Hacker News Reader

Comment by cbg0 | Hacker News Reader

> To be clear: DoH and/or DoT would have stopped the gathering of DNS query data in this case. It's simple to set up, and it's just a smart thing to do for anyone concerned about their privacy.

Actually, for most people that are not technically savvy this is definitely not an easy thing to set up, nor are they even aware that DoH/DoT exist.

Unless this feature starts being turned on by default in routers and popular software, the average user's DNS lookups will not be protected.

View on HN

> Unless this feature starts being turned on by default in routers and popular software

Firefox has DoH turned on by default for US-based users. Unfortunately being US-only, it won't protect Thai users just yet. Especially considering the fact that Thai ISPs have known to be hijacking port 53 and NXDOMAIN since forever[1] with ISP in the article being one of the biggest offender.

It might also worth nothing that PDPA, Thailand's equivalent of GDPR, is to become in effective in two days (May 27th) so this incident will be... interesting.

[1]: Starting in early 2000s, with NIPA (that I never see anybody uses), who aim to provide IDN-enabled Thai domain names by providing NXDOMAIN-hijacking services to ISP

I recently set up a dns-over-https (doh) proxy on my router to forward dns requests to 5 resolvers, that also use dnssec.

I wish Firefox would expose the option from about:config in its user-friendly Preferences page so it will respect the "system default" (the advertised dns server).

I am - for no legitimate reasons - avoiding Cloudflare as a resolver. As far as I know Firefox uses Cloudflare.

Have you been able to find a trustworthy public DoT resolver?

I really want to use uncensoreddns.org, but availability has been a little flaky in the past. I'm not sure about Quad9. Google and CloudFlare are obviously out of the question. What else is there?

> Have you been able to find a trustworthy public DoT resolver?

It really depends what you view as being "trustworthy". Outside of the US good enough? Or do you want non 5/9/14-Eyes? (https://en.wikipedia.org/wiki/UKUSA_Agreement#9_Eyes,_14_Eye...)

Let's start with "not Google-levels of creepy" and work up from there. I want someone who's not harvesting data, or engaging in censorship.

Check out this list in privacytools.io: https://www.privacytools.io/providers/dns/

Yes, well i trust this one:

DoT: dns.digitale-gesellschaft.ch

DoH: dns.digitale-gesellschaft.ch/dns-query

Source:

https://de.wikipedia.org/wiki/DNS_over_HTTPS

https://de.wikipedia.org/wiki/DNS_over_TLS

https://www.digitale-gesellschaft.ch/dns/

Sorry, for not being available in the en-wiki

Hadn't seem them before, very interesting. Vielen dank.

Just a year old and located in Zurich,

OpenNIC has a few servers supporting either DoH or DoT or both.

DoH just moves the logging from Thai telecom and moves it to Cloudflare (or, whoever you set up as your DoH server, but most likely Cloudflare), no?

I trust CF much more than my ISP, but it makes the potential leak much worse...

edit: On the other hand, DoH makes DNS requests independent of ISP, which is nice. ISPs are often monopoly by nature.

Cloudflare has a privacy policy https://developers.cloudflare.com/1.1.1.1/privacy/public-dns...

Obviously, for Thai users this is a reasonable option, but I would understand why American users would not want to use Cloudflare, Google or even Quad9, as these are all US-based.

I thought quad9 was UK based?

Bottom of quad9.net says:

1442 A Walnut Street

Suite 501

Berkeley CA 94709

Aha, figured out I was confused because I read about their membership in the Global Cyber Alliance which includes members such as the London Police and the NYPD.

Bonus if you are interested: forum thread where Quad9's director of the board comments about DNS are surprisingly informational.

https://www.snbforums.com/threads/cloud9-dns.56918/

The netflow data from cloudflare, which is 0.05% of all traffic, is retained for 60 days according do the compliance report. 8.3B log entries is a lot, but I suspect that given how large market share cloudflare has, 0.05% over 60 days is also not a small data set. My intuition with probability calculus make me suspect that given normal internet usage over 60 days, a person is more likely than not to end up in cloudflares netflow log.

> a person is more likely than not to end up in cloudflares netflow log.

They are, but because this is all Cloudflare's 1.1.1.1 service does, that log only tells you that the IP address used Cloudflare's service.

So whereas this Thai data more or less says e.g. You watched Netflix between 18:40 and 19:26 and then again 21:33 to 22:09 the Cloudflare data says you own a device that uses Cloudflare's 1.1.1.1 DNS service. Maybe you can try to do some kind of activity estimate e.g. me idly browsing random web sites probably causes more DNS queries versus a SmartTV just periodically doing auto-updates when I'm asleep, but the 2000:1 dilution would make that more unreliable.

It isn't strictly nothing but it's damn close.

If the attacker also have access to the anonymized data set which is stored for 25hrs they should be able to deanonymize quite a bit of the data by just comparing time stamps and finding patterns.

It is much better than just having normal logs laying around, and since the data is split in two data set, there is a possibility that having access to one does not automatic result in having access to the other. The dilution is also helpful, through I am uncertain to the extent given the amount of traffic generated.

Is a privacy policy worth anything? Genuinely wondering, can they be sued, etc, if they violate it and claim "Oops, we made a mistake and our data got leaked".

For example Facebook probably said they would keep your data secure, but their system to prevent abuse from 3rd party "Quiz" developers was "Developer, by clicking here you agree not to abuse the data you can access."...

Could be interesting to use a list of DoH servers and pick one at random for each DNS query.

dnscrypt-proxy can do that for you, downside slow DNS server means slow DNS responce time

Most malicious ISPs disable DoH (ex: Verizon) so it likely wouldn’t have solved this.

If you want it solved find a protocol that can be used in the libc resolver and make it ubiquitous rather than goofing around with browser defaults.

How do they disable DoH? They block TLS over that port?

Thats DoT, DoH ist just a dns query over https(443)

Alright, I repeat my question, since it's almost identical: how do they block that? HTTPS starts with opening a TLS socket, how do they reliably determine that they can drop that traffic?

I don't know if Verizon is actively doing it, but since most providers that offer DoH have well-known IPs, like 8.8.8.8, 1.1.1.1, 9.9.9.9, they could easily just block traffic heading in that direction.

This follows along with what I read, at first it’s easy to block but it’s a losing proposition because anyone can stand up a doh server (which is also a network security nightmare)

Not sure what has changed security wise. Any one could also stand a DNS resolver. Many people use hosts file or used a local resolver for dev domains for example, security minded folks setup up resolvers on openWRT stack router for example or a use a piHole.

Blocking popular DNS providers is a common tactic deployed by ISPs. It is technically easy enough to bypass depending on your skill level and interest in doing so. Their strategy is make it difficult for majority of their users, who won't know or care, users doing all this will not make substantial impact on revenue generated from selling this data, or from showing adds etc so they don't make the effort.

DoT/DoH is not going to change this, Firefox's market share is not enough for that. I don't see Chrome or Safari implementing this functionality at all.

Okay that’s great for my developers now what happens when they download some malicious script modified their doh queries to use their servers instead of my corporate wins?

I don't think they do that.

Mozilla provides instructions for network operators that want to block it.

How can they disable DoH? That's Dns over HTTPS.

> Most malicious ISPs disable DoH (ex: Verizon) so it likely wouldn’t have solved this.

Is this confirmed? I couldn't find a source for this statement.

Well in Firefox you can turn it on: about:preferences#general >> Network Settings >> Settings...

Where is the setting in Chrome? It's not on by default in the latest version, and not available in the flags/settings...

Reply on news.ycombinator.com