What’s Next in Making Encrypted DNS-over-HTTPS the Default

https://blog.mozilla.org/futurereleases/2019/09/06/whats-next-in-making-dns-over-https-the-default/

by bzbarsky • 7 years ago

139 186 7 years ago

blog.mozilla.org

JeanMarcS• 7 years ago

So what will be « safer » ?

Using a pi-hole or equivalent, or using this ?

IIRC all DoH requests are sent to Cloudflare. Is there a way to host your own DNS server and use it with DoH instead ?

pletnes• 7 years ago

AFAIK a pi-hole can use dns-over-https if configured correctly so there’s no either/or.

milofeynman• 7 years ago

They are not mutually exclusive. Pi-hole supports dns-over-https. My concern with this technology is my port 53 masquerade rule on my router will no longer grab all dns requests when this becomes common practice. I imagine there will be a solution but I'm not sure what it is.

mtsr11• 7 years ago

I don't really see a solution without installing root CA's to MitM HTTPS traffic. I too would be interested in solutions for this.

jlgaddis3• 7 years ago

Yeah, you can re-configure Pi-Hole to use DoH (with your preferred servers). unbound can be configured to use DoH as well.

mtsr11• 7 years ago

For forwarding yes, but not for recursive resolution.

mike-cardwell• 7 years ago

For unbound, I just dropped this in my /etc/unbound/unbound.conf.d/02-block-doh.conf

  local-zone: "use-application-dns.net" static

iforgotpassword• 7 years ago

For now I'm blocking traffic to Google's and cloudflare's DNS and plan on also following the advice about that special domain from https://support.mozilla.org/en-US/kb/configuring-networks-di... that someone posted here.

papaf• 7 years ago

At first, I was sceptical of DNS over HTTPS and thought that it gave Cloudflare, who already control too much access over the internet, even more control.

However, other DNS providers are available. For instance Google[1] and Quad 9 [2] both provide free DNS over HTTPS services.

[1] https://developers.google.com/speed/public-dns/docs/doh/

[2] https://www.quad9.net/doh-quad9-dns-servers/

auslander3• 7 years ago

For instance Google[1] and Quad 9 [2] both provide free DNS over HTTPS services.

Using Google is giving your browsing history to an Ad company, why? At least Quad9 is non-profit. It also provides DNS over TLS, DoT service, which I'm using.

shpx2• 7 years ago

Because with Google you only have to trust one organization that flat out says in the FAQ that they do not "correlate or combine information from temporary or permanent logs with any personal information that [you] have provided Google for other services".

Quad9 is a conglomorate of "Threat Intelligence Partners" and three founding organizations: IBM, Packet Clearing House and Global Cyber Alliance https://www.quad9.net/about/ . What's that third one? I don't know, but it's founded by The City of London Police, NY District Attorney and the Center for Internet Security https://www.globalcyberalliance.org/who-we-are/ that third one is like a hundred "Partners", with such privacy champions as The US Secret Service. Over 100 organizations. What are their incentives? What role do all these organization play and how much access do they have? Who knows.

Compare their privacy policies. They're strikingly similar because Quad9 largely lifted theirs from Google's (I'm assuming, since theirs came later)

https://developers.google.com/speed/public-dns/privacy

https://www.quad9.net/policy/

Google's policy states they collect private information for 24-48 hours, keep "anonymized" information for 2 weeks and then randomly samples that data for permanent storage:

Google Public DNS stores two sets of logs: temporary and permanent. The temporary logs store the full IP address of the machine you're using. We have to do this so that we can spot potentially bad things like DDoS attacks and so we can fix problems, such as particular domains not showing up for specific users.
We delete these temporary logs within 24 to 48 hours.
In the permanent logs, we don't keep personally identifiable information or IP information. We do keep some location information (at the city/metro level) so that we can conduct debugging, analyze abuse phenomena. After keeping this data for two weeks, we randomly sample a small subset for permanent storage.

Quad9 collects effectively the same information (except AS) as Google's 2 week logs and says

All the above data may be kept in full or partial form in permanent archives.

If you want a game theoretic, capitalist analysis, Google has an incentive to keep the web running and keeping it an awesome platform, to make sure humanity's information is created and shared in an open format that they know how to index and that they can freely index, instead of apps or some alternative web or some other walled garden.

