News for hackers. Stuff that matters.
Re:A cartoon intro to DNS over HTTPS (2018) by EvanAnderson on Sunday October 20, 2019 @06:40AM (#21303336)
Device manufacturers will absolutely use DoH (with a pinned certificate) as an architecture of control. You won't be able to filter network access for such devices. They'll just fail to work if you attempt to intercept their traffic. DoH is a gift for device manufacturers who want to ensure forced obsolescence, make sure their ads get displayed, etc.

Devices already use pinned certificates, but DoH gives the device manufacturer a convenient and unblockabke way to resolve names against a trusted server. Device manufacturers could be jerks already, but I'd argue that DoH lowers the barrier-to-entry for being a jerk.

Consumers don't, by and large, give a damn about whether they actually own their devices or not. This is yet another reason why those of us who care about ownership and control of our own networks can't have the cool new "toys". We're back to feudalism.

Re:A cartoon intro to DNS over HTTPS (2018) by tptacek on Sunday October 20, 2019 @11:02AM (#21304572)
Device manufacturers don't need DoH to implement an architecture of control. They already have everything they need to do so. They don't even need to use DNS at all.
Re:A cartoon intro to DNS over HTTPS (2018) by EvanAnderson on Sunday October 20, 2019 @01:06PM (#21305421)
I should have said "yet another architecture of control".

Call it the opposite of defense-in-depth. Device manufacturers who aren't thorough might allow a class of "attacks" by way of using DNS. Having ubiquitous DoH takes away that "attack" vector.

I'm not arguing device manufacturers need DoH to be jerks. Having it available just enables the less sophisticated ones to be jerky more easily. DNS-over-TLS does the same thing, it's just marginally less frustrating because it can be blocked at the network layer, at least.

I understand that allowing owners of devices to do what they want on their own networks runs counter to the whole "protect the public from bad network operators" / "protect the public from bad people" narrative. I'm in the minority. It's just damned frustrating. It's sucking all the fun out of computing and networking. It's irrational and self-serving, but dammit it makes me angry.

Re:A cartoon intro to DNS over HTTPS (2018) by tptacek on Sunday October 20, 2019 @01:20PM (#21305514)
This doesn't make any sense. Device vendors don't need encrypted DNS to obfuscate their command-and-control any more than bot developers do. They already have code execution on their platform that has network access. They can use whatever encrypted channel they want. Skype was doing this before DoH had even occurred to anybody. We're supposed to tell home users to keep using plaintext DNS because an incompetent device manufacturer might not be able to come up with a better encrypted C&C than DoH?
Re:A cartoon intro to DNS over HTTPS (2018) by EvanAnderson on Sunday October 20, 2019 @02:03PM (#21305827)
I'm not arguing home users, or anybody, should keep using unencrypted DNS. I'm not arguing anything. I'm just depressed as hell that every solution to "protect the average person" involves making me own my devices even less. You're right, I'm wrong. I'm sorry I engaged. Chalk it up to me being old and angry.
Re:A cartoon intro to DNS over HTTPS (2018) by tptacek on Sunday October 20, 2019 @02:46PM (#21306166)
I don't object to you being angry about devices you don't control on your home network. You should be angry about that. It just doesn't have anything to do with DNS.
Re:A cartoon intro to DNS over HTTPS (2018) by user72628 on Sunday October 20, 2019 @03:28PM (#21306451)
You are right. But we will lose.

You see, one thing is one or two vendors misusing protocols to remove users control from their devices. Another thing is an official protocol that does the same thing. We find have anywhere to run anymore.

As bi dollar corporations and organizations are more and more "protecting" ourselves they need to remove control from ourselves.

Re:A cartoon intro to DNS over HTTPS (2018) by atomi on Sunday October 20, 2019 @08:51AM (#21303803)
Chromecast for example forces it's device to bypass local resolution and use Google's DNS. Bad Google, but that would still be an issue even without DoH. With DoH you just won't be able to port block ":53" which no one really does anyway. If you want device manufacturers to behave you're going to have to do it through regulation.
Re:A cartoon intro to DNS over HTTPS (2018) by xg15 on Sunday October 20, 2019 @09:13AM (#21303900)
> Bad Google, but that would still be an issue even without DoH.

Well, with regular DNS, you can force-route 8.8.8.8 to pi-hole and regain control relatively easily.

That's not possible with DoH due to TLS.

Re:A cartoon intro to DNS over HTTPS (2018) by atomi on Sunday October 20, 2019 @09:25AM (#21303969)
> force-route 8.8.8.8

Yeah static IP routing is an option - for both nameservers and nefarious servers. That is, we may just have to resort to using IP blocks.

Re:A cartoon intro to DNS over HTTPS (2018) by user927272 on Sunday October 20, 2019 @09:02AM (#21303842)
Yes but today one need to build and sell a device to take control of DNS. With DoH any app can do that
Re:A cartoon intro to DNS over HTTPS (2018) by userbinator on Sunday October 20, 2019 @03:16PM (#21306379)
Device manufacturers could be jerks already, but I'd argue that DoH lowers the barrier-to-entry for being a jerk.

And now that it's being marketed heavily, it just gave them another reason to do it that they didn't have before ("Mozilla is doing it too!")