7 ms·
As a network guy, the fact that I can transparently redirect DNS on my network to wherever I need to is a nice feature. As a user of the public internet, it fe
by happyopossum 2y ago
As a network guy, the fact that I can transparently redirect DNS on my network to wherever I need to is a nice feature.
As a user of the public internet, it feels like a bug.
As much hassle as things like DoH can be for securing and enforcing policy on a network, it’s about time it became ubiquitous enough that governments can’t leverage DNS for their own purposes anymore.
- vFunct 2y agoDoH won't solve redirects. DoH only gets you to a secure query, it won't help you if the government decides to give you a falsified query. For that you'll need DNSSec, which maintains a cryptographic chain of authenticity to the root DNS servers. And DNSSec is even more rare than DoH.
- xnyanta 2y agoDoH will prevent government from hijacking your query in the first place. These blockades are only possible because of DNS being clear text and suceptible to MITM
- vFunct 2y agoThat's one level of security, but even for DoH, it's possible for entities to attack and control an HTTPS server, returning falsified DNS queries, and now the antigovernment.com website you logged in to talk about anti-government politics is actually run by government. The only way to prevent that is via DNSsec to make sure that antigovernment.com goes to a real antigovernment.com server.
- yegle 2y agoWait what do you mean? They can have an HTTPS server and MITM, but how can they get a certificate for the DoH server I use?
- labcomputer 2y agoThey only need a certificate signed by an authority trusted by your resolver. And, unlike for the website itself, your browser does not show certificate information for the DoH server. DoH also does not solve the problem of where the DNS server you use gets its information from: A government can compromise the other side as well.
- yegle 2y agoSo, like, you are assuming someone using a resolver that ignores the certificate chain of trust, as an evidence that DoH is not useful? Do your program language _show_ you the certificate information when you use an http library to connect to an HTTPS service? Sure the other end of the DNS query may not be encrypted, but I can easily decide which government to trust, and run my DoH server there.
- kelnos 2y ago> your browser does not show certificate information for the DoH server. It doesn't show it, but I expect it would put up an error message if the DoH server's cert is invalid.
- tsimionescu 2y agoThis makes no sense whatsoever. If the government can transparently MITM your HTTPS connections with the DoH server, they can just as well MITM your connection to the real antigovernment.com server regardless of what DNS you use. And in fact, if they can't MITM your connection to the real antigovernment.com, they also can't trick you to talk to their fake antigovernment.com regardless of intercepting your DNS: you will connect to the attacker IP, the attacker IP will give you a bogus certificate, your browser will refuse to connect.
- mfenniak 2y agoDoH uses HTTPS; it solves redirects because you can use a trusted server, and not have the request intercepted and the response spoofed.
- sublinear 2y agohttps://dl.acm.org/doi/10.1145/358198.358210 https://dl.acm.org/doi/10.1145/358198.358210 I don't really trust many DNSes and neither do many yet we all have few choices The lack of MitM isn't much comfort Neither are guarantees of the chain of trust
- tsimionescu 2y agoDNSSec is entirely useless here. The government has two goals here: block you from accessing certain sites, and perhaps prosecute you for the attempt. DNSSec does exactly nothing to help against either of these , even if perfectly deployed. DNSSec can help protect from fraudsters or others that might try to transparently direct you to a different site than the one you wanted to access. But the government here has no intention of serving you a fake porn site, they want to stop you accessing porn and log the fact that you were trying to access it.
- raverbashing 2y agoHonestly I never got the backlash against DoH. Sounded more like a kneejerk reaction and a meme for something that's an improvement. UDP at this day and age? Come on
- deleted 2y ago[deleted]
- AnthonyMouse 2y agoThe backlash against DoH is that the implementations switch your DNS server without asking to a centralized one which is presumably data mining the queries, default ignoring the one you configured in your operating system or DHCP server. There is also nothing wrong with using UDP for DNS. And the latency can be better, and in this context that matters. The real problem is that the UDP DNS protocol isn't encrypted. But there is no reason it couldn't be, except that then nobody gets a new source of DNS queries to data mine, which is where the money comes from to push DoH.
- JoshTriplett 2y agoISPs regularly data-mine their users' traffic. Meanwhile, some of the major DoH servers specifically don't. (See, for instance, the deals Mozilla has with their default DoH providers.)
- jjav 2y ago> Meanwhile, some of the major DoH servers specifically don't. You can't possible make that assertion, because all it takes is one NSL and they will log and share it all.
- belorn 2y agoThe policy that Mozilla ask providers to follow does not prohibit data-mining the traffic. Providers are requested to not store or share personal information, but any data-mining that removes personal identifiable information are allowed. For example, accidentally leaked internal network queries from companies are up to grabs. As is market data like what people are querying, how much, when, from where (geographical for example) and to whom, and so on. The quality of the anonymization of private information are also not guarantied.
- buro9 2y agoDoH helps us against governments, but doesn't help us against advertisers, i.e. what stops Google or an app maker talking to their own DNS endpoint via DoH and avoiding local measures to block malware and tracking. DoH is a double edged thing, advertisers are a more present and pervasive threat to most than their own government
- logicchains 2y agoIf by most people you mean most people globally, governments are absolutely a bigger threat; only a minority of the world's population live in countries with benevolent governments who don't censor the internet to hide the government's misdeeds.
- whatwhaaaaat 2y agodon’t forget the us federal government paid twitter and Facebook to remove speech it didn’t like (speech that turned out to be true).
