Improving DNS Privacy with Oblivious DoH in 1.1.1.1

[Ubimo]

Hello
Can we somehow make use of this on our routers?
Source: https://blog.cloudflare.com/oblivious-dns/

 

[bbunge]

Great. The kids will love this as it make it almost impossible to force browsing restrictions.
As for me, I feel that DoH has some security flaws in the way it is implemented. Browser based DoH still requires conventional DNS to get to the secure server and does not use DNSSEC. Better to stay with DOT.

 

[doublehd]

Great. The kids will love this as it make it almost impossible to force browsing restrictions.
As for me, I feel that DoH has some security flaws in the way it is implemented. Browser based DoH still requires conventional DNS to get to the secure server and does not use DNSSEC. Better to stay with DOT.

Exactly,comfy with DoT.

 

[RMerlin]

Just what the world needed: ANOTHER "standard" for DNS queries.

How about the world focus on implementing what already exists instead of coming up with new methods of messing up with networks? Like, encouraging people to implement DNSSEC, which already exists, already resolves a lot of security-related issues, and yet has like less than 1% adoption?

 

[Zastoff]

Seems a lot like Anonymized DNSCrypt but with DoH..
A proxy in between instead of a relay server

 

[heysoundude]

Dan, you're preaching to the choir: pop over to the AsusMerlin forum where a bunch of us have been bypassing google and cloudflare for a while with unbound, which allows our routers to be an rDNS server, consulting the very same Authorittative servers that Google and Cloudflare do, but without the latency of a hop through the dataminers servers. Further, it's able to be configured to do the Auth lookup using DoT, so we're pretty much self contained. I believe unbound runs on openwrt as well, so check with those good people too. If we're savvy enough to do this, we're also savvy enough to run VPN servers that we control on our routers for our devices to tunnel into when away from our LAN so that we can enjoy similar Info- and OpSec as if we were sitting in our home office bastions.

 

[Zastoff]

Hello
Can we somehow make use of this on our routers?
Source: https://blog.cloudflare.com/oblivious-dns/

Looks like Jedisct1(Frank Denis) have started working on a implementation for ODoH (part of at least) for DNSCrypt-proxy.

GitHub - jedisct1/go-hpke-compact: A small and easy to use HPKE implementation in Go.

A small and easy to use HPKE implementation in Go. - jedisct1/go-hpke-compact

github.com

 

[AndreiV]

Schneier on Security

Read the comments and observations then ask yourself just who is this good for ??? All they are doing is cutting out the ISP and probably gaining the data themselves.

 

[Ubimo]

This news is now also discussed in reddit:

https://www.reddit.com/r/technology/comments/k96375

 

[sfx2000]

Like, encouraging people to implement DNSSEC, which already exists, already resolves a lot of security-related issues, and yet has like less than 1% adoption?

yep...

DNS is a bit of a mess right now...

 

[XIII]

Just what the world needed: ANOTHER "standard" for DNS queries.

How about the world focus on implementing what already exists instead of coming up with new methods of messing up with networks? Like, encouraging people to implement DNSSEC, which already exists, already resolves a lot of security-related issues, and yet has like less than 1% adoption?

If I understand it correctly this new protocol requires DNSSEC, so it might encourage people to implement DNSSEC?

 

[RMerlin]

If I understand it correctly this new protocol requires DNSSEC, so it might encourage people to implement DNSSEC?

The thing is, DNSSEC has to be implemented first of all by domain owners. If they haven't done so yet (in large part due to the fact that it's not very straightforward to implement, varies between registrars, and isn't well known/documented either), this new protocol won't change anything.

 

[thecheapseats]

"DNS is a bit of a mess right now"...

THAT^^^ Jon Postel is rolling in his grave - Who could blame him?...

 

[Authority]

Hello
Can we somehow make use of this on our routers?
Source: https://blog.cloudflare.com/oblivious-dns/

Been reading about this - really excited to see the big names behind this!

Hope Merlin implements despite his personal biases.

 

[AndreiV]

Been reading about this - really excited to see the big names behind this!

Hope Merlin implements despite his personal biases.

Why on earth would you wish for something that is inherently INSECURE and will provide you with nothing worthwhile?

You need to read further on some of the security sites.

 

[Authority]

I can see why you might think that, but everything is a compromise. This has the backing to make a difference.

 

[AndreiV]

I can see why you might think that, but everything is a compromise. This has the backing to make a difference.

DOH has major flaws , adding a single proxy won't do anything to help you, they can be compromised. This service possibly stop your ISP from seeing your usage BUT like TOR can be viewed by multiple agencies.

Ask yourself who will now be handling your connection?

If you want privacy use a reliable paid VPN provider.

 

[Authority]

That’s certainly one strategy, but who owns the VPN? Options are a good thing.

 

[Zastoff]

DOH has major flaws , adding a single proxy won't do anything to help you, they can be compromised. This service possibly stop your ISP from seeing your usage BUT like TOR can be viewed by multiple agencies.

Ask yourself who will now be handling your connection?

If you want privacy use a reliable paid VPN provider.

DoH improvements are being worked on i think.

Speeding up HTTPS and HTTP/3 negotiation with... DNS

A look at a new DNS resource record intended to speed-up negotiation of HTTP security and performance features and how it will help make the web faster.

blog.cloudflare.com

Like when there is some competition for dns solutions (Not the part with browsers adding DoH support)
I use Anonymized DNSCrypt, Looks like the ODoH trying something similar, I am interested how this will be when the "flaws" of DoH has been handled.

 

[L&LD]

'Reliable paid VPN provider'. The pink unicorn that little children on the internet dream about.

It doesn't exist, nor does it offer any form of privacy.

But marketing (and the fear they instill for these types of 'products') is strong...