But we're bombarded daily with "goog bad" by politicians and journalists, so Google must obviously be just brazenly lying and you should give your DNS history to an organization founded by The City of London Police instead that "share anonymized data on specific domains queried [...] with its threat intelligence partners".

Please double check my work, I didn't read the privacy policies too carefully (I think notably Google stores the AS number and Quad9 doesn't) because I don't actually care, I (along with roughly 100% of internet users) just give all my DNS history in plain text to my ISP.

alexis_fr• 7 years ago

The difference is, DNS-over-HTTPS seems to support cookies and identification. DNS only identified the IP of a person.

So it’s clearly an upgrade for Google.

mtsr11• 7 years ago

Ooh, that's an interesting tack. I wonder if Firefox stores cookies or sends enough headers for fingerprinting DoH requests.

jedisct17• 7 years ago

A really good presentation on the privacy implications of "modern DNS" by PowerDNS https://www.youtube.com/watch?v=V2F92orIEO8

jedisct17• 7 years ago

There are many more secure public resolvers than Google and Quad9 : https://dnscrypt.info/public-servers

jlgaddis3• 7 years ago

I didn't see it mentioned in the article. Has Mozilla said whose servers they will be sending unsuspecting users queries to by default? (IIRC, it was Cloudflare previously. Any reason to believe this has changed?)

---

If, like me, you already have a solution in place you are happy with and don't like the idea of others (deciding they know what's best for you and) circumventing it, simply ensure that your existing resolvers are configured as described in [0]:

Network administrators may configure their networks as follows to signal that their local DNS resolver implemented special features that make the network unsuitable for DoH:
DNS queries for the A and AAAA records for the domain “use-application-dns.net” must respond with NXDOMAIN rather than the IP address retrieved from the authoritative nameserver.

[0] https://support.mozilla.org/en-US/kb/configuring-networks-di...

josteink10• 7 years ago

If true that DoH can be disabled at network level, ad-blocking solutions like pihole should probably implement it by default.

Anyone have any idea if this is the case?

That would at least save me a lot of trouble and work.

Dylan168073• 7 years ago

Pihole is great because it can do all your non-browser activity.

But for a browser, an ad-blocking extension works better and is less than a minute to set up. Why force it to use the same DNS blocking?

EvanAnderson5• 7 years ago

Already proposed: https://discourse.pi-hole.net/t/support-for-returning-nxdoma...

jedisct17• 7 years ago

Already implemented in the latest dnscrypt-proxy version.

TazeTSchnitzel2• 7 years ago

I wonder if UK ISPs that complained about DoH will block use-application-dns.net network-wide.

nicolaslem2• 7 years ago

The article is not clear about one issue: are all applications expected to disregard the OS DNS? Is there an option to tell all applications that they should not bypass it?

I will be pretty pissed if I wake up one day and find that Firefox decided to stop using my DNS server and instead started sending my requests to a third-party.

jlgaddis3• 7 years ago

That's exactly what their plan is -- and if you have experiments enabled, they may have already started sending your DNS queries to Cloudflare.

z3t43• 7 years ago

I guess thats Mozillas new monetizing strategy, sell user data to cloudflare, and market it as privacy.

If you want privacy you better firewall everything your computer want to send to Cloudflare, Akamai, et.al.

modeless• 7 years ago

The article explicitly mentions the way to tell applications including Firefox not to disregard the OS DNS: blocking a canary domain. It even links to detailed instructions.

Frankly, given how much trouble I've had with systemd's DNS meddling, I look forward to applications taking DNS under their own control.

Dont_panic• 7 years ago

It's a bad idea what it end up starting a cycle where every big application uses their own DNS. Some of them might not wven do it right

nicolaslem2• 7 years ago

blocking a canary domain

And how long will it take for most ISPs to block this domain when they realize that their DNS servers are not being used anymore? Some of them sell this data so they see it as a source of revenue.

At this point this canary domain will have the same fate as Do Not Track.

I look forward to applications taking DNS under their own control.

I am sure I can find a hundred applications/programs resolving domains on my machine. It is unrealistic to configure all of them separately. At this point we are back to the OS providing the configuration for all of them.

lordlimecat3• 7 years ago

Do you mean Network manager? AFAIK systemD does not meddle with dns.

And there's a rather short conf.d stub you can create that disables NM's meddling with resolv.conf.

