7 ms·

DoH does wonders against ISPs which filter DNS traffic (including traffic to third-party DNS servers). This happens more often than many people realize. My ISP

DoH does wonders against ISPs which filter DNS traffic (including traffic to third-party DNS servers). This happens more often than many people realize. My ISP blocks traffic to a couple of random websites (perfectly safe and legal) just because their security system doesn't like them, and they can't do anything about that. I only wish for more websites to deploy ECH, because they are using SNI filtering as well.

jsiepkes 1y ago
Same goes for if you have an IoT device behind a corporate firewall and you are being forced to use a enterprise DNS server running on some Cisco or Juniper device which doesn't respect TTL's, filters TXT records, etc.
- unethical_ban 1y ago
  A decent corporate policy will block or decrypt DoH, same as it blocks direct outbound DNS.
  - josephcsible 1y ago
    The hope is we eventually get enough things like DoH and ECH that it stops being feasible for corporate policies to block things.
    - unethical_ban 1y ago
      Ah, are you a data exfiltrator or a ransomware operator? I jest. I think the network as a chokepoint will slowly go away due to improvements in cryptography, and we'll need the endpoint to do all the inspection and enforcement.
      - josephcsible 1y ago
        > I think the network as a chokepoint will slowly go away due to improvements in cryptography, and we'll need the endpoint to do all the inspection and enforcement. That's exactly what I want, because any solution other than that one would allow network operators to snoop on other people's endpoints.
        unethical_ban 1y ago
        Network operators that the endpoints trust. If your OS doesn't trust a MitM box, it yells.
  - jsiepkes 1y ago
    > A decent corporate policy will block or decrypt DoH, same as it blocks direct outbound DNS. DoH is simply HTTPS traffic as far as a firewall is concerned so how are you going to block or decrypt it? If you take it a step further and you are running a DoH server on the same place where the API endpoints (REST, gRPC or whatever) for your IoT device are running no one is going to see the anything but HTTPS traffic
    - unethical_ban 1y ago
      HTTPS decryption in corporate environments is standard. Have a corporate root CA, install certs on endpoints, and man-in-the-middle the network traffic.
atahanacar 1y ago
>they are using SNI filtering as well This is surprisingly easy to beat using very funny methods, like splitting the request in the middle of SNI, or sending a request with a low TTL to an unblocked website first which gets dropped then repeating it to the correct SNI. There are more methods all of which I find very funny for some reason. You can use GoodbyeDPI on Windows and zapret on Linux.
- dabacaba 1y ago
  The disadvantage of those methods is that they require installing custom software, and they don't work on mobile devices unless you put them behind a router with custom firmware. In contrast, DoH works out of the box on most operating systems, and hopefully ECH will work as well.
bornfreddy 1y ago
I guess it depends on the situation then. My ISP doesn't pull such stunts and if they did, I would switch them in a moment. Fortunately others around here don't suck either. Cloudflare (or Google, or whoever) OTOH gets waaaay too much data from everybody. For my taste at least.
- josephcsible 1y ago
  I'm glad your ISP doesn't do that, but there are a lot of people not as lucky as you, and we shouldn't deny them all a major increase in privacy just to avoid having you to change one browser setting.
  - michaelt 1y ago
    To me, that seems awfully trusting of Cloudflare. Instead of sending all my DNS traffic to sketchy multinational corporation A, we'll send all my traffic to sketchy multinational corporation B? Doesn't seem like much of an increase in privacy to me.
    - josephcsible 1y ago
      If you're using insecure DNS, then you have no choice but to let your ISP see all your queries. But if you're using DoH, you can choose from plenty (see https://github.com/curl/curl/wiki/DNS-over-HTTPS https://github.com/curl/curl/wiki/DNS-over-HTTPS) of other DoH providers instead if you don't trust Cloudflare.
    - zinekeller 1y ago
      Frankly, the article is doing a lot of disservice (and should be removed in HN because of its grossly outdated information). As josephcsible pointed out, there are many, many options for DoH.
    - LtWorf 1y ago
      I change it to mullivad of course.
  - 1y ago

jsiepkes 1y ago

Same goes for if you have an IoT device behind a corporate firewall and you are being forced to use a enterprise DNS server running on some Cisco or Juniper device which doesn't respect TTL's, filters TXT records, etc.

unethical_ban 1y ago
A decent corporate policy will block or decrypt DoH, same as it blocks direct outbound DNS.
- josephcsible 1y ago
  The hope is we eventually get enough things like DoH and ECH that it stops being feasible for corporate policies to block things.
  - unethical_ban 1y ago
    Ah, are you a data exfiltrator or a ransomware operator? I jest. I think the network as a chokepoint will slowly go away due to improvements in cryptography, and we'll need the endpoint to do all the inspection and enforcement.
    - josephcsible 1y ago
      > I think the network as a chokepoint will slowly go away due to improvements in cryptography, and we'll need the endpoint to do all the inspection and enforcement. That's exactly what I want, because any solution other than that one would allow network operators to snoop on other people's endpoints.
      - unethical_ban 1y ago
        Network operators that the endpoints trust. If your OS doesn't trust a MitM box, it yells.
- jsiepkes 1y ago
  > A decent corporate policy will block or decrypt DoH, same as it blocks direct outbound DNS. DoH is simply HTTPS traffic as far as a firewall is concerned so how are you going to block or decrypt it? If you take it a step further and you are running a DoH server on the same place where the API endpoints (REST, gRPC or whatever) for your IoT device are running no one is going to see the anything but HTTPS traffic
  - unethical_ban 1y ago
    HTTPS decryption in corporate environments is standard. Have a corporate root CA, install certs on endpoints, and man-in-the-middle the network traffic.

atahanacar 1y ago

>they are using SNI filtering as well This is surprisingly easy to beat using very funny methods, like splitting the request in the middle of SNI, or sending a request with a low TTL to an unblocked website first which gets dropped then repeating it to the correct SNI. There are more methods all of which I find very funny for some reason. You can use GoodbyeDPI on Windows and zapret on Linux.

dabacaba 1y ago
The disadvantage of those methods is that they require installing custom software, and they don't work on mobile devices unless you put them behind a router with custom firmware. In contrast, DoH works out of the box on most operating systems, and hopefully ECH will work as well.

bornfreddy 1y ago

I guess it depends on the situation then. My ISP doesn't pull such stunts and if they did, I would switch them in a moment. Fortunately others around here don't suck either. Cloudflare (or Google, or whoever) OTOH gets waaaay too much data from everybody. For my taste at least.

josephcsible 1y ago
I'm glad your ISP doesn't do that, but there are a lot of people not as lucky as you, and we shouldn't deny them all a major increase in privacy just to avoid having you to change one browser setting.
- michaelt 1y ago
  To me, that seems awfully trusting of Cloudflare. Instead of sending all my DNS traffic to sketchy multinational corporation A, we'll send all my traffic to sketchy multinational corporation B? Doesn't seem like much of an increase in privacy to me.
  - josephcsible 1y ago
    If you're using insecure DNS, then you have no choice but to let your ISP see all your queries. But if you're using DoH, you can choose from plenty (see https://github.com/curl/curl/wiki/DNS-over-HTTPS https://github.com/curl/curl/wiki/DNS-over-HTTPS) of other DoH providers instead if you don't trust Cloudflare.
  - zinekeller 1y ago
    Frankly, the article is doing a lot of disservice (and should be removed in HN because of its grossly outdated information). As josephcsible pointed out, there are many, many options for DoH.
  - LtWorf 1y ago
    I change it to mullivad of course.
- 1y ago