- chmod775 2y agoYou could argue against seatbelts the same way: seatbelts can cause abrasion of the skin during everyday driving, which is a more present and pervasive threat to most than car crashes. In both instances it turns out that the difference in magnitude of those threats makes the direct comparison misleading.
- FireInsight 2y agoI've never heard of seatbelt skin abrasion, but car crashes are an exceptionally commom danger.
- megous 2y agoCommunity based FOSS OSes/distros stop all this and avoiding the corporate SW/services.
- 2y ago
- mcpherrinm 2y agoAs an infrasec person, DoH is great because we can config manage all the corp devices to use DoH servers run by the company whether not a device is on VPN. Good visibility into what devices are looking up, easy internal domains, and ensuring malware domains are blocked on and off network. At least the companies I’ve been working for have a lot more laptops at coffee shops and weworks, and probably not on a VPN half the time either. DoH has been a way bigger win than a hassle for me.
- sidewndr46 2y agohow would you ever get online at a coffee shop? Almost all of this use a captive portal that redirects DNS to some internal webpage making you click a button that says "I agree to your completely absurd terms and conditions"
- jeremyjh 2y agoI can use a mobile hotspot on my phone basically everywhere I go. Public Wifi is most often garbage throughput compared to 5g.
- SoftTalker 2y agoI have found that fewer places seem to be doing captive portals and are just going back to open wifi or maybe a well-posted password. Maybe they are realizing there's not a lot of value to it as almost all browser traffic is encrypted these days.
- grishka 2y agoA good implementation of DoH/DoT would use regular DNS in these situations.
- chupasaurus 2y agoIf you have any Windows devices they are leaking DNS requests no matter the setup as long as they are getting DNS servers from DHCP that aren't yours.
- inkyoto 2y agoEven if DNS is redirected, where DNS lookup request goes to next depends on the next hop, which is – for the prevailing majority of the internet users – the ISP. Deep packet inspection hardware appliances have proliferated in their numbers in recent years, they are cheap, the hardware is highly performant, and they are capable of the highly sustained throughput. Redirecting DNS queries in UDP port 53 to any other destination of choice is what they can do without blinking an eye (if they had one). Or dropping / blackholing it. Only a VPN tunnel can get through, however modern DPI appliances can also scan for VPN and VPN-like signatures in the traffic and drop those, too. The only viable and guaranteed to work solution to resist the tampering with the traffic is a VPN tunnel wrapped into a Shadow Socks tunnel that obfuscates traffic signatures and constantly changes ports it operates on to avoid detection.
- ruthmarx 2y agoDoH is sufficient to mitigate DPI.
- inkyoto 2y agoWidely used DoH servers operate on fixed IP addresses (v4 and v6), connections to which can be dropped / blackholed, which is what people from at least the UK and Malaysia are reporting. DPI is not even required.
- ikt 2y agoCo-incidentally Mullvad recently mentioned they're fighting back https://mullvad.net/en/blog/introducing-defense-against-ai-guided-traffic-analysis-daita https://mullvad.net/en/blog/introducing-defense-against-ai-g...
- DanAtC 2y agoAnd now available for macOS and Linux https://mullvad.net/en/blog/defense-against-ai-guided-traffic-analysis-daita-now-available-on-linux-and-macos https://mullvad.net/en/blog/defense-against-ai-guided-traffi...
- profmonocle 2y ago> As much hassle as things like DoH can be for securing and enforcing policy on a network, it’s about time it became ubiquitous enough that governments can’t leverage DNS for their own purposes anymore. A caveat of encrypted DNS is that it has to be bootstrapped via traditional, unencrypted DNS or via a well-known set of IPs. Currently, most clients using DoH/DoT use one of a small handful of providers. Cloudflare, Google, Quad9, etc. A motivated government could block those endpoints pretty easily. Of course, a client using encrypted DNS could just refuse to work when encryption is blocked, rather than falling back to traditional DNS. But that could mean the client is unusable in the country implementing the block. This sort of reminds me of when Kazakhstan announced they were going to MITM all TLS sessions within the country, and all citizens would need to manually install a root cert. Google, Apple, and Mozilla chose to completely block their root cert, so it would be unusable even if users chose to go along with it. https://en.wikipedia.org/wiki/Kazakhstan_man-in-the-middle_attack https://en.wikipedia.org/wiki/Kazakhstan_man-in-the-middle_a... Seems like the browser devs won that political standoff, but would they fight the same battle if DoH/DoT was blocked?
- klingoff 2y agoIf we make sure clients support proxies what are they going to do about all the proxies that may allow the DoH server list and may be the only way to do something else?
- zarzavat 2y agoThis is the way. Few governments have the resources to play cat and mouse with OS or browser devs. Just look at the fuss over manifest v3, it shouldn’t be a big deal - just fork chromium and patch manifest v2 back in again - but it is because there’s no “just patching” chromium, it’s like a train.
- TacticalCoder 2y ago> As a network guy ... Then transparently redirect the DNS request from all your machines at home to your own DNS resolver (so that you're in control of what gets resolved and what doesn't, like malware, phishing sites, porn so that kids don't get to see that, etc.) and have your own DNS resolver use DoH. But asking for browsers to "make DoH ubiquitous" (they would force DoH and DoH only) is not a good thing. It also probably would clash with corporate policies, so it'd make the browser picking that path unusable in corporate settings (leaving the corporate market to competitor browsers).