Santosh832• 7 years ago

Mozilla can only speak for their applications and they seem to eventually intend Firefox to use DoH as default and fallback to OS DNS under various failure conditions some of which are mentioned in the post. They also say:

"When DoH is enabled, users will be notified and given the opportunity to opt out."

s_tec3• 7 years ago

Firefox decided to stop using my DNS server

In an ideal world, your probably want some sort of encrypted connection to your own DNS server (unless your LAN is 100% trusted). Maybe something like HTTPS would work... oh wait.

Most people don't have their own DNS server, so their DNS traffic is already who-knows-what server with who-knows-what monetization in place (plus its in plaintext, so the rest of the internet gets it too).

DNS over HTTPS seems like a net win for both types of users. Power users like you get way to encrypt your DNS traffic, and non-technical users get an encrypted connection to a potentially less-hostile DNS server. It sucks that there is now a second place to configure things, but hopefully seeing this work well will put pressure on the OS to adopt DNS over HTTPS natively, bringing the experiment to its final goal (at least, I assume this is the endgame).

throw0101a12• 7 years ago

And how the hell is split-horizon DNS supposed to work if resolve.conf is ignored?

This may be "fine" for (some) home users, but most organizations have a whole bunch of internal-only records. And even a lot of residences have things like printers and such that live under .local: how is the browser supposed to connect to those?

Who the fsck is Mozilla that they get to dictate policy in my IT organization about how DNS "should" work?

xg156• 7 years ago

Most people don't have their own DNS server, so their DNS traffic is already who-knows-what server with who-knows-what monetization in place (plus its in plaintext, so the rest of the internet gets it too).

I know perfectly well who operates my DNS server: My ISP. If they are doing shady stuff, I can sue them, raise awareness or switch providers.

I can't do the same with hardwired DoH endpoints.

josteink10• 7 years ago

unless your LAN is 100% trusted

For 99% of the people out there, it is.

Can Mozilla stop interfering with my network and get back to doing useful things with Firefox now?

darkhorn3• 7 years ago

Are all applications expected to disregard the OS DNS?

I hope so if OS continues to use plaintext (none secure) DNS queries.

throw0101a12• 7 years ago

Is there an option to tell all applications that they should not bypass it?

Yes there is. If your internal recursive DNS servers return an NXDOMAIN for "use-application-dns.net", then Firefox will stick with gethostbyname(3) (or whatever). See:

* https://support.mozilla.org/en-US/kb/configuring-networks-di...

If you’re using NLnet’s unbound(8) as a recursive DNS server, it’s possible to use the “local-zone” directive to force an NXDOMAIN:

* https://serverfault.com/questions/625170/

For ISC’s BIND, the response policy zone (RPZ) mechanism does something similar on BIND 9.8+ (it’s more flexible, so more complicated to configure):

* https://jpmens.net/2011/04/26/how-to-configure-your-bind-res...

* https://downloads.isc.org/isc/bind9/9.9.5/doc/arm/Bv9ARM.ch0...

* https://dnsrpz.info

* https://tools.ietf.org/html/draft-vixie-dnsop-dns-rpz

* http://www.zytrax.com/books/dns/ch7/rpz.html

* https://serverfault.com/questions/618106/set-up-bind9-as-dns...

techntoke• 7 years ago

At what point can I expect Mozilla to start proxying my web requests as well?

andrerm2• 7 years ago

Mozilla I don't know but Google is already doing it with AMP

euph0ria2• 7 years ago

What is the latency for DoH compared to traditional UDP DNS?

Santosh832• 7 years ago

I have DoH enabled (Cloudflare) and I can't visibly notice any latency compared to normal DNS (which was also Cloudflare). I haven't timed the requests though...

nullify88• 7 years ago

Here's a whitepaper that did some benchmarks and a detailed analysis on it. Was posted on hn a few days ago. https://arxiv.org/abs/1907.08089

They test various network conditions with some results showing DoH and DoT loading webpages faster than udp dns (due to tcp timing out faster than udp on lossy connections )

euph0ria2• 7 years ago

Thanks!

auslander3• 7 years ago

I wish Mozilla had Firefox version free from all integrations with 3rd parties.

floatboth3• 7 years ago

Just build it from source with no API keys.

(Though DoH is not an "integration" in that sense.)

Jonnax3• 7 years ago

There's a lot of negativity here.

But this is a win overall for privacy.

DNS is used by ISPs to sell user's data and is one way that oppressive regimes track what their users do.

If you're technical enough to understand DNS then you are smart enough to change what the default is.

If you're a system administrator for a company. You should be able to push a profile down to the user's computer to configure DNS how you want.

