8 ms·

You're absolutely right, Cloudflare will still see it. That doesn't make this a bad improvement though. You don't have to use Cloudflare to support it, but it h

You're absolutely right, Cloudflare will still see it. That doesn't make this a bad improvement though. You don't have to use Cloudflare to support it, but it helps obscure which site is being visited by the nature of Cloudflare hosting so many different sites. So what does this actually protect against? Who will this benefit? Mostly people in censored countries and companies. This removes the last piece of information that can be used to block HTTPS traffic based on the site your visiting without being a party to the exchange. I still think DoH is hot garbage and the way it has been implemented across browsers is an atrocity. It's actively harmful to security even if the spirit is in the right place. I've got no complaints about ECH.

vasachi 3y ago
> This removes the last piece of information that can be used to block HTTPS traffic based on the site your visiting without being a party to the exchange. And that will cause blocks by IP. It's not like authorities in those countries care that much if a user can't access a not-blocked site, as long as they can't access a blocked one.
- josephcsible 3y ago
  The point of efforts like this is exactly to make selective blocking infeasible. This will force the bad guys to choose between blocking nothing and blocking everything, and with the exception of North Korea, most aren't willing to do the latter.
  - vasachi 3y ago
    Nope, the bad guys don't care that much.
    - jamespo 3y ago
      Who are you talking about?
kreetx 3y ago
What is wrong with DoH?
- johnklos 3y ago
  It takes our control over our networks away from us and gives it to random applications, to Trojans, to viruses, to adware purveyors, to advertisers. It makes the assertion that because SOME of us don't know how to change our DNS servers, they (Mozilla, Cloudflare, other proponents of DoH) need to take control away from us and need to send our DNS lookups to, usually, them. The justifications are ridiculous, but the harms introduced by DoH are much, much worse than the thing they're trying to say makes DoH useful.
  - josephcsible 3y ago
    > It takes our control over our networks away from us Taking control away from the owner of networks is a good thing. Control is supposed to reside with the owner of endpoints. To see why, imagine if your ISP started to MITM all of your connections that went over their network. > don't know how to change our DNS servers It's not a case of "don't know how". It's a case of "can't, because even if you change the setting, $evil_isp will hijack the queries anyway".
    - johnklos 3y ago
      That's an incorrect oversimplification. It takes control away from the owner of networks, even when we're the owner of those networks. Should DoH start to become more common, blocking it will become a Sisyphean task. It takes control away from the owner of endpoints. Sure, you can go and change the settings in Firefox to turn off DoH after they've turned it on without asking and without telling us, but what happens when applications and Trojans start doing DoH lookups, skipping our system's configured DNS? So yes, your statement about control residing with the endpoints is correct, but DoH removes control, doesn't add it. For the case of "can't, because even if you change the setting, $evil_isp will hijack the queries anyway", that's FUD. There are many, many better ways to deal with evil ISPs. Encouraging the world to send all of their DNS lookups to a centralized entity like Cloudflare (who, by every right, are precisely in a position to be an evil ISP) is such an incredibly shortsighted idea that I have to think that you haven't thought out the implications of a world where DoH is dominant. If you care to learn, consider things without DoH: you can edit your hosts file. You can choose your DNS servers. You can run a local recursive resolving DNS server. You can block ads and advertisingware using your DNS server and/or something like Pihole. You can block all DNS queries to the outside world on your network so that they all go through your own resolvers. Next, consider a world where DoH is commonplace: you have no control over DNS lookups on your own system. Your only choice is to not run binaries that might do things you don't like. Want to block ads or adware, or adult sites, or conspiracy sites, or any of a number of other things on the Windows system that your child uses? Now Edge doesn't let you. Want to block the Trojans and phishing sites that Google serves through their ad network? Chrome doesn't let you. "Just don't run binaries that do that" is one heck of an ask for people who don't know how to set their own DNS or who have an evil ISP. You can block common DoH servers, until Cloudflare puts them on the same address as the