4 ms·

I still don't understand how industry got conned into thinking sending all your DNS requests to essentially one actor (DoH) is a good idea

by ilyt 4y ago

mjevans 4y ago
Too many ISPs hijacking requests to user configured DNS servers and too many ISPs providing default servers that 'helpfully' redirect to a placeholder domain with ads rather than just an NX record.
dinosaurdynasty 4y ago
https://dnscrypt.info/public-servers https://dnscrypt.info/public-servers Lots of servers out there support DoH
pabs3 4y ago
I got the impression that DoH/DoT are mainly for request privacy rather than security.
- DistractionRect 4y ago
  It's about security. It keeps intermediate hops from hijacking your query and providing their own response. Unfortunately, it offers no privacy. DNS is usually the precursor to a tls connection, and the domain name is sent in cleartext during the tls handshake. So the same people who would hijack your DNS queries are still privy to them if you use DoH (routers, ISPs, governments, etc).
  - pabs3 4y ago
    DoT/DoH only stops one hop of the DNS resolution process from hijacking requests, so it isn't as good as DNSSEC for security. There is encrypted TLS handshaking for hiding the TLS domain name indicator. https://datatracker.ietf.org/doc/draft-ietf-tls-esni/ https://datatracker.ietf.org/doc/draft-ietf-tls-esni/
    - duskwuff 4y ago
      > ... so it isn't as good as DNSSEC for security. And DNSSEC doesn't provide any privacy to the end user. Both mechanisms provide something of value, and ideally they'd both be used together.
josephcsible 4y ago
There's a lot of different DoH providers. And don't most people who aren't using DoH send all of their DNS requests to the same actor (usually their ISP) anyway?
mindslight 4y ago
Centralized servers run by trusted [0] third parties is the foundation that most of the industry is built on. Surveillance dollars flow in, and mindshare follows. DNS seems eminently easy to secure against eavesdropping, given it is just distributed database, and a slowly consistent one at that. Someone just needs to step up to the plate and make a p2p resolver that communicates with a secure protocol, rather than the naive one spelled out in rfc1035. And with DNSSEC you wouldn't even have to worry about trusting/verifying other peers. [0] The formal definition of someone who can break you, not the common usage that implies "trustworthy".
- pabs3 4y ago
  I like the GNU Name System for replacing DNS: https://www.gnunet.org/gns https://www.gnunet.org/gns
  - duskwuff 4y ago
    Every time people bring this project up, I have to say this again, so here goes: The purpose of a naming system is to give users a common way to consistently reference specific things. Anyone should be able to mention a name for a thing, and know that any other user will be able to look up that name and resolve it to the same thing. GNS missed this lesson. Under GNS, every user has their own, slightly different view of naming; a name which one user is able to resolve may not be resolvable for another user, or (even worse) other users might see it resolve to something completely different. There are many ways of defining how a "decentralized" naming system should work. This is one of them, and I'm sure it sounds cool, but it is not a good idea. Try again.
dimensi0nal 4y ago
DNSSEC is not the same thing as DoH or DoT or DNSCrypt
dogecoinbase 4y ago
It's to prevent DNS-based ad blocking (e.g. Pi-hole).
- josephcsible 4y ago
  This isn't true. There are DoH servers that do ad blocking.
  - candiddevmike 4y ago
    Parent means from the IoT device side. DoH lets devices (say your TV) bypass a pi-hole and still reach ad servers. That's why I blackhole DoH on my network. Don't connect to my wireless if you want DoH privacy.
    - SAI_Peregrinus 4y ago
      Bypassing your network's DNS doesn't require DoH, it just requires the IoT device to use its own DNS servers.
      - candiddevmike 4y ago
        I redirect all outbound TCP/UDP 53 traffic to my DNS servers. I can't do that with DoH, so into the blackhole it goes
        josephcsible 4y ago
        Remember, if you can censor traffic at the network level, so can Comcast and China. Hopefully, there will eventually be a day when Microsoft, Google, Amazon, and CloudFlare all serve DoH from the same IPs they serve the rest of the websites they host from, so that it won't be feasible to block them anymore.
        SAI_Peregrinus 4y ago
        But they can run DoH on any server, they don't have to use CloudFlare or Google or whatever. So any port 80 connection is suspect. Same for any port 443 connection with DoT. Or any port whatsoever if they run their DNS (on any transport) on a "non-standard" port, which is not unheard of for such devices. DNS works on port 5353 just as well as it does on port 53. Redirecting outbound port 53 to your own servers has never been an effective way to stop devices from using their own DNS. DoH and DoT do make it harder to block (since they're authenticated), but even classic DNS can evade simple port-based redirection.

