1. The world changes again
DNS Privacy:
The world changes again

2. The world changes again
DNS Privacy:
The world changes again
Dmitry Belyavskiy,
Technical Centre of Internet
EEDNS Forum, Moscow,Russia
December 4, 2018 2

3. DNS Privacy: why?
DNS data is public, your requests are not
70% people can be recognized by their queries
Threat model
IETF WG dprive (2014 — nowadays)
IETF WG doh (2017 — nowadays)

4. Solutions: non-cryptographic part
QNAME minimization
Hide source IP
Consequences: more DNS queries

5. Solutions: cryptographic part
Padding (2016, 2018)
DNS over TLS (2016). DNS over DTLS (2017).
DNS over HTTPS (2018)
Supported by all major players

6. Big data market
Old: social networks
New: CDNs, Browsers
Future: who knows?
Mobile phone vendors?
Nationwide services?

7. Switching to new model
Users will not switch themselves
DoH/DoT in browsers: opt-in => opt-out?
Resolving: from providers (and roots) to major resolvers

8. Security consequences
Host: major resolver, port: 443. Is everything ok?
No more DNS-based DPI
Only major players are able to fight malware/botnets?
Law-enforcement, antitrust: new relations?

9. Overall context
«All-in-one-browser»
Encrypted DNS
Encrypted handshake
Encrypted traffic

10. Questions?