3 ms·

This article is totally wrong. I'm not sure how it got so much traction. Details: > But slowly people started to realize what the collaboration between Mozilla

This article is totally wrong. I'm not sure how it got so much traction. Details: > But slowly people started to realize what the collaboration between Mozilla and Cloudflare really means: Cloudflare gets all your DNS queries. There are a lot of DoH providers other than Cloudflare. https://github.com/curl/curl/wiki/DNS-over-HTTPS https://github.com/curl/curl/wiki/DNS-over-HTTPS lists several. If you don't want Cloudflare seeing your DNS requests, then use one of them instead. (And even for users who do just stick with the default, I think it's better privacy-wise for Cloudflare to see that data than for the average American ISP to.) > Yes, there is. It is called DNS over TLS and is specified as a proposed standard in RFC 7858. This provides transport encryption to DNS without abusing HTTP as transport protocol. The only difference between DoT and DoH is that DoT is easier to block and force fallback to totally insecure DNS. There's no reason to ever use DoT if you can use DoH. (And I don't get why the author likes it better: whoever runs the DoT server gets the exact same data that they'd get with a DoH server instead.) > No, it is not. Abusing HTTP as a transport protocol for DNS data adds a unneeded complexity to the protocol. You must add a HTTP module to all DNS servers or interact with a separated HTTP server on the same system in order to support DoH. That is a lot of code which can contain a lot of bugs and security flaws. Complexity is the enemy of security. The extra complexity of HTTP is massively outweighed by the significant reduction in fallbacks to insecure DNS.

