7 ms·

Analyzing DNS-over-HTTPS and DNS-over-TLS Privacy and Security Claims

50 points by shreyasonline 7y ago

Ayesh 7y ago
I like Chrome's approach to DoH. If the local DNS server is capable of DoH, then, and only then, Chrome switches to DoH. It is the safest choice to make, since if you are querying that name server, they have your data anyway, so you might as well encrypt it in transit.
- the8472 7y ago
  How would chrome know whether getaddrinfo() uses DoH to resolve a host?
  - icebraining 7y ago
    Anyone can link to their own getaddrinfo(), including an internal function, they don't have to use one from whichever libc happens to be laying around on the system. In theirs, they read the DNS servers from the OS (like the original), and then if it's part of a list of known DoH providers, they try to connect over DoH before falling back to regular DNS queries.
    - mlyle 7y ago
      First, I know nothing about DoH, so take this with a grain of salt. They should look up a canary domain that doesn't resolve from the roots, but local sites can configure to provide the address of a DoH resolver. Then you don't need to have a list of known DoH providers-- any site can install a DoH resolver and then add the canary domain to allow clients to upgrade. It'd still be vulnerable to MITM attacks on initial connect, but at least the window for them is closed after the first resolution with this approach (better than normal DNS).
    - judge2020 7y ago
      For reference, the code that does the protocol upgrade: https://github.com/chromium/chromium/blob/711b1ba2735f8af4bd6359c6292e1875412df74f/net/dns/dns_util.cc#L146-L217 https://github.com/chromium/chromium/blob/711b1ba2735f8af4bd...
    - the8472 7y ago
      That would mean bypassing OS configuration, including other naming sources then DNS.
      - icebraining 7y ago
        Yes, and if you search for "Chrome DNS client", people have reported problems related to that.
- techslave 7y ago
  i am very avidly opposes to DoH because it doesn’t solve the problem people think it does. and it further entrenches cloudflare, who imho are vile but that aside the concentration isn’t a good thing. however, your statement is wrong. i won’t go further into detail because my comments on this subject universally attract all the downvotes so there’s no point. but in general the problem is you need to qualify “safest”. safest for what and for whom, and in what scenarios? you’ve left too much unsaid, so what you say is not generally true.
  - icebraining 7y ago
    This comment says very little; you don't explain what problem people think DoH solves, won't go into detail on why the statement is wrong, nor why not qualifying "safest" makes it not generally true. At least a comment that attracts downvotes may be useful to someone.
- fanf2 7y ago
  Chrome has a short list of known DoH servers that it will use, and they are all public cloud DNS providers so it will not use your local DoH server. https://www.chromium.org/developers/dns-over-https https://www.chromium.org/developers/dns-over-https
Santosh83 7y ago
The claim that DoH will interfere with internal DNS of enterprises can be solved with a local deployment of a recursive DoH server right? That also addresses the concern of centralisation. Imagine every ISP offering a DoH sever... so now Cloudflare will not be in a position to scoop up the entire DNS data of the Internet. I'm still waiting to see a genuinely technical disadvantage of DoH. All that I've read so far are social and implementation related issues that can be ironed out over time.
- vetinari 7y ago
  The thing that is still being ignored is the configuration mechanism for the DoH resolver. Currently, the only way to configure it is manual and application-specific; there's no way to configure it for all apps and automatically, like DHCP for the normal, 53/udp DNS. Nobody is going to manually reconfigure their DNS every time they switch network (e.g. home -> office -> customer).
  - chupasaurus 7y ago
    Currently, the only way to configure DoH for everything is one-time setting local dnscrypt-proxy as the only resolver. Easy on Android 9+ and Linux with systemd, on Windows you have to override DNS settings for all NICs because it has a weird process of resolving. Don't know about macOS, iOS is definitely out. edit P.S: I'd never trust ISP's DNS servers, because it's the easiest way to track what customers does.
    - fragmede 7y ago
      I may trust Comcast as far as I can throw them. I still prefer that they get my data, rather than even more of my browsing data go straight to Google.
      - tptacek 7y ago
        The point of DoH is that you don't have to send your DNS queries to either of those entities.
asveikau 7y ago
I do sometimes use firefox and I found the canary hostname, linked in the article, to be a good tip: https://support.mozilla.org/en-US/kb/canary-domain-use-application-dnsnet https://support.mozilla.org/en-US/kb/canary-domain-use-appli... My home network has a DNS server that already talks to the outside DNS servers with TLS, so having browsers reach out to cloudflare would prevent cross-device caching and only protect against snooping on my LAN or wifi, which I don't find to be very necessary. So I just made this domain return NXDOMAIN.
bjoli 7y ago
Can anyone explain why DoH was invented? To me it seems like another one of the "let's solve this using web technologies!" Whereas DoT has a great ietf process behind it.
- cstejerean 7y ago
  My guess is that networks can block the DoT ports to force fallback to plaintext DNS. Whereas DoH looks indistinguishable to HTTPS traffic so it’s harder to block.
- tptacek 7y ago
  Two primary use cases were considered during this protocol's development. These use cases are preventing on-path devices from interfering with DNS operations, and also allowing web applications to access DNS information via existing browser APIs in a safe way consistent with Cross Origin Resource Sharing (CORS). Virtually all the opposition to DoH is rooted in two complaints: 1. It centralizes DNS at Cloudflare (obviously, you can point DoH elsewhere). 2. It's hard for network operators to block it (which is the point).
  - kchamplewski 7y ago
    The biggest complaint I have regarding DoH is that it's extremely painful to configure because every application does it individually. If I could configure DoH at the system level, as I do normal DNS, I'd be perfectly happy. As it stands, DoH could trivially be co-opted by browser vendors to ignore system DNS settings, and even if it isn't, it still makes DNS configuration a worse experience.
