Cloudflare and Apple design a new privacy-friendly internet protocol | Hacker News Reader

Cloudflare and Apple design a new privacy-friendly internet protocol

techcrunch.com

31 pointslladnar14 comments

It may be more accurate to say that Cloudflare and Apple seem to have implemented ODNS:

https://odns.cs.princeton.edu

Why did they change the name to ODoH?

as i read they add an extra TLS/HTTPS layer to ODNS traffic in order to pipe dns query yet an other party. first TLS gets unwrapped, then forwarded to ODNS resolver, so the DOH provider sees who (which IP/netblock) queries but not what; and the ODNS sees what is queried but not by whom. my problem with it is that DOH and ODNS providers are altough intended to be separate entities, but it's not guaranteed and eventhough they are, they can still share data off-band. and this obscurity in DNS won't stop ISPs to spy on what sites user visits, based on bare IP connections pattern, see https://blog.apnic.net/2019/08/23/what-can-you-learn-from-an... of course if all of the Internet would be behind aws/cloudflare CDN then this method won't be so effective for ISPs.

Interesting. Thanks for sharing your take. This is new to me so I really appreciate it

i'm wondering how does it compare to CurveDNS. once the root nameservers (or at least the TLD NSes) support curvedns, the ISPs won't see what the users query or the dns answer, only the IPs of the NSes the users queries.

it maybe give some insight for ISPs to know approximately which domain names users look up, but "big corp" ODNS and DOH provides won't get this info. and eventhough, ISPs still have a better resolution on what sites the user visits based on bare IP traffic (see https://blog.apnic.net/2019/08/23/what-can-you-learn-from-an... ).

IMO to minimize even that info that which NS IPs users query, zone and NS admins should cooperate to have as many secondary NS per zone as possible, even at 3rd party NS providers AND sign zones by DNS-SEC to prevent tampering at 3rd party NSes. in this ways the zone–to–nameserver-ip mapping becomes a many–to–many relation which ISPs can not rely on.

> Dubbed Oblivious DNS-over-HTTPS, or ODoH for short, the new protocol makes it far more difficult for internet providers to know which websites you visit.

> Here’s how it works: ODoH wraps a layer of encryption around the DNS query and passes it through a proxy server, which acts as a go-between the internet user and the website they want to visit.

A proxy server provided by Apple or Cloudflare? That sounds a lot less private than what I have now honestly.

> A proxy server provided by Apple or Cloudflare? That sounds a lot less private than what I have now honestly.

You're not the target demographic; it's a hell of a lot more private than >90% of their user base has now.

For US users.

For almost everyone, especially given that it's double-hop and neither hop knows both the user and the traffic.

ISPs are not allowed to do what this concern addresses in most of Europe.

It's not just the ISP; web sites won't get the client's true IP either, further stymying user tracking via IP correlation.

are not they? web traffic is disconnected from DNS once the name resolution is done. neither ODNS, DOH, nor other dns solutions masks your IP in web traffic. VPN does (there are vpn-over-dns solutions like iodine, but we aren't talking about it).

Edit: sorry I noticed you probably talk about web proxy servers provided by big corp. in this case, yes they "protect" you from your ISP's this kind of espionage.

This isn't just DNS.

Bravo.

This is likely what they’re using for the iCloud+ privacy enhanced browsing features they announced yesterday.

Reply on news.ycombinator.com