AnthonyMouse 1y ago
> If you don't want Cloudflare seeing your DNS requests, then use one of them instead. Normal people have no idea that this even exists, much less how to do it, so they're still having all their queries routed to Cloudflare by default. > The only difference between DoT and DoH is that DoT is easier to block and force fallback to totally insecure DNS. A normal middlebox can't even tell the difference between DoH and DoT because they both just look like TLS. A corporate one that requires you to install certificates on the client so that it can, is just as able to block DoH as DoT. And fallback isn't required in either case. If some network is blocking encrypted DNS, the client device can be configured to fail rather than use the insecure DNS, at which point the user knows that the network is adversarial and can switch to a VPN or a cellular connection etc.
- zinekeller 1y ago
  > A normal middlebox can't even tell the difference between DoH and DoT because they both just look like TLS. You forgot the "let's intercept in a public place (e.g. public Wi-Fi hotspots)" one where blocking port 853 is super trivial while blocking port 443... is impossible. Sure, Google DNS will be blocked easily but there a lot of DoH providers!
  - AnthonyMouse 1y ago
    There is no law against running DoT over port 443.
    - tptacek 1y ago
      At that point you might as well use DoH. But you're also reasoning axiomatically about something we have a lot of documentary evidence for: the DNS operator community (or a big chunk of it) favors DoT and opposes DoH because they want to make it easier to block encrypted DNS; they frame this in terms of "control over their own networks".
      - AnthonyMouse 1y ago
        > At that point you might as well use DoH. What benefit is the additional complexity and overhead of HTTP buying you there? > the DNS operator community (or a big chunk of it) favors DoT and opposes DoH because they want to make it easier to block encrypted DNS; they frame this in terms of "control over their own networks". This is one of the main issues here: When then DNS operator is you, i.e. your local network at home or your corporate network within your own company, you should be able to control DNS on your own network, which you can't if a bunch of adversarial devices are bypassing your DNS servers. When the DNS operator is your ISP, letting them block encrypted DNS is bad. So what we need is some way to distinguish between these situations so that the local network administrator's preferences are heeded but Comcast can go pound sand. But browsers are too late in the stack for that because they have no way to tell if the system DNS server is the one the user wants or the one they got by default from their ISP and never knew to change.
rsync 1y ago
"But slowly people started to realize what the collaboration between Mozilla and Cloudflare really means: Cloudflare gets all your DNS queries." This is not wrong. This is correct. The article speaks correctly here.
- tptacek 1y ago
  The comment you're replying to used that quote to frame their argument that there are plenty of providers besides Cloudflare. Nobody is disputing that if you set your provider to Cloudflare your queries go to Cloudflare. This is not a reasonable rebuttal.
  - timewizard 1y ago
    In 2018 how many other choices were there actually?
    - josephcsible 1y ago
      This article says "Last update: 2018-10-26". https://github.com/curl/curl/wiki/DNS-over-HTTPS/9e5a5acf7999ba00ebae47405ff1ab8790ddcd0d https://github.com/curl/curl/wiki/DNS-over-HTTPS/9e5a5acf799... shows the list as of then, which had 12 choices.
- josephcsible 1y ago
  If you use Cloudflare as your provider, then yes. But the article incorrectly asserts that DoH requires you to use Cloudflare as your provider.
gsich 1y ago
>The only difference between DoT and DoH is that DoT is easier to block and force fallback to totally insecure DNS. There's no reason to ever use DoT if you can use DoH. (And I don't get why the author likes it better: whoever runs the DoT server gets the exact same data that they'd get with a DoH server instead.) Don't use shitty networks then. This is not an issue for all residential (and mobile) connections. Only corporate and other shtity configured networks are affected by this.
- josephcsible 1y ago
  > Don't use shitty networks then. This is not an issue for all residential (and mobile) connections. Only corporate and other shtity configured networks are affected by this. There are some residential and mobile connections that this is an issue for. And it's not always an option to use a network that doesn't try to do this.
  - gsich 1y ago
    Maybe 0.01%. Anyway, it's not an argument against it.
bastard_op 1y ago
The article is not wrong, it's exactly what they're doing, but so does Google with their 8.8.8.8 servers, and you thought Google was doing it out of the goodness of their hearts (after they removed the do not be evil clause). At least Cloudflare offers their 1.1.1.2 and 1.1.1.3 resolvers with built-in content filtering or full adult content filtering as as unfiltered 1.1.1.1, which is better than others. Normally folks pay Cisco OpenDNS or other enterprise-y products for this, and I applaud them doing it in general, for free. I'd set my mother to use it if something I had to do still. Cloudflare is probably one of the less-evil companies today, and is a good engineering company if you follow their blogs. Apple is actually worse in that they forced an entire DNS AND Web Proxy solution to get ALL traffic every apple users do in the name of "privacy", but in the end it's really more for their marketing and analytics they can sell at will. Funny Google tried to offer a VPN service and everyone shunned it, but Apple people just drank the kool-aid as something nice Apple did just because they're a lovely company like that. As the security guy that runs enterprise firewalls, I tend to block the Apple's VPN/proxy stuff as proxy-avoidance by default, which creates a ton of noise in terms of denied apple proxy and doh drops, but it keeps them using my internal dns and internet that I can see when l-users happen to get themselves infected and start exfiltrating data to China. Otherwise with Apple's VPN/Proxy privacy bs, I have no ability to see or stop it, and neither do their users. Thanks for the fish Apple. I just assume all VPN companies do this now as their real revenue stream. I also happen to do work for Firefox's primary advertising partner, and I can tell you it brings me no comfort as a Firefox user myself.
- deleted 1y ago
  [deleted]

AnthonyMouse 1y ago

> If you don't want Cloudflare seeing your DNS requests, then use one of them instead. Normal people have no idea that this even exists, much less how to do it, so they're still having all their queries routed to Cloudflare by default. > The only difference between DoT and DoH is that DoT is easier to block and force fallback to totally insecure DNS. A normal middlebox can't even tell the difference between DoH and DoT because they both just look like TLS. A corporate one that requires you to install certificates on the client so that it can, is just as able to block DoH as DoT. And fallback isn't required in either case. If some network is blocking encrypted DNS, the client device can be configured to fail rather than use the insecure DNS, at which point the user knows that the network is adversarial and can switch to a VPN or a cellular connection etc.

