3 ms·

What’s the selling point of ODoH given the low uptake of ECH which means the name of the server you’re talking to is given away anyway?

by cedws 5mo ago

fc417fc802 5mo ago
I'd think that if you've got several leaks then patching one up is still forward progress even if it doesn't deliver a full fix immediately.
rdme 5mo ago
They solve different things. ODoH hides your question, not who you're talking to.
- fc417fc802 5mo ago
  Sure ODoH hides your query but you then turn around and leak the question you just asked as part of the TLS handshake.
  - rdme 5mo ago
    I agree with you, however that's a separate problem that needs to be solved
  - jiveturkey 5mo ago
    Leaked to different parties. Assuming you don't have ECH, you leak the question (in practical terms) to your ISP, and you leak your question to the DNS provider. With ODoH you plug the latter leak. Plugging that first leak is then still a problem (solved separately) but it's orthogonal to the second. Even with ECH, where you plug the TLS leak, you have many more holes to plug. IP address might not be shared or might be shared across too few properties, and then traffic profile after the initial connect (to retrieve all the sub-resources) can identify destinations.
    - fc417fc802 5mo ago
      It's not limited to the ISP and DNS provider. Thanks to being plaintext it's anyone anywhere along the network path (unless you were already using DoH of course, but sans-ECH is still the entire path regardless). Anyway I agree with you that plugging leaks is good (notice my adjacent comment). My response there was intended to provide clarification regarding the preceding exchange.
      - jiveturkey 5mo ago
        Going off on a tangent, I wish there were more awareness of how this concentrates power to Cloudflare.
        fc417fc802 5mo ago
        Between so many service operators intentionally purchasing MitM as a service from the cloud providers and the ever increasing proliferation of centralized captcha solutions that work via fingerprinting the entire situation seems increasingly hopeless.
elp 5mo ago
My, admittedly cynical, view of it is that the main selling point is that you share your data with the person running the ODoH server. The truth is that very very few people run their own recursive nameserver. The entirely reasonable assumption for any authoritative nameserver, like .com, is that the query is being asked on behalf of someone else and knowing that a user of your nameserver asked for the ip of sexysheep.com doesn't give them a lot of useful info. I'm think many ISPs actually sell a lot of data from their recursive nameservers, but I'm willing to bet that almost no-one bothers to sniff port 53 udp traffic going elsewhere. My vote for the best privacy option is always going to be just run pi-hole with your own recursive nameservers.
- petcat 5mo ago
  > your own recursive nameserver But then the internet can know that you are the one using your own resolvers and so they can trivially identify your traffic. Really you need to use some public resolver with a critical mass of other users in order to have any hope for anonymity. But then of course you have to trust that resolver too.
- rdme 5mo ago
  The relay sees IP + ciphertext, the target sees question + relay's IP. No single party gets both
  - petcat 5mo ago
    What if the relay and target are being operated by the same provider? The relay controls where the question is sent right? They can collude?
    - rdme 5mo ago
      no, you are actually telling the relay where to redirect your question from the start (because you are encrypting the question with the public key of the destination resolver) - the relay sending the question where it wants would result in the destination to not be able to decrypt it
    - 5mo ago
jeroenhd 5mo ago
It means you can use a decently fast DNS server like Cloudflare without the major privacy problems of using Cloudflare. Or DNS4EU, or any non-ISP DNS server really. Your ISP snooping on you with SNI logging is something people using normal ISPs don't need to worry about, but feeding all your data into a profit-driven company is.
- LoganDark 5mo ago
  > something people using normal ISPs don't need to worry about It doesn't matter which ISP you're using if the cables are tapped, which they pretty much are.
  - UqWBcuFx6NV4r 5mo ago
    Please don’t be intentionally tone-deaf. “a nation-state can track my shit therefore it’s not with doing” is a silly, silly, silly approach to security, and does not speak to the concerns of the vast majority of even privacy-focused people.
    - deleted 5mo ago
      [deleted]
    - LoganDark 5mo ago
      That's not what I was saying. I'm just saying that if the goal is not to be tracked, that's pretty difficult to achieve with pretty much any normal ISP. Not saying that all forms of tracking are something to be worried about to the point where it's not worth doing defense-in-depth whatsoever... obviously any shred of privacy you can get is good.
  - jeroenhd 5mo ago
    If you piss off any government enough that you suspect your wires may be tapped, ODoH will not save you and TOR probably will not do much better. If you live in a place with omnipresent government monitoring (China/Iran/etc.), there is no solution. Any solution to getting wiretapped with a legal order will almost certainly be an extra charge the day you do get arrested.
aftbit 5mo ago
What's the selling point of locking your front door given that you have an easily breakable window nearby?
- cwillu 5mo ago
  It's more like closing the blinds while your frontdoor is wide open.
josephcsible 5mo ago
By that logic, someone else would ask "what's the point of ECH since that data will just leak via DNS?" and then neither technology would ever roll out. Deploying this now despite that is exactly how you fix that chicken-and-egg problem.
1vuio0pswjnm7 5mo ago
ODoH selling point is same as DoH selling point: third party DNS providers, e.g., shared caches, want query data for commercial purposes^1 And, funnily enough, they want data from users who are looking for "privacy" Also, ODoH claims it will hide the client's IP address. ECH, even it were adopted by CDNs and websites, cf. being "supported" by a browser,^2 will not hide the client's IP address 1. Silicon Valley has this bizarre narrative where ISPs are the "bad guys" when it's Silicon Valley who created the online surveillance dystopia we are living in. Truthfully it's a competition over who can collect more data, conduct more surveillance and perform more ad services: Silicon Valley or ISPs. Silicon Valley is generally 100% focused on this as a "business model", cf. selling internet access, they have captured the market and they pose a much greater threat to the user seeking "privacy" 2. Where the browser vendor is Silicon Valley and data collection, surveillance and online advertising services is the "business model" NB. Third party recursive DNS service has other uses besides "privacy", e.g., avoiding censorship