endpoints for their millions of hosting customers. But what happens when apps do DoH lookups using random Amazon AWS or Google Cloud servers? How do you block them? Do you block ALL https? You see, you'd give up freedom, and have everyone else give up their freedom, for some abstract "safety" from ISPs that use your DNS data. You'd apply a shitty fix for 1% of the people to 100% of the people, rather than create tools for the 1% to circumvent their evil ISPs. The fact that you'd choose this makes me think that either you want big, evil companies like Cloudflare to win, or you really don't understand the issues. Just like this article above does a good job explaining the lack of security in the cloud, we really could use a good article explaining how completely inane the idea of DoH is.
johnklos 3y ago
I agree that this is generally a good thing, and that DoH is an absolutely shitty thing, but I think the poster here was taking exception to this statement: "no one except for the user and the website will be able to determine which website was visited" That, I think we can all agree, is patently untrue. Cloudflare shouldn't be publishing blatant deceptions.
- leihca 3y ago
  Author here - definitely not trying to be deceptive! I've amended the sentence you mentioned to be more clear.
  - johnklos 3y ago
    Thank you, and good to know :)
AnthonyMouse 3y ago
> You're absolutely right, Cloudflare will still see it. That doesn't make this a bad improvement though. You can do something like ECH in a way that not even Cloudflare will see it (it being the connection contents rather than the name, since Cloudflare actually needs the name to route the connection). The naive way to do it is to do one handshake with Cloudflare that the client uses to provide the "real" name and then another with the "real" server so Cloudflare can't see that. That is possible but then you'd need two handshakes, which is rather inefficient and probably means it wouldn't be used. The interesting question is can someone come up with a way to get that result without the inefficiency.
- YeBanKo 3y ago
  > You can do something like ECH in a way that not even Cloudflare will see it How is it possible for a Cloudflare to front a website, without knowing what the website it is. You browser is only supposed to do a handshake with a server with a certificate matching the domain, this make Cloudlare in charge of the cert. And Cloudflare needs to forward the traffic to a known location, so they __have__ to know the target host.
  - AnthonyMouse 3y ago
    it being the connection contents rather than the name, since Cloudflare actually needs the name to route the connection
- d-z-m 3y ago
  Sounds kind of similar to [0]. TL;DR: stealth secondary DH key exchange in the nonce field of Client/Server Hello in TLS 1.3. [0]: https://eprint.iacr.org/2023/651.pdf https://eprint.iacr.org/2023/651.pdf
YeBanKo 3y ago
> I still think DoH is hot garbage and the way it has been implemented across browsers is an atrocity. Not sure if it's a hot garbage, but I don't see why it's better than DoT or DoQ, except maybe a use case for censored countries. DoT is faster and can be abstracted away from from HTTP. Presumably, DoH is more privacy preserving, because it runs on the same port and looks just like the rest HTTPS traffic. But I think a spying ISP can probably guess that it's a DNS traffic by where it's going. If it's an HTTPS connection over 443 going to a know DNS server, then it's probably a DNS request, thus I don't see added privacy here. But from traffic administration, it is harder. As a an example, now your Smart Spying Device can phone home and it is going to be harder to block it. Also, we are moving from your ISP knowing too much about you to Cloudflare knowing too much about you. It's one of the biggest DoH DNS services, often they see unencrypted HTTPs traffic, they also an exit node for iCloud Private Relays. ISP is left out, but Cloudflare seems to be able to consolidate this knowledge.
- tialaramex 3y ago
  Deployability is what matters. DoH had great deployability because everybody speaks HTTPS. In my home, lots of technologies would work. I have static v4 and v6, I have complete control over the firewalls, I can do whatever I want. But at my mum's house, who knows what ports work and which protocols work over them and whether you can change any of that. HTTPS definitely works though, because if it didn't her web browser wouldn't work and she'd yell at the ISP until they fixed it. So that's why DoH.
  - YeBanKo 3y ago
    Everybody who speaks HTTPS speaks TLS and the existing DNS-over-TCP. DoT is just DNS-over-TCP tunneled inside TLS. And it can be on any port, not necessarily 853, could be even on 443. What is the point of wrapping it into http request?
    - tatersolid 3y ago
      Because ports other than 443 are often blocked on corporate, hotel, and even coffee shop networks.

