privacyguides
/
privacytools.io
Archived
1
0
Fork 0
Code Issues 304 Pull Requests 47 Activity

Add section to validate DNS connection #1176

Merged
nitrohorse merged 7 commits from 1152 into master 2019-08-24 17:26:38 +00:00
Conversation 1 Commits 7 Files Changed 1 +17 -1
nitrohorse commented 2019-08-18 01:26:05 +00:00 (Migrated from github.com)
Copy Link

Description

This PR adds a new section for giving users easy to follow steps to validate their encrypted DNS connection is working for them. Definitely open to any feedback to make this clearer and more readable.

@Mikaela did note in the issue:

Should we note here [in Firefox's about:networking#dns step] that it's normal that some first queries such as captive portal checking may be going plaintext? Is it OK that our instructions allow downgrading to insecure DNS if DoH is down? I guess as optimally the user has global DNS encryption and eDNS is just going to benefit as DoH?

I address this by saying If the TRR column says "true" for some fields, you are using DoH. Maybe this could be changed to something more clearer?

Resolves: https://github.com/privacytoolsIO/privacytools.io/issues/1152

Check List

Code Repository (if applicable): N/A

<!-- PLEASE READ OUR [CONTRIBUTING GUIDELINES](https://github.com/privacytoolsIO/privacytools.io/blob/master/.github/CONTRIBUTING.md) BEFORE SUBMITTING --> ## Description This PR adds a new section for giving users easy to follow steps to validate their encrypted DNS connection is working for them. Definitely open to any feedback to make this clearer and more readable. @Mikaela did note in the issue: > Should we note here [in Firefox's `about:networking#dns` step] that it's normal that some first queries such as captive portal checking may be going plaintext? Is it OK that our instructions allow downgrading to insecure DNS if DoH is down? I guess as optimally the user has global DNS encryption and eDNS is just going to benefit as DoH? I address this by saying `If the TRR column says "true" for some fields, you are using DoH.` Maybe this could be changed to something more clearer? Resolves: https://github.com/privacytoolsIO/privacytools.io/issues/1152 #### Check List <!-- Please add an x in each box below, like so: [x] --> - [x] I have read and understand [CONTRIBUTING.md](https://github.com/privacytoolsIO/privacytools.io/blob/master/.github/CONTRIBUTING.md). - ~~[ ] I have listed the source code for this project in [source_code.md](https://github.com/privacytoolsIO/privacytools.io/blob/master/source_code.md).~~ - ~~[ ] This project is [free/libre software](https://www.wikipedia.org/wiki/Free_software).~~ - [x] This project has an [associated discussion](https://github.com/privacytoolsIO/privacytools.io/issues). Code Repository (if applicable): N/A
jonah reviewed 2019-08-18 01:26:05 +00:00
blacklight447 (Migrated from github.com) reviewed 2019-08-18 01:26:05 +00:00
netlify[bot] commented 2019-08-18 01:26:47 +00:00 (Migrated from github.com)
Copy Link

Deploy preview for privacytools-io ready!

Built with commit f59c63c0c9

https://deploy-preview-1176--privacytools-io.netlify.com

Deploy preview for *privacytools-io* ready! Built with commit f59c63c0c941995806df60f7283b1fc9f0636a2e https://deploy-preview-1176--privacytools-io.netlify.com
nitrohorse (Migrated from github.com) reviewed 2019-08-18 01:26:52 +00:00
_includes/sections/dns.html
@ -39,3 +39,3 @@
<tr>
<th data-sorted="true" data-sorted-direction="descending">ICANN DNS Provider</th>
<th data-sorted="true" data-sorted-direction="ascending">ICANN DNS Provider</th>
<th data-sortable="true">Server Locations</th>
nitrohorse (Migrated from github.com) commented 2019-08-18 01:26:52 +00:00

Fix small issue with sorting "caret" pointing in the wrong direction on page load.

Fix small issue with sorting "caret" pointing in the wrong direction on page load.
jonah reviewed 2019-08-18 01:55:43 +00:00
Mikaela (Migrated from github.com) requested changes 2019-08-18 08:41:00 +00:00
Mikaela (Migrated from github.com) left a comment

👍 overall good start, but I have suggestions I would like to see implemented

:+1: overall good start, but I have suggestions I would like to see implemented
_includes/sections/dns.html
Mikaela (Migrated from github.com) commented 2019-08-18 08:27:02 +00:00

I think this need additional information.

        <li>Check <a href="https://www.dnsleaktest.com/">https://www.dnsleaktest.com/</a> You should see something else than your ISP's DNS servers that is at least in the country of your chosen encrypted DNS server.</li>

I am not how good my suggestion is though. Also I am not sure how clear it is that Quad9 often appears as WoodyNet for people in the USA while in Finland they appear as TREX Exchange Services Oy where the node is hosted. My Keybase DNS leak test with my config file is possibly a good showcasing of this.