    - tptacek 7y ago
      This seems a lot more like a complaint about your libc than about DoH. But the response to that complaint would likely be "give it time".
    - judge2020 7y ago
      You can do this on Android Pie and newer, but the overall rollout on other systems might be held up due to the potential issues with enterprises not being happy that their DNS systems are no longer working (and that this is probably far from having priority P0).
seanhunter 7y ago
For people concerned with Firefox's use of cloudflare, it's very easy to configure an alternative DoH if you have one you prefer. You can do so via network prefs or about:config (the key is "network.trr.resolvers")
shawnz 7y ago
> DNS is one important control planes in a network. It essentially allows network administrators to block content based on domain names making it quite useful tool in the arsenal. It is being widely used to provide content filtering services, parental controls, and to block known malware command and control. Its so popular that a lot of people install a locally running DNS server on their home networks to block Internet Ads using block lists. This is a totally wrong usage of DNS and I wish we would focus more effort into making IP-based blocking easy and accessible rather than wasting time trying to make DNS fit this niche. DNS is not the right tool for this job and maintaining this functionality is not a valid reason to block progress on more private technologies like DoH. And it's totally possible to run a PiHole-style system using DoH anyway.
- jdsnape 7y ago
  I'm not convinced IP-based blocking can be more effective than DNS blocking. Very often many different sites are hosted on one IP address (e.g. a CDN in the 'worst' case), and IP blocking would mean lots of things become inaccessible. Users access services by DNS name, so if you want to control access it has to be at that level. Whether DNS can be effectively blocked while maintaining privacy is another issue, but I can't see IP-based blocking helping here.
  - judge2020 7y ago
    I agree, CF allows porn and blocking every Cloudflare site isn't a viable course of action for most people. Governments like UK that mandate restricting access shouldn't be doing it for you by DPI'ing DNS. Instead, any blocking needs to be done on the device, whether it be MDM for any business-related blocking or via Parental Controls/Restrictions for blocking porn.
  - comex 7y ago
    In my opinion, both DNS- and IP-based blocking are a hack because they fundamentally have to work based on limited information. After all, ad services could pretty easily start doing any of the following: - proxying ad requests through the server of the website you're visiting; - accessing ads by IP address directly; or - using randomly generated domain names. With a browser-based ad blocker, those measures would still be an obstacle, but at least you'd have a chance - you could switch to more heuristic ways of detecting ads based on, say, the scripts involved, or the content of the media being downloaded, or its size and placement on the page. None of that information is available to network-based blockers, at least not when HTTPS is in use. Admittedly, those things probably won't happen anytime soon, at least not for regular website ads. (Though as one example, Twitch has already started using fairly sophisticated measures to bypass ad blockers for their video ads...) But I'm an idealist, and I like to fight on favorable territory. When it comes to cat and mouse games, I don't want to be the mouse.
jchw 7y ago
Part of Paul Vixie’s argument is that DNS is part of the control plane, and that DoH will bypass security policy. Let’s at least address this with some skepticism. 1. Is security policy via DNS really a good way to go? There are other, imo more effective, ways of handling this. If your security policy can be defeated by using a DoH resolver, it’s evidently not very hard to bypass. 2. While this can be true, it’s not actually anything to do with the way DoH works. You could just as easily choose to only upgrade to DoH when the DNS provider of your choosing happens to support it. 3. Home internet is not new or uncommon. 76% of the US has internet access according to a cursory Google search. A vast, vast majority of these users are casual users. The control plane is not under their control necessarily. The control plane is not something that can just absolutely be trusted. With much respect, I simply must disagree. The notion that DoH is dangerous feels like it comes from a dated view of internet security, and it only reflects the mode of rollout where application software indiscriminately uses a DoH server in place of the user’s default DNS server. Further, this article has a lot of interesting claims. It claims that many websites are still not running over TLS even though it’s free. Of course, this is undoubtedly true and reflected in statistics. However, is it true in a realistic sense? How many non-HTTPS pages do you browse? Thanks to Cloudflare and other actors, I suspect ESNI will have no trouble gaining meaningful marketshare. Not full proliferation. We don’t need full proliferation for it to be useful, though.
- tptacek 7y ago
  In reality what's happening is a conflict between the security goals of network operators and those of end-users. Vixie, who runs a company that provides security services based on passively observing DNS, believes DoH sacrifices the security of networks in favor of end-users, and he's right. But: 1. In most situations, the end-users are the ones that matter; the cart shouldn't drag the horse. 2. In situations where that doesn't hold, serious security teams already exert direct control (via MDM and endpoint security) over end-systems anyways; why should anybody give anything up to make things easier for enterprises who are just a bit concerned about security, but not enough to take responsibility for endpoint security?
  - jchw 7y ago
cbsmith 7y ago
I haven't though much about this problem, but I'm curious why none of the solutions employ DTLS. Is UDP just pointless in this context?
alibert 7y ago
My fear is that platforms start using DoH, bypassing local dns privacy resolver such as pihole, for tracking purpose. I have a nVidia Shield and I can see how many requests to tracking domains it does and if nVidia or Google uses DoH, I will not be able to block those requests.
collsni 7y ago
DOH has the possibility to leverage the wrong parties against encryption. There needs to be a barrier of control.