vasachi 3y ago

> This removes the last piece of information that can be used to block HTTPS traffic based on the site your visiting without being a party to the exchange. And that will cause blocks by IP. It's not like authorities in those countries care that much if a user can't access a not-blocked site, as long as they can't access a blocked one.

josephcsible 3y ago
The point of efforts like this is exactly to make selective blocking infeasible. This will force the bad guys to choose between blocking nothing and blocking everything, and with the exception of North Korea, most aren't willing to do the latter.
- vasachi 3y ago
  Nope, the bad guys don't care that much.
  - jamespo 3y ago
    Who are you talking about?

kreetx 3y ago

What is wrong with DoH?

johnklos 3y ago
It takes our control over our networks away from us and gives it to random applications, to Trojans, to viruses, to adware purveyors, to advertisers. It makes the assertion that because SOME of us don't know how to change our DNS servers, they (Mozilla, Cloudflare, other proponents of DoH) need to take control away from us and need to send our DNS lookups to, usually, them. The justifications are ridiculous, but the harms introduced by DoH are much, much worse than the thing they're trying to say makes DoH useful.
- josephcsible 3y ago
  > It takes our control over our networks away from us Taking control away from the owner of networks is a good thing. Control is supposed to reside with the owner of endpoints. To see why, imagine if your ISP started to MITM all of your connections that went over their network. > don't know how to change our DNS servers It's not a case of "don't know how". It's a case of "can't, because even if you change the setting, $evil_isp will hijack the queries anyway".
  - johnklos 3y ago
    That's an incorrect oversimplification. It takes control away from the owner of networks, even when we're the owner of those networks. Should DoH start to become more common, blocking it will become a Sisyphean task. It takes control away from the owner of endpoints. Sure, you can go and change the settings in Firefox to turn off DoH after they've turned it on without asking and without telling us, but what happens when applications and Trojans start doing DoH lookups, skipping our system's configured DNS? So yes, your statement about control residing with the endpoints is correct, but DoH removes control, doesn't add it. For the case of "can't, because even if you change the setting, $evil_isp will hijack the queries anyway", that's FUD. There are many, many better ways to deal with evil ISPs. Encouraging the world to send all of their DNS lookups to a centralized entity like Cloudflare (who, by every right, are precisely in a position to be an evil ISP) is such an incredibly shortsighted idea that I have to think that you haven't thought out the implications of a world where DoH is dominant. If you care to learn, consider things without DoH: you can edit your hosts file. You can choose your DNS servers. You can run a local recursive resolving DNS server. You can block ads and advertisingware using your DNS server and/or something like Pihole. You can block all DNS queries to the outside world on your network so that they all go through your own resolvers. Next, consider a world where DoH is commonplace: you have no control over DNS lookups on your own system. Your only choice is to not run binaries that might do things you don't like. Want to block ads or adware, or adult sites, or conspiracy sites, or any of a number of other things on the Windows system that your child uses? Now Edge doesn't let you. Want to block the Trojans and phishing sites that Google serves through their ad network? Chrome doesn't let you. "Just don't run binaries that do that" is one heck of an ask for people who don't know how to set their own DNS or who have an evil ISP. You can block common DoH servers, until Cloudflare puts them on the same address as the endpoints for their millions of hosting customers. But what happens when apps do DoH lookups using random Amazon AWS or Google Cloud servers? How do you block them? Do you block ALL https? You see, you'd give up freedom, and have everyone else give up their freedom, for some abstract "safety" from ISPs that use your DNS data. You'd apply a shitty fix for 1% of the people to 100% of the people, rather than create tools for the 1% to circumvent their evil ISPs. The fact that you'd choose this makes me think that either you want big, evil companies like Cloudflare to win, or you really don't understand the issues. Just like this article above does a good job explaining the lack of security in the cloud, we really could use a good article explaining how completely inane the idea of DoH is.