TheChaplain• 7 years ago

Well, DoH effectively bypass DNS-filters set up by countries. While some are questionable, I believe it won't take long until Mozilla ends up with some bad press, and being an underdog it doesn't need that.

indalo• 7 years ago

To me that is good press, and it's something I personally would like. Seeing a state and/or adjunct corporations throwing a tantrum over this is only a measure of success.

After all privacy is the goal, isn't it?

zajio1am2• 7 years ago

Not if one trusts more his/her ISP more than Cloudflare. At least, an ISP is a contractual partner and under the same jurisdiction, in Europe including GDPR.

floatboth3• 7 years ago

Being in the same jurisdiction is bad: your ISP is THE place for your local law enforcement to get info on your browsing.

rnhmjoj2• 7 years ago

Or if you run your own resolver and don't want a completely unrelated third party like Cloudflare siphoning your traffic.

lordlimecat3• 7 years ago

Cloudflare would also be under GDPR as it serves customers in EU.

meowface• 7 years ago

For what it's worth, I trust Cloudflare an order of magnitude more than I trust my ISP (Comcast).

zzzcpan5• 7 years ago

But this is a win overall for privacy.
DNS is used by ISPs to sell user's data and is one way that oppressive regimes track what their users do.

It's not a win for privacy, ISPs will still have that data and now third parties will have that data, state actors will have that data in a nice convenient centralized locations, governments will have an ability to force those centralized providers to do censorship for them. As for oppressive regimes - they don't care about DNS data, if they want to spy on people, they will one way or another.

lovelearning3• 7 years ago

DoH does not imply centralization in any way. Any trusted party can provide their own DoH endpoint. I can run my own DoH server on a cheap VPS hosted in another country.

I live in an increasingly oppressive regime. Most of the blocking is done at DNS level. DoH is a great solution. Slamming DoH because they can anyway spy one way or another is a poor argument.

xorcist• 7 years ago

DNS is used by ISPs to sell user's data

Claims like these keep surfacing in every discussion. While it is good to contemplate what your ISP spying on you would look like and what you can do to minimize that risk, it is not good to present this as normal behaviour.

From my perspective I am absolutely certain that this is not something that is routinely done, not in established ISPs in democratic countries. The risks would be far too great for a tiny income. Who would you sell to? The advertising networks have their own data sources, and even the web giants with billions of users and trackers embedded in pretty much every web page you visit can't charge much.

Even if you wanted to do this, DNS would be a low value target considering it is cached at every layer. Data mining sFlow logs, which is something every ISP would use anyway for diagnostic purposes, would give you better view of which kind of services users connect to and for how long.

So please don't normalize something that is at best a niche for bad actors. That can lead to decisions for end users, many of whom would be wiser not sending their data off to a foreign third party.

BubRoss2• 7 years ago

How are you so certain that this doesn't happen in general?

throw0101a12• 7 years ago

DNS is used by ISPs to sell user's data and is one way that oppressive regimes track what their users do.

Your ISP may do this, but mine does not, so why should Mozilla get to dictate IT policy of my machine (i.e., ignoring resolve.conf)? Or policy of the company where I help run IT?

Jonnax3• 7 years ago

DNS is a plaintext protocol. It's a new technology. Technically this is better.

It reminds me of this silliness I sometimes hear:

"I need to use NAT with IPv6 to protect my network"

Firefox will allow you to set up a DNS rule locally that forces the client to use local dns, if you need it.

You can also configure a DNS over HTTPs server as your DNS.

If you help run IT and care about security. Then you should be blocking direct access to the internet anyway.

All your traffic should be going through a proxy server.

Also defaults should help those that are in weaker security positions. Just because you're lucky to have a good ISP doesn't mean that other people shouldn't be protected by default.

You're knowledgeable enough to configure your DNS, you just gotta learn something different.

edjw• 7 years ago

Unfortunately, Mozilla are planning to leave DoH off by default for Firefox users in the UK. Almost certainly to avoid criticism from politicians and children’s charities about how DoH would interfere with the UK’s network level website blocking of ‘adult’ websites.

choeger• 7 years ago

Hrhr. But talk about how it intends to prevent censorship...

andreareina• 7 years ago

Fall back to operating system defaults for DNS when split horizon configuration or other DNS issues cause lookup failures.

