Hacker News Reader

Comment by userbinator | Hacker News Reader

This is essentially a better-managed, centralised equivalent to the long-standing practice of using the HOSTS file to block unwanted sites at the DNS level.

Unfortunately it seems there's now a desire for browsers (and soon, maybe other applications/systems will follow) to make DNS requests inside HTTPS tunnels (DoH), but maybe that'll just encourage more the use of MITM proxies which have almost become a taboo amongst the force of "HTTPS everything" security-authoritarianism. Web security these days may be just as much focused on securing the profits of the advertising and tracking companies as it is against malware and actual user hostilities...

View on HN

Yeah. HTTPS everywhere and DoH have always seemed like part of a 5 year plan to kill ad blocking. Once the ad networks can use HTTPS + DoH + ESNI + CDN we’re screwed. Application level DoH is just nasty.

I also think it’ll encourage consolidation onto the existing major providers because everyone is going to want to be on an unblock-able IP block.

I'm sorry and I know these kinds of posts are sometimes discouraged here on HN but do you have a eli5 for that or possibly some reading I could check out. Why would https everywhere allow advertisers to enhance their targeting?

I see less of a conspiracy there and more a classic tragedy of the commons. If you make it harder for malicious parties to intercept, read and modify your requests, you automatically make it harder for security research and any beneficial purposes as well.

Or simply, past some point, security and usability are enemies. It seems to be impossible in practice to tell whether a thing is being done by a fully-aware user, by a confused user, by user under duress, or by malware impersonating the user - so the standard approach to security is to simply kill off any feature that could even remotely be misused. Which essentially means any and all features that are not under full control of the service provider.

One day soon someone will figure out that the right way to deliver any and all content is through an end-to-end, cryptographically secure server -> HTTPS -> NIC -> HDCP -> screen pipe. And then we'll all have TVs instead of PCs, but at least they'll be secure™.

It's the sum total of all that technology. If you want to filter content there are a few options:

* Look at the actual content if it's HTTP. HTTPS prevents this. * Look at the DNS query to determine the domain. DoH prevents this. * Look at the SNI header to determine the domain. ESNI prevents this. * Look at the IP address to see where the traffic is going. However, this isn't fine grained enough, especially if the traffic is going to a CDN. * MitM with a self-signed CA. This is the hardest option. It's impossible on many devices (because you can't install a root CA) and a huge PITA to install a custom root CA on devices that support it. It's also much more invasive than the other options and makes it possible to accidentally log sensitive information.

Right now a lot of devices ignore your network config and use 8.8.8.8 for DNS. At least with DNS as a separate protocol, you can block external DNS servers and most devices will reluctantly use your local DNS (which can be used to block ads and tracking).

However, once DoH starts getting adopted, those devices (and many apps) will start to use it because you can't block HTTP(S). Literally all a network admin is going to see is a bunch of encrypted connections to CDNs (Cloudflare, Cloudfront, etc.).

IMHO, even though it's sold as privacy tech, it's a huge loss for the average person that can spin up a DNS based ad-blocker right now. It's going to get to the point where you no longer have control over your own network. The huge tech companies and ISPs will control everything.

Can still use cosmetic filtering through uBlock Origin

Surely you can adapt the pi-hole system to run a HTTPS proxy and block the unwanted DoH requests there/respond with invalid garbage?

Browser plugins are just fundamentally better because e2e security is preseeved and they have context information. They can be used with centralised management too.

But the mitm has its place. Hostile iot devices should be sanboxed.

Browser plugins are being increasingly limited; recently Google tried to nerf them to the point ad blocking would become impossible, but after a round of outrage they backed down. For now.

What's worrying is that even if browser extensions retained their power, DoH being used on Electron apps and native apps will nerf any ability to control network requests on those.

browser plugins also don't exist on mobile chrome.

Yes, this is the main reason Firefox is so much better than Chrome on mobile. Anyone know if some of the Chromium derived browsers support extensions on mobile?

Chrome mobile isn't open source. Only the desktop one is opensource (via the 99% identical chromium project)

It turns out that it's the same code base - here's how to build it for Android: https://chromium.googlesource.com/chromium/src/+/master/docs...

And for iOS: https://chromium.googlesource.com/chromium/src/+/master/docs...

This is also why there are Chromium-derived browsers on iOS and Android (eg Brave).

That's awesome. Means someone can add extension support for mobile...

Correct me if I am wrong but I think we still should be able to create a self sign certificate and let Pi access all the traffic so that it can block the unwanted one.

Not if the app and or website use certificate pinning or hsts and you want to use the device on a different network as well, e.g. phones and laptops.

I don't think a website can decide to use public key pinning can it? But the client/browser can. Google won't let you route their traffic through a proxy (chrome does public key pinning for Google).

Websites can but apparently Chrome and Firefox ignore incorrect certs when the presented cert is from a user installed CA [1]. I guess this is to allow firewalls to MITM the traffic.

[1] - https://developer.mozilla.org/en-US/docs/Web/HTTP/Public_Key...

HSTS would need to be disabled in all browsers for all clients to allow for mitm proxy. I’ve seen it done in corporate environments.

So in order to prevent seeing ads we are opening ourselves up to other vulnerabilities. This might be a choice some tech minded people can make but is definitely not something for the masses.

Slight speculation on my part, so if someone wants to correct me, feel free

Wouldn't one be able to install their own certificate (EG: Let's Encrypt) on their devices, and use their own local DNS over HTTPS that way?

Yes, I think it's absolutely about securing profits. I've been downvoted to oblivion before when speaking out against it on HN before, though, so it may already be too late to stop this.

People have a tendency to realize certain things only when it's too late.

Reply on news.ycombinator.com