zlacker

[parent] [thread] 12 comments
1. denkmo+(OP)[view] [source] 2023-02-23 23:26:08
This is exactly why DoH is a trojan horse. You can't control it as a network administrator, all it takes is a piece of software to simply remove the controls for users to configure their own DoH and bam, end user has little to no control over how their applications perform name resolution.

Little pro-tip for anyone who tries to run their own private DoH infrastructure too, Firefox doesn't like RFC1918 addresses for the DoH resolver. Set `network.trr.allow-rfc1918=true` if you run DoH on a private IP.

replies(3): >>noizej+X5 >>joseph+oh >>d110af+Ex
2. noizej+X5[view] [source] 2023-02-24 00:00:37
>>denkmo+(OP)
> You can't control it as a network administrator

That’s the design intent. Because not all network administration is benign.

DoH is a tool like any other. Good or bad entirely on why and how it’s used. And your own perspective on that use case.

replies(1): >>JohnFe+e8
◧◩
3. JohnFe+e8[view] [source] [discussion] 2023-02-24 00:14:09
>>noizej+X5
But when the network is mine, and I'm the administrator, anything that prevents me from seeing what's happening is a Bad Thing.

DoH opens me up to security problems that I wouldn't otherwise have, and the extent I have to go to in order to stop it is crazy.

> DoH is a tool like any other. Good or bad entirely on why and how it’s used.

Except that it's a tool I have little control over, and no control over how and why it's used. That's the problem.

DoH is a plague.

replies(1): >>joseph+yh
4. joseph+oh[view] [source] 2023-02-24 01:17:11
>>denkmo+(OP)
> You can't control it as a network administrator

You can't control it as a malicious censor who's trying to control what Web sites other people's computers can access just because they're on your Wi-Fi. You can absolutely control it on computers that are actually yours.

replies(2): >>tsimio+jV >>denkmo+8i4
◧◩◪
5. joseph+yh[view] [source] [discussion] 2023-02-24 01:18:51
>>JohnFe+e8
> But when the network is mine, and I'm the administrator, anything that prevents me from seeing what's happening is a Bad Thing.

That's not true when the just the network itself is yours. It's only true when all of the computers on it are too.

> DoH opens me up to security problems that I wouldn't otherwise have, and the extent I have to go to in order to stop it is crazy.

What? No it doesn't.

> Except that it's a tool I have little control over, and no control over how and why it's used. That's the problem.

You're not supposed to be able to have control over what tools other people use on their own computers.

replies(1): >>JohnFe+NX1
6. d110af+Ex[view] [source] 2023-02-24 03:24:28
>>denkmo+(OP)
> You can't control it as a network administrator

Yes you can. Do what corporate firewalls do. MITM all TLS connections with your own personal CA. Don't allow any traffic streams that you can't MITM to leave your network.

◧◩
7. tsimio+jV[view] [source] [discussion] 2023-02-24 07:18:53
>>joseph+oh
If a malicious app on your system is using DoH, how can you control it? This is what GP was complaining about.

Of course, this is not the fault of DoH providers themselves - at worst, they have just made it easier to perform this.

replies(1): >>joseph+7M1
◧◩◪
8. joseph+7M1[view] [source] [discussion] 2023-02-24 15:01:49
>>tsimio+jV
Because if it's your system, you can remove the malicious app from it.

And it's a good thing that DoH is easy, because it helps protect vulnerable people from censorship and surveillance.

◧◩◪◨
9. JohnFe+NX1[view] [source] [discussion] 2023-02-24 16:01:19
>>joseph+yh
> It's only true when all of the computers on it are too.

I was unclear. This is exactly the case I'm talking about. The network, and all of the devices on the network, are mine.

> What? No it doesn't.

It does. It makes it easier for bad actors -- mostly advertising networks -- to bypass my DNS filtering. They can do it all with their own code, encrypted through HTTPS to hide it, and never touch my DNS systems, nor be affected by browser settings.

> You're not supposed to be able to have control over what tools other people use on their own computers.

Again, I'm talking about having control over my own machines, not anyone else's.

replies(1): >>joseph+N32
◧◩◪◨⬒
10. joseph+N32[view] [source] [discussion] 2023-02-24 16:25:23
>>JohnFe+NX1
> It makes it easier for bad actors -- mostly advertising networks -- to bypass my DNS filtering. They can do it all with their own code, encrypted through HTTPS to hide it, and never touch my DNS systems, nor be affected by browser settings.

If that makes DoH bad, then privacy is bad too since it makes it easier for terrorists and pedophiles to evade the law.

replies(1): >>JohnFe+AL2
◧◩◪◨⬒⬓
11. JohnFe+AL2[view] [source] [discussion] 2023-02-24 19:35:09
>>joseph+N32
On my network, running my machines, these privacy mechanisms really are bad. Having them doesn't give me any privacy (the entire system is my private system to begin with -- who am I being private from?).

The only privacy they are affording is specifically to entities that I don't want operating on my machines to begin with, who are mostly interested in violating my privacy.

So this privacy mechanism, in this use case, really is bad because it reduces my privacy.

◧◩
12. denkmo+8i4[view] [source] [discussion] 2023-02-25 07:51:04
>>joseph+oh
For now. I would point out that the browser with the largest market share by a considerable margin is created and developed by a company that makes most of its money by selling ads, and that choosing your own DNS server with the capability of blocking those ads is a direct threat to that revenue model.

They will tell you it is to defeat censorship though and to improve network resilience, because they are deeply committed to having the image of being a champion of internet freedom.

replies(1): >>joseph+5O4
◧◩◪
13. joseph+5O4[view] [source] [discussion] 2023-02-25 14:08:13
>>denkmo+8i4
They don't need DoH to stop you from being able to block ads at the network level. For a while, a lot of sites have been proxying their ads through their own domains to do that.

And besides, every browser that supports DoH also lets you pick what server to use, and adblocking DoH servers exist.

[go to top]