I hope we'll be given the opportunity to disable this, or at the very least show a warning (similar to cert warnings?) that something's off.

the8472• 7 years ago

the network.trr.mode setting provides fine control

https://wiki.mozilla.org/Trusted_Recursive_Resolver

elcomet2• 7 years ago

Why don't they rather include a resolver in Firefox ?

This way, no privacy problems, you're directly contacting authoritarive servers. And you don't rely on a single dns-over-https provider.

Is the latency a big problem there? I would say that with caching it is not too bad.

EvanAnderson5• 7 years ago

A local resolver using root hints and DNS-over-TLS would be a win for privacy and, at the same time, would not promote centralization of the Internet to DNS-over-HTTPS providers. It still suffers from the problem of overriding local network policy but it's better than just handing all the queries over to a single DoH provider.

StavrosK3• 7 years ago

How is DoT different from DoH? Do you have an issue with the format on the wire? Because otherwise you can use whichever resolver you want in either case.

hannob• 7 years ago

1. The connection to the authoritative servers isn't encrypted, so the whole point of DoH is undermined.

2. There's plenty of networks that don't let arbitrary DNS traffic out, so this doesn't work without another fallbacks. Fallbacks for security features are bad.

I see that there are legit controversies around DoH. But these "Why don't you just do X?" comments aren't helpful. Try to understand the problem they're trying to resolve.

elcomet2• 7 years ago

Well I'm asking because I'm trying to understand the drawbacks of a resolving server. Thanks for the explanation !

EvanAnderson5• 7 years ago

I disagree that the OP's comment isn't helpful. Mozilla could have taken a tack that would have increased decentralization and promoted privacy (DNS-over-TLS exists). Instead, they went the way of a centralized protocol that just trades one set of potentially bad actors (ISPs) for another.

re: network policy - If you're paying to use a network with policy that you disagree with vote w/ your wallet. If you're using somebody else's network (i.e. a corporate network I'm paid to administer, for example) it's reasonable to accept that you're bound by the owner's policy-- it's their network.

poizan42• 7 years ago

Besides what the other commenters have said, it also just seems like a bad idea to add 170 million extra recursive resolvers, I don't know how well the dns infrastructure would cope with that extra amount of traffic.

mtsr11• 7 years ago

Each of which individually generates really limited traffic?

Besides, the number of domains and relatively short TTLs mean that even the big resolvers will not have most requests cached except for the most popular domains.

pmontra• 7 years ago

DoH bypasses the OS and the /etc/hosts file. This breaks some workflows.

Jonnax3• 7 years ago

Oh no.

Maybe you can configure this? https://support.mozilla.org/en-US/kb/customizing-firefox-usi...

Or perhaps use their canary domain to force Firefox to use local DNS?

Or just configure it yourself?

It's not security if an application can still access the internet. Why not block all internet access except via a proxy server? Which is what a "real" enterprise would do because they can block what they want and have a secure network.

lota-putty• 7 years ago

We're getting an option to bypass TSP's DNS to a 3rd party over secure connection; be it DoH or DoT.

TSPs can easily map your usage behaviour to your identity while 3rd party DNS provider will have your behaviour alone. Albeit, TSP will still have IPs you've accessed for data transfer.

TSPs that honour their customers' privacy will allow 3rd party DoH/DoT, esp DoT(ie port:853).

TSP: Telecom service provider

EvanAnderson5• 7 years ago

Can somebody point me to the place in the Firefox code where the "use-application-dns.net" canary domain is actually checked? I've tried searching the mozilla-central Mercurial repository and I'm not finding it. I'm clearly inept here.

I'm looking at what my Windows DNS servers return when I put in an empty zone for "use-application-dns.net" and I'd like to see exactly what Firefox is testing for. Windows 2012 R2, at least, returns the SOA and no NXDOMAIN for an "A" query to "use-application-dns.net" with an empty zone. If they're explicitly looking for NXDOMAIN then blocking DOH behavior with Windows DNS servers probably isn't going to work. >sigh<

bzbarsky5• 7 years ago

The canary is not implemented yet, as far as I can tell.

antpls• 7 years ago

I tried forced-mode DoH in Firefox 68 and 69, on Debian 9 and 10. In all cases, it worked for a while then stopped to work after a few hours (at random it seems). The only way for me to make it work again was to disable DoH.