What’s the selling point of ODoH given the low uptake of ECH which means the name of the server you’re talking to is given away anyway?

by cedws 5mo ago

What’s the selling point of ODoH given the low uptake of ECH which means the name of the server you’re talking to is given away anyway?

fc417fc802 5mo ago

I'd think that if you've got several leaks then patching one up is still forward progress even if it doesn't deliver a full fix immediately.

rdme 5mo ago

They solve different things. ODoH hides your question, not who you're talking to.

fc417fc802 5mo ago
Sure ODoH hides your query but you then turn around and leak the question you just asked as part of the TLS handshake.
- rdme 5mo ago
  I agree with you, however that's a separate problem that needs to be solved
- jiveturkey 5mo ago
  Leaked to different parties. Assuming you don't have ECH, you leak the question (in practical terms) to your ISP, and you leak your question to the DNS provider. With ODoH you plug the latter leak. Plugging that first leak is then still a problem (solved separately) but it's orthogonal to the second. Even with ECH, where you plug the TLS leak, you have many more holes to plug. IP address might not be shared or might be shared across too few properties, and then traffic profile after the initial connect (to retrieve all the sub-resources) can identify destinations.
  - fc417fc802 5mo ago
    It's not limited to the ISP and DNS provider. Thanks to being plaintext it's anyone anywhere along the network path (unless you were already using DoH of course, but sans-ECH is still the entire path regardless). Anyway I agree with you that plugging leaks is good (notice my adjacent comment). My response there was intended to provide clarification regarding the preceding exchange.
    - jiveturkey 5mo ago
      Going off on a tangent, I wish there were more awareness of how this concentrates power to Cloudflare.
      - fc417fc802 5mo ago
        Between so many service operators intentionally purchasing MitM as a service from the cloud providers and the ever increasing proliferation of centralized captcha solutions that work via fingerprinting the entire situation seems increasingly hopeless.

