Re:Show HN: dingo - a Google DNS-over-HTTPS caching proxy in Go
by nickodell on Friday September 16, 2016 @07:22PM
(#12518103)
It seems like this includes up to 500 bytes of padding in a request. Is there a reason for that?
Re:Show HN: dingo - a Google DNS-over-HTTPS caching proxy in Go
by pjf on Friday September 16, 2016 @07:27PM
(#12518129)
Yes, the random padding (which is optional) is to counter-measure possible side-channel privacy attacks that could infer the domain name from the packet sizes.
The Google documentation explains that (look for "random_padding") at https://developers.google.com/speed/public-dns/docs/dns-over...
Re:Show HN: dingo - a Google DNS-over-HTTPS caching proxy in Go
by textmode on Friday September 16, 2016 @10:19PM
(#12518773)
"It can even \"spoof\" the TLS SNI string to avoid HTTPS firewalls..."
Are you confirming SNI is being used for censorship?
Re:Show HN: dingo - a Google DNS-over-HTTPS caching proxy in Go
by clinta on Saturday September 17, 2016 @09:10AM
(#12520335)
Plenty of content blockers support blocking domains based on SNI. Here's just a couple of examples from a quick google search.
https://wiki.untangle.com/index.php/Web_Filter#HTTPS_Options
http://www.watchguard.com/help/docs/wsm/xtm_11/en-us/content...
Re:Show HN: dingo - a Google DNS-over-HTTPS caching proxy in Go
by NetStrikeForce on Wednesday September 21, 2016 @08:55AM
(#12547707)
If someone is doing DPI their best bet to know where are you connecting to is to look at the host in SNI, but if you're in a corporate environment with an explicit proxy, your computer would be sending a "CONNECT hostname.tld" in plain text anyway :)
1/ I hope to update the project to use QUIC soon, so it will use encrypted UDP to fetch DNS data from Google Public DNS. It is somehow similar to the DNS over DTLS idea, developed under IETF dprive WG.
2/ dingo does not need to resolve dns.google.com. Providing the server IP address is enough (IPv4 or IPv6, make sure it is close to your location). dingo verifies the server certificate to make sure we talk to Google. It can even "spoof" the TLS SNI string to avoid HTTPS firewalls, too (by default it asks for www.google.com, which is pretty benign).
3/ Last but not least, it's just my first non-trivial Golang project - thanks for all your suggestions! :)