I guess a more long term solution is to have a local proxy dns-to-doh, but we are falling back in the solution that only a technical user can setup :

https://developers.cloudflare.com/1.1.1.1/dns-over-https/clo...

https://facebookexperimental.github.io/doh-proxy/

And it means setting up firewall routing and filters, as some softwares don't have settings to add DNS proxy, or even bypass them (Google Chrome for example)

tannhaeuser2• 7 years ago

Same story as always with Google "innovations": "hey, we're preventing DNS queries to go to your ISP who is selling it" (to go to our service instead so we can profit from it).

It's scary that Moz sides with monopolies like Google and Cloudflare on this one.

LUmBULtERA• 7 years ago

In my Firefox settings I can choose any DoH provider I want, not just Cloudflare. Naturally something has to be set up as a default so it works. Why is adding DoH in the browser a bad thing?

josteink10• 7 years ago

Because if we’re replacing classic DNS with something new, it needs to be part of the OS.

Not reimplemented (and configured) per application. The user and OS should control the application, not the other way around.

tannhaeuser2• 7 years ago

The DNS has grown into a regulated service, with TLD authorities and protocols to follow for registrators, transparency for domain holders, many registrators to choose, etc. Do you want to replace it by a centralized system run by very few monopolies that track resolution queries by IP?

jedisct17• 7 years ago

At the end, you still need to trust the resolver.

There is a proposal to improve this. Resolves won't know client IPs any more: https://github.com/DNSCrypt/dnscrypt-protocol/blob/master/AN...

Reference client and server implementations should be ready in the next few days.

vavrusa2• 7 years ago

This is interesting as a lighter alternative to DNS over Tor. Where is the padding going to be? Basic clients won't add EDNS padding by default, but intuitively there has to be padding somewhere. It reminds me of https://odns.cs.princeton.edu (I haven't seen a working implementation of that one yet). The most difficult challenge is how to present the ultimate choice - use the relay and maybe get slower Internet, or don't use the relay and maybe get tracked. What hasn't been much explored yet is using resolvers just to obtain the delegation (nobody needs to know who the client is for that), but that itself is not without problems.

throawayeu45556• 7 years ago

I am wondering, does DNS-over-HTTPS really helps since the way I understand it, after the domain name is resolved to an IP address, the client contacts the IP address so the ISP could still know the website visited especially since many if not most websites have dedicated IP addresses. So ISP could simply crawl the web and map domain names to IP addresses.

Is there anything in DoH mitigating this? Or maybe is this attack vector negligible in practice because most servers typically host multiple websites? At least this adds plausible deniability in a wide range of situations I guess. But is it really true? And for example, would it really help in a country where a website like Facebook is censored? (Since their IP addresses are dedicated).

guiambros• 7 years ago

DoH definitely doesn't mitigate against your upstream provider doing traffic inspection and siphoning the IPs your network is connecting to. Ultimately, they have to route your IP packets, so they'll always have that visibility.

But this 1) adds a technical hurdle, 2) reduces accuracy of the data captured, and 3) adds a potential legal barrier, as the data is not theirs anymore

(before ISPs could claim that the use of their DNS gave them right to use the data collected)

zzzcpan5• 7 years ago

Yes, ISPs can know IP addresses and map domains to IP addresses, they can also know exact SNI names, all kinds of passive TCP-level information about your communications, can do active probing for all kinds of information on behalf of you, can use all that together to build a much more detailed profile of you, than available through DNS queries. There is an entire industry of commercial DPI solutions to do that. On top of that ISPs can always block DoH and force fallback to their own DNS servers. So, a minimum amount of privacy can only be achieved with a VPN (or a proxy), not DoH, DoH just leaks to and centralizes data on third parties, violating privacy, making it easier for state actors to spy on people, things like that, it might even give governments capabilities to do world wide censorship if all major browsers implement it. Mozilla, Cloudflare and everyone else involved are being very dishonest when it comes to DoH.

bzbarsky5• 7 years ago

they can also know exact SNI names

This is why ESNI is being rolled out, yes?

mtsr11• 7 years ago

SNI allows hosting multiple SSL Certificates on one IP, but is itself a privacy problem, because https requests have the domain in plain text.

ESNI can solve this, by encrypting the SNI header while still allowing serving multiple https domains on one IP. But it’s currently mainly implemented by cloudflare.

nathanaldensr2• 7 years ago

This is why IP itself is no longer a workable solution--it's point-to-point by nature. Take a look at Named Data Networking for possible approaches to this problem.

krupan2• 7 years ago

This! Just like https encrypting website that anyone can visit is not about privacy, DoH is also not about privacy. Anyone can visit the same https website you visit and see what you are reading. Anyone can resolve the same hostnames that you are resolving (or reverse IPs you are visiting to determine hostnames).

