Hacker News Reader

Comment by Santosh83 | Hacker News Reader

The claim that DoH will interfere with internal DNS of enterprises can be solved with a local deployment of a recursive DoH server right? That also addresses the concern of centralisation. Imagine every ISP offering a DoH sever... so now Cloudflare will not be in a position to scoop up the entire DNS data of the Internet.

I'm still waiting to see a genuinely technical disadvantage of DoH. All that I've read so far are social and implementation related issues that can be ironed out over time.

View on HN

The thing that is still being ignored is the configuration mechanism for the DoH resolver.

Currently, the only way to configure it is manual and application-specific; there's no way to configure it for all apps and automatically, like DHCP for the normal, 53/udp DNS. Nobody is going to manually reconfigure their DNS every time they switch network (e.g. home -> office -> customer).

Currently, the only way to configure DoH for everything is one-time setting local dnscrypt-proxy as the only resolver. Easy on Android 9+ and Linux with systemd, on Windows you have to override DNS settings for all NICs because it has a weird process of resolving. Don't know about macOS, iOS is definitely out.

edit P.S: I'd never trust ISP's DNS servers, because it's the easiest way to track what customers does.

For iOS, you can check out DNSCloak, Adguard, NextDNS, Cloudflare 1.1.1.1, etc. which are all system wide resolver.

I may trust Comcast as far as I can throw them. I still prefer that they get my data, rather than even more of my browsing data go straight to Google.

The point of DoH is that you don't have to send your DNS queries to either of those entities.

Is DHCP useful to enforce network policy? What about users who manually set their DNS servers?

Wouldn't be a proxy checking the SNI of connections you open better?

Enforcement is step 2. Proxy with a blacklist of hostnames would do, but unfortunately, with encrypted SNIs on the horizon, full blown https proxy with custom CA enrolled on all machines would be necessary.

Step 1 is a mechanism for those, who do not want to fight the network policy, just want the autoconfiguration.

Why DoH and not DoT? DoT be much more suitable and provides same set of guarantees since both are essentially using TLS. DoH provides only one extra thing that is to make it difficult to block. If you run DoT over port 443 then it essentially becomes same as DoH in terms of difficult to block.

> to see a genuinely technical disadvantage of DoH

Lack of privacy issue aside, there are a bunch of technical disadvantages compared to alternatives. Like using encryption to a local resolver or to a resolver over trusted or encrypted network is unnecessary overhead and complexity, including operational complexity that you really want to avoid. And if there is a case to use encrypted communications with a recursive resolver (i.e. non local), it could be done by simply tunneling DNS protocol over any of existing crypto protocols, no need for yet another complex protocol tunneled over https that still has to be converted to a native DNS protocol down the line.

I’d prefer not to “trust” any network, even my local home network, and encrypt all the traffic traveling over it I can. especially in an age where a security camera or even your fridge can be compromised by non-targeted automated scripts and then all plaintext traffic on your network is exposed.

As for not using TLS/http to wrap the dns queries for secure transport across the net, what “existing crypto protocol” do you suggest they should have implemented instead?

Reply on news.ycombinator.com