50 points by shreyasonline 7y ago

I like Chrome's approach to DoH. If the local DNS server is capable of DoH, then, and only then, Chrome switches to DoH. It is the safest choice to make, since if you are querying that name server, they have your data anyway, so you might as well encrypt it in transit.

the8472 7y ago
How would chrome know whether getaddrinfo() uses DoH to resolve a host?
- icebraining 7y ago
  Anyone can link to their own getaddrinfo(), including an internal function, they don't have to use one from whichever libc happens to be laying around on the system. In theirs, they read the DNS servers from the OS (like the original), and then if it's part of a list of known DoH providers, they try to connect over DoH before falling back to regular DNS queries.
  - mlyle 7y ago
    First, I know nothing about DoH, so take this with a grain of salt. They should look up a canary domain that doesn't resolve from the roots, but local sites can configure to provide the address of a DoH resolver. Then you don't need to have a list of known DoH providers-- any site can install a DoH resolver and then add the canary domain to allow clients to upgrade. It'd still be vulnerable to MITM attacks on initial connect, but at least the window for them is closed after the first resolution with this approach (better than normal DNS).
  - judge2020 7y ago
    For reference, the code that does the protocol upgrade: https://github.com/chromium/chromium/blob/711b1ba2735f8af4bd6359c6292e1875412df74f/net/dns/dns_util.cc#L146-L217 https://github.com/chromium/chromium/blob/711b1ba2735f8af4bd...
  - the8472 7y ago
    That would mean bypassing OS configuration, including other naming sources then DNS.
    - icebraining 7y ago
      Yes, and if you search for "Chrome DNS client", people have reported problems related to that.
techslave 7y ago
i am very avidly opposes to DoH because it doesn’t solve the problem people think it does. and it further entrenches cloudflare, who imho are vile but that aside the concentration isn’t a good thing. however, your statement is wrong. i won’t go further into detail because my comments on this subject universally attract all the downvotes so there’s no point. but in general the problem is you need to qualify “safest”. safest for what and for whom, and in what scenarios? you’ve left too much unsaid, so what you say is not generally true.
- icebraining 7y ago
  This comment says very little; you don't explain what problem people think DoH solves, won't go into detail on why the statement is wrong, nor why not qualifying "safest" makes it not generally true. At least a comment that attracts downvotes may be useful to someone.
fanf2 7y ago
Chrome has a short list of known DoH servers that it will use, and they are all public cloud DNS providers so it will not use your local DoH server. https://www.chromium.org/developers/dns-over-https https://www.chromium.org/developers/dns-over-https

