Hacker News Reader

Comment by LeoPanthera | Hacker News Reader

The move of applications such as Firefox to start using DNS-over-https to hardcoded DNS servers will render such user-modified DNS services useless.

Firefox can have this feature disabled, but more malicious applications will simply not give you the choice.

View on HN

It's a tragic move. The DHCP/DNS ecosystem made managing devices dead simple. OTOH I suppose we were foolish to ever think our devices were playing nice. Is there a fix to DNS-over-HTTPS as a network operator? Can you MITM your "own" proprietary devices? What dragons live there?

You can set a canary domain which currently is used

The only other way would be MITM all https traffic and sign with your own certificate, but many iot devices won’t allow you to install a new certificate store.

I don’t know what a canary domain is. That reddit post isn’t entirely clear but it seems to be some kind of DNS black hole. That would rely on the application using your config.

Will a canary domain on an edge device prevent my smart TV from using DoH to get the IP of a tracking server?

https://support.mozilla.org/en-US/kb/canary-domain-use-appli...

If your smart tv checks to see if it should disable DOH then it would work.

I wouldn’t bank on it doing so though. Best to block all iot devices.

Thanks for clarifying. This only helps for well-behaved applications and is apparently temporary.

> The use of this domain is specified by Mozilla, as a limited-time measure until a method for signaling the presence of DNS-based content filtering is defined and adopted by an Internet standards body.

More than anything I am disappointed in Mozilla for shipping such a half-baked anti-feature. I can't even trust Firefox to do the right thing anymore.

It’s a temporary feature until there’s a standard to replace it.

Intimately DoH isn’t needed to make IoT transparent, an IoT device can establish a TLS tunnel to a CDN, and unless that’s blocked you have no way of knowing what is being sent where.

An in-line https proxy is the only solution, if iot devices fail to check certificates (which wouldn’t surprise me)

If they do check, and you can’t provide your our root, then you can’t trust them. Read GNU manifesto and realise why it’s important.

I am conflicted over DoH. As an end user I want to be protected against rogue networks - especially in hotels. As a network admin I want to be protected against rogue end devices.

As both I want to be able to deploy split dns servers due to Nat, not to force users (including me), but to don’t to them where to go.

DoH should have been implemented at the OS level and driven by DHCP unless overridden, as with normal DNS.

I know this is a crazy idea, but maybe we should stop buying locked-down IOT devices?

Sure, I don't really have any right now. In the long run I think that will be impossible. When my TV dies I have to make a lot of compromises to get a dumb display with(out) all the other neat features.

Also, moving DNS to the application instead of the OS just makes managing my well behaved applications harder. It used to be possible to set this automatically through DHCP, now I have to audit every application and make sure it is using my preferred DNS and also manually configure those applications.

DNS-over-HTTPS in Firefox doesn't really benefit me. DNS-over-HTTPS with a DHCP configured server in my OS would be a beneficial option.

Really I would prefer something like DNS over TLS because that solves everything. DNS keeps working, intermediate parties can't read my DNS requests and I can reason about my network traffic, at least on devices I trust.

Why can't you run your own DNS-over-HTTP server, just as you run your own DNS server today? There's no particular reason why the server addresses have to be hardcoded...

I can and for well-behaved applications that's good. But how do I know my IoT device is using my DNS-over-HTTPS server and not a hard-coded one? There's no way to know and the only way to block DNS-over-HTTPS is to also block HTTPS.

It's much harder (or impossible) to block only some of the IoT device traffic (like ads). If I want it to function at all I have to let it spy on me and do other rude things.

My solution is to just not have IoT things but in the long run I think that will become impossible. Consumers seem to have made their choice and everything needs an IP address now.

I don't like how DNS-over-HTTPS smells and I wish there was less momentum behind it. This should be solved by OS vendors, not application developers. DNS doesn't belong at this part of the stack.

I think this is rather orthogonal. A non-well-behaved app can use hardcoded DNS servers as well. And if the author is concerned with your ability to intercept and filter it on protocol level, they can always hack their own equivalent of DNS-over-HTTP with a basic REST service.

OTOH I expect non-malicious code to just use the platform/language/framework-standard mechanism to resolve hostnames, and I expect such mechanisms to provide all the necessary customization points, just as they did for DNS.

Agreed, there are multiple issues here.

The solutions are different but a device like a Pi-hole probably has a part to play in both.

This is a concern of mine as well. I like having some semblance of control of what connections my personally owned devices are making to the outside world. As soon as that becomes opaque, and normalized, who knows what data leaks there will be? Given what advertising companies and malicious app developers already try to get away with when it's visible (to motivated technical folks), the opportunities / possibilities are scary.

I avoid phone banking as it is...

You can disable it on your DNS server using canary domain [1]. Last time I checked it was already implemented in Pi-hole.

1) https://support.mozilla.org/en-US/kb/canary-domain-use-appli...

Agreed-- it's particularly egregious since intranet resources will just fail to resolve entirely in many cases (it has no graceful fallback to system DNS as far as I can tell).

Reply on news.ycombinator.com