johnklos 3y ago

I agree that this is generally a good thing, and that DoH is an absolutely shitty thing, but I think the poster here was taking exception to this statement: "no one except for the user and the website will be able to determine which website was visited" That, I think we can all agree, is patently untrue. Cloudflare shouldn't be publishing blatant deceptions.

leihca 3y ago
Author here - definitely not trying to be deceptive! I've amended the sentence you mentioned to be more clear.
- johnklos 3y ago
  Thank you, and good to know :)

AnthonyMouse 3y ago

> You're absolutely right, Cloudflare will still see it. That doesn't make this a bad improvement though. You can do something like ECH in a way that not even Cloudflare will see it (it being the connection contents rather than the name, since Cloudflare actually needs the name to route the connection). The naive way to do it is to do one handshake with Cloudflare that the client uses to provide the "real" name and then another with the "real" server so Cloudflare can't see that. That is possible but then you'd need two handshakes, which is rather inefficient and probably means it wouldn't be used. The interesting question is can someone come up with a way to get that result without the inefficiency.

YeBanKo 3y ago
> You can do something like ECH in a way that not even Cloudflare will see it How is it possible for a Cloudflare to front a website, without knowing what the website it is. You browser is only supposed to do a handshake with a server with a certificate matching the domain, this make Cloudlare in charge of the cert. And Cloudflare needs to forward the traffic to a known location, so they __have__ to know the target host.
- AnthonyMouse 3y ago
  it being the connection contents rather than the name, since Cloudflare actually needs the name to route the connection
d-z-m 3y ago
Sounds kind of similar to [0]. TL;DR: stealth secondary DH key exchange in the nonce field of Client/Server Hello in TLS 1.3. [0]: https://eprint.iacr.org/2023/651.pdf https://eprint.iacr.org/2023/651.pdf

YeBanKo 3y ago

> I still think DoH is hot garbage and the way it has been implemented across browsers is an atrocity. Not sure if it's a hot garbage, but I don't see why it's better than DoT or DoQ, except maybe a use case for censored countries. DoT is faster and can be abstracted away from from HTTP. Presumably, DoH is more privacy preserving, because it runs on the same port and looks just like the rest HTTPS traffic. But I think a spying ISP can probably guess that it's a DNS traffic by where it's going. If it's an HTTPS connection over 443 going to a know DNS server, then it's probably a DNS request, thus I don't see added privacy here. But from traffic administration, it is harder. As a an example, now your Smart Spying Device can phone home and it is going to be harder to block it. Also, we are moving from your ISP knowing too much about you to Cloudflare knowing too much about you. It's one of the biggest DoH DNS services, often they see unencrypted HTTPs traffic, they also an exit node for iCloud Private Relays. ISP is left out, but Cloudflare seems to be able to consolidate this knowledge.

tialaramex 3y ago
Deployability is what matters. DoH had great deployability because everybody speaks HTTPS. In my home, lots of technologies would work. I have static v4 and v6, I have complete control over the firewalls, I can do whatever I want. But at my mum's house, who knows what ports work and which protocols work over them and whether you can change any of that. HTTPS definitely works though, because if it didn't her web browser wouldn't work and she'd yell at the ISP until they fixed it. So that's why DoH.
- YeBanKo 3y ago
  Everybody who speaks HTTPS speaks TLS and the existing DNS-over-TCP. DoT is just DNS-over-TCP tunneled inside TLS. And it can be on any port, not necessarily 853, could be even on 443. What is the point of wrapping it into http request?
  - tatersolid 3y ago
    Because ports other than 443 are often blocked on corporate, hotel, and even coffee shop networks.