Santosh83 7y ago

The claim that DoH will interfere with internal DNS of enterprises can be solved with a local deployment of a recursive DoH server right? That also addresses the concern of centralisation. Imagine every ISP offering a DoH sever... so now Cloudflare will not be in a position to scoop up the entire DNS data of the Internet. I'm still waiting to see a genuinely technical disadvantage of DoH. All that I've read so far are social and implementation related issues that can be ironed out over time.

vetinari 7y ago
The thing that is still being ignored is the configuration mechanism for the DoH resolver. Currently, the only way to configure it is manual and application-specific; there's no way to configure it for all apps and automatically, like DHCP for the normal, 53/udp DNS. Nobody is going to manually reconfigure their DNS every time they switch network (e.g. home -> office -> customer).
- chupasaurus 7y ago
  Currently, the only way to configure DoH for everything is one-time setting local dnscrypt-proxy as the only resolver. Easy on Android 9+ and Linux with systemd, on Windows you have to override DNS settings for all NICs because it has a weird process of resolving. Don't know about macOS, iOS is definitely out. edit P.S: I'd never trust ISP's DNS servers, because it's the easiest way to track what customers does.
  - fragmede 7y ago
    I may trust Comcast as far as I can throw them. I still prefer that they get my data, rather than even more of my browsing data go straight to Google.
    - tptacek 7y ago
      The point of DoH is that you don't have to send your DNS queries to either of those entities.

asveikau 7y ago

I do sometimes use firefox and I found the canary hostname, linked in the article, to be a good tip: https://support.mozilla.org/en-US/kb/canary-domain-use-application-dnsnet https://support.mozilla.org/en-US/kb/canary-domain-use-appli... My home network has a DNS server that already talks to the outside DNS servers with TLS, so having browsers reach out to cloudflare would prevent cross-device caching and only protect against snooping on my LAN or wifi, which I don't find to be very necessary. So I just made this domain return NXDOMAIN.

bjoli 7y ago

Can anyone explain why DoH was invented? To me it seems like another one of the "let's solve this using web technologies!" Whereas DoT has a great ietf process behind it.

cstejerean 7y ago
My guess is that networks can block the DoT ports to force fallback to plaintext DNS. Whereas DoH looks indistinguishable to HTTPS traffic so it’s harder to block.
tptacek 7y ago
Two primary use cases were considered during this protocol's development. These use cases are preventing on-path devices from interfering with DNS operations, and also allowing web applications to access DNS information via existing browser APIs in a safe way consistent with Cross Origin Resource Sharing (CORS). Virtually all the opposition to DoH is rooted in two complaints: 1. It centralizes DNS at Cloudflare (obviously, you can point DoH elsewhere). 2. It's hard for network operators to block it (which is the point).
- kchamplewski 7y ago
  The biggest complaint I have regarding DoH is that it's extremely painful to configure because every application does it individually. If I could configure DoH at the system level, as I do normal DNS, I'd be perfectly happy. As it stands, DoH could trivially be co-opted by browser vendors to ignore system DNS settings, and even if it isn't, it still makes DNS configuration a worse experience.
  - tptacek 7y ago
    This seems a lot more like a complaint about your libc than about DoH. But the response to that complaint would likely be "give it time".
  - judge2020 7y ago
    You can do this on Android Pie and newer, but the overall rollout on other systems might be held up due to the potential issues with enterprises not being happy that their DNS systems are no longer working (and that this is probably far from having priority P0).

seanhunter 7y ago

For people concerned with Firefox's use of cloudflare, it's very easy to configure an alternative DoH if you have one you prefer. You can do so via network prefs or about:config (the key is "network.trr.resolvers")

shawnz 7y ago

> DNS is one important control planes in a network. It essentially allows network administrators to block content based on domain names making it quite useful tool in the arsenal. It is being widely used to provide content filtering services, parental controls, and to block known malware command and control. Its so popular that a lot of people install a locally running DNS server on their home networks to block Internet Ads using block lists. This is a totally wrong usage of DNS and I wish we would focus more effort into making IP-based blocking easy and accessible rather than wasting time trying to make DNS fit this niche. DNS is not the right tool for this job and maintaining this functionality is not a valid reason to block progress on more private technologies like DoH. And it's totally possible to run a PiHole-style system using DoH anyway.