elp 5mo ago

My, admittedly cynical, view of it is that the main selling point is that you share your data with the person running the ODoH server. The truth is that very very few people run their own recursive nameserver. The entirely reasonable assumption for any authoritative nameserver, like .com, is that the query is being asked on behalf of someone else and knowing that a user of your nameserver asked for the ip of sexysheep.com doesn't give them a lot of useful info. I'm think many ISPs actually sell a lot of data from their recursive nameservers, but I'm willing to bet that almost no-one bothers to sniff port 53 udp traffic going elsewhere. My vote for the best privacy option is always going to be just run pi-hole with your own recursive nameservers.

petcat 5mo ago
> your own recursive nameserver But then the internet can know that you are the one using your own resolvers and so they can trivially identify your traffic. Really you need to use some public resolver with a critical mass of other users in order to have any hope for anonymity. But then of course you have to trust that resolver too.
rdme 5mo ago
The relay sees IP + ciphertext, the target sees question + relay's IP. No single party gets both
- petcat 5mo ago
  What if the relay and target are being operated by the same provider? The relay controls where the question is sent right? They can collude?
  - rdme 5mo ago
    no, you are actually telling the relay where to redirect your question from the start (because you are encrypting the question with the public key of the destination resolver) - the relay sending the question where it wants would result in the destination to not be able to decrypt it
  - 5mo ago

jeroenhd 5mo ago

It means you can use a decently fast DNS server like Cloudflare without the major privacy problems of using Cloudflare. Or DNS4EU, or any non-ISP DNS server really. Your ISP snooping on you with SNI logging is something people using normal ISPs don't need to worry about, but feeding all your data into a profit-driven company is.

LoganDark 5mo ago
> something people using normal ISPs don't need to worry about It doesn't matter which ISP you're using if the cables are tapped, which they pretty much are.
- UqWBcuFx6NV4r 5mo ago
  Please don’t be intentionally tone-deaf. “a nation-state can track my shit therefore it’s not with doing” is a silly, silly, silly approach to security, and does not speak to the concerns of the vast majority of even privacy-focused people.
  - deleted 5mo ago
    [deleted]
  - LoganDark 5mo ago
    That's not what I was saying. I'm just saying that if the goal is not to be tracked, that's pretty difficult to achieve with pretty much any normal ISP. Not saying that all forms of tracking are something to be worried about to the point where it's not worth doing defense-in-depth whatsoever... obviously any shred of privacy you can get is good.
- jeroenhd 5mo ago
  If you piss off any government enough that you suspect your wires may be tapped, ODoH will not save you and TOR probably will not do much better. If you live in a place with omnipresent government monitoring (China/Iran/etc.), there is no solution. Any solution to getting wiretapped with a legal order will almost certainly be an extra charge the day you do get arrested.

aftbit 5mo ago

What's the selling point of locking your front door given that you have an easily breakable window nearby?

cwillu 5mo ago
It's more like closing the blinds while your frontdoor is wide open.

josephcsible 5mo ago

By that logic, someone else would ask "what's the point of ECH since that data will just leak via DNS?" and then neither technology would ever roll out. Deploying this now despite that is exactly how you fix that chicken-and-egg problem.

1vuio0pswjnm7 5mo ago

ODoH selling point is same as DoH selling point: third party DNS providers, e.g., shared caches, want query data for commercial purposes^1 And, funnily enough, they want data from users who are looking for "privacy" Also, ODoH claims it will hide the client's IP address. ECH, even it were adopted by CDNs and websites, cf. being "supported" by a browser,^2 will not hide the client's IP address 1. Silicon Valley has this bizarre narrative where ISPs are the "bad guys" when it's Silicon Valley who created the online surveillance dystopia we are living in. Truthfully it's a competition over who can collect more data, conduct more surveillance and perform more ad services: Silicon Valley or ISPs. Silicon Valley is generally 100% focused on this as a "business model", cf. selling internet access, they have captured the market and they pose a much greater threat to the user seeking "privacy" 2. Where the browser vendor is Silicon Valley and data collection, surveillance and online advertising services is the "business model" NB. Third party recursive DNS service has other uses besides "privacy", e.g., avoiding censorship