Stories
Slash Boxes
Comments

SoylentNews is people

SoylentNews is powered by your submissions, so send in your scoop. Only 11 submissions in the queue.

Dutch Govt Explains the Risks Behind DNS-Over-HTTPS Move

posted by Fnord666 on Saturday October 05 2019, @07:11PM   Printer-friendly
from the can't-see-where-you're-going dept.

upstart writes:

Submitted via IRC for chromas

Dutch Govt Explains the Risks Behind DNS-Over-HTTPS Move

The Dutch National Cyber Security Centre (NCSC) explains how DNS-monitoring will get more difficult as modern encrypted DNS transport protocols are getting more popular in a fact sheet published this week.

The fact sheet's audience is represented by system or network admins and security officers who want to move to DNS over TLS (DoT) and DNS over HTTPS (DoH) DNS encryptions protocols that offer increased security and confidentiality.

Both DoH and DoT are designed to allow DNS resolution over encrypted HTTPS connections instead of using the currently common plain text DNS lookups.

Google and Mozilla are both running DoH trials for their browsers, with Chrome to upgrade to a provider's DoH server if it present on a pre-defined whitelist or to a shortlist of fallback providers (i.e., Cleanbrowsing, Cloudflare, DNS.SB, Google, OpenDNS, Quad9) if not.

By only upgrading the DNS resolution to DoH if the users' current DNS provider is supported, Google believes that the users' DNS resolution experience will stay the same.

Mozilla's DoH experiments have already been met with criticism from network admins and Linux distro maintainers after the decision to enable DoH by default and using Cloudflare's DoH server rather than a user's existing DNS provider.

Senior scalability engineer Kristian Köhntopp said that Mozilla is "about to break DNS" seeing that Cloudflare will be used for DNS resolution over the default server assigned by system administrators, leading to leaking visited website addresses inside corporate environments to Cloudflare.

Peter Hessler, an OpenBSD developer, tweeted at the time that OpenBSD disabled DoH in their Firefox package in the current releases and will also disabled it in future ones since "sending all DNS traffic to Cloudflare by default is not a good idea."

Original Submission

 
This discussion has been archived. No new comments can be posted.
Dutch Govt Explains the Risks Behind DNS-Over-HTTPS Move | Log In/Create an Account | Top | 49 comments | Search Discussion
Display Options Threshold/Breakthrough Mark All as Read Mark All as Unread
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.

  • (Score: 4, Interesting) by maxwell demon on Sunday October 06 2019, @08:07AM (1 child)

    by maxwell demon (1608) on Sunday October 06 2019, @08:07AM (#903318) Journal

    Exactly... Who in their right mind would ever believe that is more secure than your  ISP  DNS server on your own LAN?

    FTFY

    --
    The Tao of math: The numbers you can count are not the real numbers.
    Starting Score:    1  point
    Moderation   +2  
       Interesting=1, Informative=1, Total=2
    Extra 'Interesting' Modifier   0  
    Karma-Bonus Modifier   +1  
    Total Score:   4  

  • (Score: 1) by fustakrakich on Sunday October 06 2019, @06:29PM

    by fustakrakich (6150) on Sunday October 06 2019, @06:29PM (#903461) Journal

    Damn! Why didn't I think of that [soylentnews.org]?

    Sorry

    --
    La politica e i criminali sono la stessa cosa..