zinekeller 1y ago
> A normal middlebox can't even tell the difference between DoH and DoT because they both just look like TLS. You forgot the "let's intercept in a public place (e.g. public Wi-Fi hotspots)" one where blocking port 853 is super trivial while blocking port 443... is impossible. Sure, Google DNS will be blocked easily but there a lot of DoH providers!
- AnthonyMouse 1y ago
  There is no law against running DoT over port 443.
  - tptacek 1y ago
    At that point you might as well use DoH. But you're also reasoning axiomatically about something we have a lot of documentary evidence for: the DNS operator community (or a big chunk of it) favors DoT and opposes DoH because they want to make it easier to block encrypted DNS; they frame this in terms of "control over their own networks".
    - AnthonyMouse 1y ago
      > At that point you might as well use DoH. What benefit is the additional complexity and overhead of HTTP buying you there? > the DNS operator community (or a big chunk of it) favors DoT and opposes DoH because they want to make it easier to block encrypted DNS; they frame this in terms of "control over their own networks". This is one of the main issues here: When then DNS operator is you, i.e. your local network at home or your corporate network within your own company, you should be able to control DNS on your own network, which you can't if a bunch of adversarial devices are bypassing your DNS servers. When the DNS operator is your ISP, letting them block encrypted DNS is bad. So what we need is some way to distinguish between these situations so that the local network administrator's preferences are heeded but Comcast can go pound sand. But browsers are too late in the stack for that because they have no way to tell if the system DNS server is the one the user wants or the one they got by default from their ISP and never knew to change.

rsync 1y ago

"But slowly people started to realize what the collaboration between Mozilla and Cloudflare really means: Cloudflare gets all your DNS queries." This is not wrong. This is correct. The article speaks correctly here.

tptacek 1y ago
The comment you're replying to used that quote to frame their argument that there are plenty of providers besides Cloudflare. Nobody is disputing that if you set your provider to Cloudflare your queries go to Cloudflare. This is not a reasonable rebuttal.
- timewizard 1y ago
  In 2018 how many other choices were there actually?
  - josephcsible 1y ago
    This article says "Last update: 2018-10-26". https://github.com/curl/curl/wiki/DNS-over-HTTPS/9e5a5acf7999ba00ebae47405ff1ab8790ddcd0d https://github.com/curl/curl/wiki/DNS-over-HTTPS/9e5a5acf799... shows the list as of then, which had 12 choices.
josephcsible 1y ago
If you use Cloudflare as your provider, then yes. But the article incorrectly asserts that DoH requires you to use Cloudflare as your provider.

gsich 1y ago

>The only difference between DoT and DoH is that DoT is easier to block and force fallback to totally insecure DNS. There's no reason to ever use DoT if you can use DoH. (And I don't get why the author likes it better: whoever runs the DoT server gets the exact same data that they'd get with a DoH server instead.) Don't use shitty networks then. This is not an issue for all residential (and mobile) connections. Only corporate and other shtity configured networks are affected by this.

josephcsible 1y ago
> Don't use shitty networks then. This is not an issue for all residential (and mobile) connections. Only corporate and other shtity configured networks are affected by this. There are some residential and mobile connections that this is an issue for. And it's not always an option to use a network that doesn't try to do this.
- gsich 1y ago
  Maybe 0.01%. Anyway, it's not an argument against it.

bastard_op 1y ago

The article is not wrong, it's exactly what they're doing, but so does Google with their 8.8.8.8 servers, and you thought Google was doing it out of the goodness of their hearts (after they removed the do not be evil clause). At least Cloudflare offers their 1.1.1.2 and 1.1.1.3 resolvers with built-in content filtering or full adult content filtering as as unfiltered 1.1.1.1, which is better than others. Normally folks pay Cisco OpenDNS or other enterprise-y products for this, and I applaud them doing it in general, for free. I'd set my mother to use it if something I had to do still. Cloudflare is probably one of the less-evil companies today, and is a good engineering company if you follow their blogs. Apple is actually worse in that they forced an entire DNS AND Web Proxy solution to get ALL traffic every apple users do in the name of "privacy", but in the end it's really more for their marketing and analytics they can sell at will. Funny Google tried to offer a VPN service and everyone shunned it, but Apple people just drank the kool-aid as something nice Apple did just because they're a lovely company like that. As the security guy that runs enterprise firewalls, I tend to block the Apple's VPN/proxy stuff as proxy-avoidance by default, which creates a ton of noise in terms of denied apple proxy and doh drops, but it keeps them using my internal dns and internet that I can see when l-users happen to get themselves infected and start exfiltrating data to China. Otherwise with Apple's VPN/Proxy privacy bs, I have no ability to see or stop it, and neither do their users. Thanks for the fish Apple. I just assume all VPN companies do this now as their real revenue stream. I also happen to do work for Firefox's primary advertising partner, and I can tell you it brings me no comfort as a Firefox user myself.

deleted 1y ago
[deleted]