP DNS everywhere. Rather than deal with the problem and make UDP-based DNS obsolete ("but UDP is faster!" + "but middleboxes!" is the reason nobody wants to deal with it), people are instead pushing DoH, which just shoves DNS over an HTTPS connection. It's like, if in response to cars on a certain stretch of road hitting bicycles, you know building a protected bike lane is the best solution. But it's expensive, and it may limit parking, or the amount of lanes for cars, or their max speed. So instead you require everyone to put their bicycle in a car, or just bike on the street and risk being hit. Nobody wants to deal with the real problem, so we instead institute hacks and try to ignore the problem as long as we can. Anything to avoid expense, cooperation, re-building.
- alexiaa 4y ago
  you may have a point about amplification attacks, but that's not the main reason DoH/DoT exists. simply using legacy DNS over TCP will not magically make it encrypted.
- jedisct1 4y ago
  DNSCrypt mainly uses UDP, doesn't allow amplification, allows client IP anonymization.

alangibson 4y ago

> Is this because as a VPN they're committed to privacy? Almost certainly. Mullvad is way out there when it comes to privacy. They recently got rid of recurring subscriptions because they said they didn't want to store any PII.

tpmx 4y ago
Just to clarify: Saying no to recurring subscriptions is a BFD. They are what drive the revenue growth of every SaaS. Getting rid of them means they will earn less money in the short term (the next few years). It's very unusual. The vast majority focus primarily on getting this to work as friction-less as possible.
- quickthrower2 4y ago
  BFD?
  - tpmx 4y ago
    Sorry. Big Fucking Deal.
alexiaa 4y ago
> They recently got rid of recurring subscriptions because they said they didn't want to store any PII. as much as this may be a noble goal, as a user i want to have the option of a recurring subscription, especially if i pay monthly (which i prefer to, unless i'm really committed to a service or the yearly subscription is cheap enough that i'm sure i won't regret it). if it's just one or two services doing this it's not a huge deal, but imagine getting emails from tens of different services each month to renew, especially if you have to log in and enter your credit/debit card details on each one separately. is there a reason they can't simply store a token from stripe/paypal/etc, or is that still considered PII?
- jontas 4y ago
  It sounds like you are not their target audience, which is fine, it just means a different service would be a better option for the way you value convenience vs privacy.

josephcsible 4y ago

> Leaving the plain UDP port 53 option surely can't be a big burden. Is this because as a VPN they're committed to privacy? You're right. They are doing this to better protect their users, just like when they stopped accepting recurring payments. > Some people will surely switch to the encrypted versions, but others will just go looking for a different dotted quad to drop in, one possibly less secure. I feel like almost everyone who already went out of their way to use Mullvad in the first place will do the former.