jdsnape 7y ago
I'm not convinced IP-based blocking can be more effective than DNS blocking. Very often many different sites are hosted on one IP address (e.g. a CDN in the 'worst' case), and IP blocking would mean lots of things become inaccessible. Users access services by DNS name, so if you want to control access it has to be at that level. Whether DNS can be effectively blocked while maintaining privacy is another issue, but I can't see IP-based blocking helping here.
- judge2020 7y ago
  I agree, CF allows porn and blocking every Cloudflare site isn't a viable course of action for most people. Governments like UK that mandate restricting access shouldn't be doing it for you by DPI'ing DNS. Instead, any blocking needs to be done on the device, whether it be MDM for any business-related blocking or via Parental Controls/Restrictions for blocking porn.
- comex 7y ago
  In my opinion, both DNS- and IP-based blocking are a hack because they fundamentally have to work based on limited information. After all, ad services could pretty easily start doing any of the following: - proxying ad requests through the server of the website you're visiting; - accessing ads by IP address directly; or - using randomly generated domain names. With a browser-based ad blocker, those measures would still be an obstacle, but at least you'd have a chance - you could switch to more heuristic ways of detecting ads based on, say, the scripts involved, or the content of the media being downloaded, or its size and placement on the page. None of that information is available to network-based blockers, at least not when HTTPS is in use. Admittedly, those things probably won't happen anytime soon, at least not for regular website ads. (Though as one example, Twitch has already started using fairly sophisticated measures to bypass ad blockers for their video ads...) But I'm an idealist, and I like to fight on favorable territory. When it comes to cat and mouse games, I don't want to be the mouse.

jchw 7y ago

Part of Paul Vixie’s argument is that DNS is part of the control plane, and that DoH will bypass security policy. Let’s at least address this with some skepticism. 1. Is security policy via DNS really a good way to go? There are other, imo more effective, ways of handling this. If your security policy can be defeated by using a DoH resolver, it’s evidently not very hard to bypass. 2. While this can be true, it’s not actually anything to do with the way DoH works. You could just as easily choose to only upgrade to DoH when the DNS provider of your choosing happens to support it. 3. Home internet is not new or uncommon. 76% of the US has internet access according to a cursory Google search. A vast, vast majority of these users are casual users. The control plane is not under their control necessarily. The control plane is not something that can just absolutely be trusted. With much respect, I simply must disagree. The notion that DoH is dangerous feels like it comes from a dated view of internet security, and it only reflects the mode of rollout where application software indiscriminately uses a DoH server in place of the user’s default DNS server. Further, this article has a lot of interesting claims. It claims that many websites are still not running over TLS even though it’s free. Of course, this is undoubtedly true and reflected in statistics. However, is it true in a realistic sense? How many non-HTTPS pages do you browse? Thanks to Cloudflare and other actors, I suspect ESNI will have no trouble gaining meaningful marketshare. Not full proliferation. We don’t need full proliferation for it to be useful, though.

tptacek 7y ago
In reality what's happening is a conflict between the security goals of network operators and those of end-users. Vixie, who runs a company that provides security services based on passively observing DNS, believes DoH sacrifices the security of networks in favor of end-users, and he's right. But: 1. In most situations, the end-users are the ones that matter; the cart shouldn't drag the horse. 2. In situations where that doesn't hold, serious security teams already exert direct control (via MDM and endpoint security) over end-systems anyways; why should anybody give anything up to make things easier for enterprises who are just a bit concerned about security, but not enough to take responsibility for endpoint security?
- jchw 7y ago

cbsmith 7y ago

I haven't though much about this problem, but I'm curious why none of the solutions employ DTLS. Is UDP just pointless in this context?

alibert 7y ago

My fear is that platforms start using DoH, bypassing local dns privacy resolver such as pihole, for tracking purpose. I have a nVidia Shield and I can see how many requests to tracking domains it does and if nVidia or Google uses DoH, I will not be able to block those requests.

collsni 7y ago

DOH has the possibility to leverage the wrong parties against encryption. There needs to be a barrier of control.