DNS over HTTPSIETF 105 モントリオール@KenjiBaheux / Sept 2019
Product Manager @ Chrome - Web Platform, Google
1

DoH @ IETF 105

Applications Doing DNS BOF:
●Mozilla’s perspective●Chrome's perspective●

Non-browser apps doing DNS●

DoH Preference Hints for HTTP●

DoH BCP●DoH Push

DNSOP:●DNS Resolver Information2

Role of the Domain Name System(DNS)

3

Domain Name System
DNS is what allows your browser to ﬁnd which hosting9

12.34.56.78

10

Hosting server
www.example.com

2

Root Resolver

server it needs to contact when you want to visit awebsite, e.g. www.example.com
The browser asks1 the recursive resolver (RR) to resolve
the IP address for www.example.com. RR is usually1

provided by the ISP or network operator.

8

RR asks2 a root resolver to ﬁnd3 the TLD resolver

3

4

responsible for .com addresses. RR asks the TLD
resolver to ﬁnd5 the authoritative resolver for

4

6

www.example. Finally, RR asks the authoritative resolver
to ﬁnd7 the IP address of the hosting server. The IP
8address is sent back to the browser which can now
talk9-10 to the hosting server for www.example.com
Note: this mapping is temporarily cached by the browser to speed up

Recursive Resolver

5TLD Resolver(.com)

6
7

future connections.
Authoritative Resolver(for Example)

4

Problems with DNS

5Lack of Confidentiality

6

Privacy leak
192.168.1.3

12.32.12.32

3

The connection to the recursive resolver is

DNS query for
weird.com

A bad actor can ﬁnd out which websites
other users are browsing by observing theweird.com

4

not private.

1

2

DNS queries, i.e. the computer at
192.168.1.3 is asking for the IP address ofweird.com

Recursive resolver

7Lack of Authentication

8

Talking to strangers
12.32.12.32
6

The connection to the recursive resolver isa.com

not authenticated. This means that your7

browser has no way to conﬁrm the identity of
1 You
19 r RR
2.1
68 is at.1.
5

the recursive resolver.
A bad actor connected to a coffee shop’s...

public WiFi can force (step 1) other users toD
2 a NS f.co orm?
5 It’s
12.
32.
12.
32

use a recursive resolver that they control.
This could be their own laptop, running asimplistic recursive resolver set to capturelogs and build proﬁles of users.

Legitimate
Recursive Resolver

4

3rfo ?
SDN .com
a2.3
12.
2.3
12sIt’

192.168.1.5

Evil
Recursive Resolver

9Lack of Integrity

10Truth or lies?
Third Party
Ads Network

The DNS responses are unsubstantiatedclaims. Your browser has no way to know if

499.88.77.66

the IP address it got back is the truth or a lie.
3

“Helpful” website

In other words, a recursive resolver can sendback whatever it wants.
For instance, if the user mistypes wikipedia

IP address for1
wikipeda.com?

299.88.77.66

as wikipeda, the recursive resolver canRoot Resolver

ignore the “does not exist” response it got
from the authoritative resolver and send theuser to a “helpful” website ridden with ads,
allowing an unscrupulous third party to build
a user proﬁle.

Recursive Resolver

TLD Resolver

Doesnote

xist!
Authoritative Resolver

11

DNS-over-HTTPS

12

Secure DNS
DNS-over-HTTPS makes the communication
Hosting server

between the browser and the recursive
resolver secure by conducting the exchange

99.88.77.66

over a secure protocol, i.e HTTPS
Evil server

HTTPS is designed to provide conﬁdentiality,authentication, and integrity.
Bad actors can no longer:●Observe the DNS requests●Fool the browser about the resolver’sidentity●

Recursive resolver

Manipulate the response from theresolver.

13

Beyond Securing DNS
DNS-over-HTTPS is just one step in the right
direction. It’s not meant to address all theprivacy and security problems with Internet
protocols.
For instance, Server Name Indication* (steps1 & 2) is another source of privacy leak thatoccurs when multiple websites are servedbehind a single IP address. Currently, thedesired server name is sent in the clear,prior to establishing an encrypted channel.

SNI set to weird.com“I want to access
1 weird.com”

12.34.56.78“Here is how to do
2so, securely!”

bizstats.com
4

3

5
6

weird.com

Mega-hostingserver
biznews.com

14Complications

15

Yeah, secure communication!
... but to whom?

16

Hosting server

Unscrupulous providers
Securing the communication channel between thebrowser and the recursive resolver is good but notnecessarily enough.
Indeed, your browser could still be talking to a resolver
operated by an unscrupulous provider who could sell
your browsing history to third parties.
Dissociating Good from Evil is not solvable via a change

Unscrupulous
Recursive Resolver
Unexpected proﬁler 1

Unexpected proﬁler 2of protocol.
...

17

Hacked Home Routers
Consumer grade routers have poor security trackrecords. They also rarely receive software updates.
This makes them very appealing to bad actors. In
particular, security ﬂaws that allow to change a router’s
DNS settings are actively exploited to launch large scale
phishing attacks, malvertising campaigns, and so on.
So, for us it means that the DNS settings advertised byhome routers shouldn’t be taken at face value.

Router exploit campaign in Brazil (2019)18

Historical baggage1935+ years of DNS = Lots of dependencies

In November 1983, the Domain Name System was ﬁrst described in two
IETF RFCs. With 35+ years of existence, many companies have come torely on DNS, including its insecure nature.
Some examples:●●●●Enterprise / Education solutions designed to prevent access tocertain websites
ISPs and router makers providing easy to setup family-safeﬁltering
Security companies relying on the ability to monitor odd DNS
queries for detecting new malware.
ISPs required to block certain content by law or court order.

20

Mozilla's perspective

21

Takeaways

https://blog.mozilla.org/security/2019/04/09/dns-over-https-policy-requirements-for-resolvers/

22

Takeaways

23Chrome's perspective

24

Family-safe Internet
Don’t surprise our users, avoid breaking
expectations.
How:
●
●
●

Don’t force a different DNS provider (opt-in)
Lock down / adjust UX if parental controls
are enabled.
Maintain the same experience if upgradingfrom a provider’s insecure DNS to thatprovider’s secure DNS.

25

Education/EnterpriseContinue to support Education andEnterprise use cases.
How: allow administrators to disable or
conﬁgure DNS-over-HTTPS as they wish via
Chrome policies.

BYOD situations: out-of-scope. OS speciﬁcsolutions exists, e.g. Android Enterprise.

Options for enforcing Chrome policies

26

Auto-upgrade
Targeting: Chrome 78

For users who are already using a DNS provider known to also
support DoH, we will transparently auto-upgrade them to thatprovider’s DoH service.
Requirements:●Privacy, security stance and practice that are alignedwith the motivation of DoH.

●Equivalence of service between Plain DNS and DoH,e.g. parental control, performance, availability.

27

DoH BCP

28

Best Current Practices?

Presented by British Telecom●

DoH presents new challenges for operators (e.g. ISPs)●

Can ADD work on a BCP rfc?

29

DNS Resolver Information

30

DNS Resolver Information
Allow stub resolvers to obtain more information abouta Recursive Resolver.
3 interesting suggestions at the session:●Expose more info about the chain of resolvers
involved○●

Which resolver a home router is ultimately
using?

Expose info about who is providing the service(name of ISP)●

Which ﬁltering features are enabled?
○○○

Parental control
Security...

https://tools.ietf.org/html/draft-ietf-dnsop-resolver-information-00

31

Thanks@kenjibaheux

32