The benefit they do provide is authentication (ensure that google.com is really google.com) and protection against man-in-middle.

And those are great benefits!!

But it doesn't help anyone to misstate and/oversell the benefits of a new service/protocol.

bzbarsky5• 7 years ago

Anyone can resolve the same hostnames that you are resolving

Yes, but your ISP (including "that coffee shop whose wifi you're using" in ISP here) can't necessarily tell which hostnames you are resolving, if you use DoH (subject to some limitations about what happens after you've resolved the hostname). This is in fact a privacy feature

tinus_hn2• 7 years ago

Can you run this service yourself easily?

jamescun• 7 years ago

I'd personally prefer to be greeted with a screen providing me with the option of multiple DNS-over-HTTPS providers, and the option of not using one at all, than being silently forced into handing CloudFlare even more of my data.

josteink10• 7 years ago

How about to save time, we could have this choice only once, and that would apply to every application on the machine. Say it could even be handled by the OS itself!

And to save users even more time, not having to configure this per machine, we could have such assignment be an automatic part of the network infrastructure...

We could call it DHCP and DNS! How about it?

testis321• 7 years ago

And DNSSEC all the way to the user!

TazeTSchnitzel2• 7 years ago

I wonder if this will break TP-Link's tplinklogin.net and tplinkrepeater.net for logging into their routers/repeaters? At least the latter is supposed to be intercepted by the device, and if it isn't, you get a message saying things are misconfigured.

xg156• 7 years ago

Seems to me they should be able to keep this sort of working by resolving tplinklogin.net to 192.168.0.1 or such on their public DNS and ensuring the router always serves the web page from that IP.

Of course things will break down if a router is ever configured to use a different IP - but then again, the public DNS with local IP might trigger Firefox' heuristics and cause it to fall back to traditional DNS - so thinks may still work.

But the whole concept of using an on-device web page as config UI seems to become problematic, thanks to HTTPS-everywhere, as there appears to be no way to serve HTTPS from a local, unsupervised device that is frictionless and does not open a security vulnerability.

xg156• 7 years ago

What I still don't see addressed is the question how this will affect non-browser applications.

It's nice that Firefox (currently) still offers options to turn off DoH and to keep using local domains. (although the way DoH and HTTPS-everywhere are structured show that non-internet sites don't seem to have much of a place in the web of the future)

However, now that we have public DoH endpoints available for everyone to query, what will keep non-browser apps and devices from using DoH without any way to opt-out?

Currently, tracking DNS requests seems to be a common way for security and privacy researchers to get some basic information what an app or device is doing on the internet. If DoH is widely deployed, all you'll probably be seeing is encrypted connections to IPs of shared hosters.

This seems like a perfect opportunity for apps and devices to cloak data tracking and other illegitimate requests.

zamadatix• 7 years ago

The same thing that stopped it before DoH was standardized: nothing.

There are ways to make FW rules based on trusted DNS lookups (i.e. you can only do traditional DNS to a trusted DNS server with domain filtering and you can only connect to an IP if a DNS lookup has been performed) but this is extremely hard to maintain in any sort of foolproof way.

The truth is if you allow outbound connectivity then there all the sender needs to do is add 1 more level of obfuscation than you secure against.

exabrial• 7 years ago

Could we have srv records as the default to alleviate/eliminate the ipv4 crisis?

andrerm2• 7 years ago

Android + Chrome + DoH + AMP = ?

Edit: typo

Avamander• 7 years ago

ISPs, OSs and Routers should effort at providing secure resolving themselves before every app out there thinks it knows better what DNS to use.

darkhorn3• 7 years ago

Big thanks to Mozilla for making internet a more secure place.

badrabbit2• 7 years ago

Why would Mozilla hurt Firefox's market share in such an obvioud and drastic way? Do they not have anyone at their meetings that brings up obvious and uncomfortable risks?

I use DoH on Firefox and love it but man, I myself would block Firefox in a corporate network I help oversee if this is the default. Matter of fact, web proxies already list DoH resolvers as anonymizing sites.

Even if this involves some profit with cloudflare,this is strategically terrible for long term goals.

What’s Next in Making Encrypted DNS-over-HTTPS the Default

Related Stories