I still don't understand how industry got conned into thinking sending all your DNS requests to essentially one actor (DoH) is a good idea

by ilyt 4y ago

I still don't understand how industry got conned into thinking sending all your DNS requests to essentially one actor (DoH) is a good idea

mjevans 4y ago

Too many ISPs hijacking requests to user configured DNS servers and too many ISPs providing default servers that 'helpfully' redirect to a placeholder domain with ads rather than just an NX record.

dinosaurdynasty 4y ago

https://dnscrypt.info/public-servers https://dnscrypt.info/public-servers Lots of servers out there support DoH

pabs3 4y ago

I got the impression that DoH/DoT are mainly for request privacy rather than security.

DistractionRect 4y ago
It's about security. It keeps intermediate hops from hijacking your query and providing their own response. Unfortunately, it offers no privacy. DNS is usually the precursor to a tls connection, and the domain name is sent in cleartext during the tls handshake. So the same people who would hijack your DNS queries are still privy to them if you use DoH (routers, ISPs, governments, etc).
- pabs3 4y ago
  DoT/DoH only stops one hop of the DNS resolution process from hijacking requests, so it isn't as good as DNSSEC for security. There is encrypted TLS handshaking for hiding the TLS domain name indicator. https://datatracker.ietf.org/doc/draft-ietf-tls-esni/ https://datatracker.ietf.org/doc/draft-ietf-tls-esni/
  - duskwuff 4y ago
    > ... so it isn't as good as DNSSEC for security. And DNSSEC doesn't provide any privacy to the end user. Both mechanisms provide something of value, and ideally they'd both be used together.

josephcsible 4y ago

There's a lot of different DoH providers. And don't most people who aren't using DoH send all of their DNS requests to the same actor (usually their ISP) anyway?

mindslight 4y ago

Centralized servers run by trusted [0] third parties is the foundation that most of the industry is built on. Surveillance dollars flow in, and mindshare follows. DNS seems eminently easy to secure against eavesdropping, given it is just distributed database, and a slowly consistent one at that. Someone just needs to step up to the plate and make a p2p resolver that communicates with a secure protocol, rather than the naive one spelled out in rfc1035. And with DNSSEC you wouldn't even have to worry about trusting/verifying other peers. [0] The formal definition of someone who can break you, not the common usage that implies "trustworthy".

pabs3 4y ago
I like the GNU Name System for replacing DNS: https://www.gnunet.org/gns https://www.gnunet.org/gns
- duskwuff 4y ago
  Every time people bring this project up, I have to say this again, so here goes: The purpose of a naming system is to give users a common way to consistently reference specific things. Anyone should be able to mention a name for a thing, and know that any other user will be able to look up that name and resolve it to the same thing. GNS missed this lesson. Under GNS, every user has their own, slightly different view of naming; a name which one user is able to resolve may not be resolvable for another user, or (even worse) other users might see it resolve to something completely different. There are many ways of defining how a "decentralized" naming system should work. This is one of them, and I'm sure it sounds cool, but it is not a good idea. Try again.

dimensi0nal 4y ago

DNSSEC is not the same thing as DoH or DoT or DNSCrypt

dogecoinbase 4y ago

It's to prevent DNS-based ad blocking (e.g. Pi-hole).

josephcsible 4y ago
This isn't true. There are DoH servers that do ad blocking.
- candiddevmike 4y ago
  Parent means from the IoT device side. DoH lets devices (say your TV) bypass a pi-hole and still reach ad servers. That's why I blackhole DoH on my network. Don't connect to my wireless if you want DoH privacy.
  - SAI_Peregrinus 4y ago
    Bypassing your network's DNS doesn't require DoH, it just requires the IoT device to use its own DNS servers.
    - candiddevmike 4y ago
      I redirect all outbound TCP/UDP 53 traffic to my DNS servers. I can't do that with DoH, so into the blackhole it goes
      - josephcsible 4y ago
        Remember, if you can censor traffic at the network level, so can Comcast and China. Hopefully, there will eventually be a day when Microsoft, Google, Amazon, and CloudFlare all serve DoH from the same IPs they serve the rest of the websites they host from, so that it won't be feasible to block them anymore.
      - SAI_Peregrinus 4y ago
        But they can run DoH on any server, they don't have to use CloudFlare or Google or whatever. So any port 80 connection is suspect. Same for any port 443 connection with DoT. Or any port whatsoever if they run their DNS (on any transport) on a "non-standard" port, which is not unheard of for such devices. DNS works on port 5353 just as well as it does on port 53. Redirecting outbound port 53 to your own servers has never been an effective way to stop devices from using their own DNS. DoH and DoT do make it harder to block (since they're authenticated), but even classic DNS can evade simple port-based redirection.