I think this need additional information. ```suggestion <li>Check <a href="https://www.dnsleaktest.com/">https://www.dnsleaktest.com/</a> You should see something else than your ISP's DNS servers that is at least in the country of your chosen encrypted DNS server.</li> ``` I am not how good my suggestion is though. Also I am not sure how clear it is that Quad9 often appears as WoodyNet for people in the USA while in Finland they appear as TREX Exchange Services Oy where the node is hosted. My Keybase DNS leak test with my config file is possibly a good showcasing of this.
Mikaela (Migrated from github.com) commented 2019-08-18 08:29:13 +00:00

I guess the dnsleak.com test is higher due to being more reliable? I am thinking on how that test may fail at times due to caching or just in general like happens to BlahDNS https://github.com/ookangzheng/blahdns/issues/42 who doesn't know why it happens. I am not sure if this comment needs to be addressed.

I guess the dnsleak.com test is higher due to being more reliable? I am thinking on how that test may fail at times due to caching or just in general like happens to BlahDNS https://github.com/ookangzheng/blahdns/issues/42 who doesn't know why it happens. I am not sure if this comment needs to be addressed.
Mikaela (Migrated from github.com) commented 2019-08-18 08:32:14 +00:00 
        <li>If using Firefox's trusted recursive resolver (TRR), navigate to <code>about:networking#dns</code>. If the TRR column says "true", then that DNS query was done using DoH.</li>

Can we assume that people read our insturctions and we don't need to separately warn about not all queries possibly being TRR?

image

```suggestion <li>If using Firefox's trusted recursive resolver (TRR), navigate to <code>about:networking#dns</code>. If the TRR column says "true", then that DNS query was done using DoH.</li> ``` Can we assume that people read our insturctions and we don't need to separately warn about not all queries possibly being TRR? ![image](https://user-images.githubusercontent.com/831184/63222112-a8a0b080-c192-11e9-98b5-64bcfeb6a360.png)
Mikaela (Migrated from github.com) commented 2019-08-18 08:34:54 +00:00 
    <li>dnscrypt-proxy - Check <a href="https://github.com/jedisct1/dnscrypt-proxy/wiki/Checking">DNSCrypt-proxy's wiki on how to verify that your DNS is encrypted</a>.

This discussion made me check the upstream.

```suggestion <li>dnscrypt-proxy - Check <a href="https://github.com/jedisct1/dnscrypt-proxy/wiki/Checking">DNSCrypt-proxy's wiki on how to verify that your DNS is encrypted</a>. ``` This discussion made me check the upstream.
Mikaela (Migrated from github.com) commented 2019-08-18 08:38:06 +00:00 
    <li>DNSSEC - Check <a href="https://dnssec.vs.uni-due.de/">dnssec.vs.uni-due.de</a>.</li>

I want the link to look better, but I am not sure what to call that test as they don't call themselves as "DNSSEC capability checker by ??? University" or similar.

```suggestion <li>DNSSEC - Check <a href="https://dnssec.vs.uni-due.de/">dnssec.vs.uni-due.de</a>.</li> ``` I want the link to look better, but I am not sure what to call that test as they don't call themselves as "DNSSEC capability checker by ??? University" or similar.
Mikaela (Migrated from github.com) commented 2019-08-18 08:39:25 +00:00

Should it be noted that dig is part of bind-dnsutils in Debian and ??? in Fedora, if it says command not found? And Windows?

Should it be noted that dig is part of `bind-dnsutils` in Debian and ??? in Fedora, if it says command not found? And Windows?
nitrohorse (Migrated from github.com) reviewed 2019-08-20 02:17:31 +00:00
_includes/sections/dns.html
nitrohorse (Migrated from github.com) commented 2019-08-20 02:17:31 +00:00

Yeah, I guess I'm thinking the dnsleaktest maybe isn't more reliable but applicable to all providers we list? Some don't have their own test page is what I'm thinking... I guess it's implicit for users to try several of the points we make here, e.g. check dnsleaktest & see if a test page is available.

Yeah, I guess I'm thinking the dnsleaktest maybe isn't more reliable but applicable to _all_ providers we list? Some don't have their own test page is what I'm thinking... I guess it's implicit for users to try several of the points we make here, e.g. check dnsleaktest & see if a test page is available.
nitrohorse (Migrated from github.com) reviewed 2019-08-20 02:20:00 +00:00
_includes/sections/dns.html
nitrohorse (Migrated from github.com) commented 2019-08-20 02:19:59 +00:00

Yeah, good point 🤔 the server location difference is due to Anycast, correct (which we call out in the table)? Maybe we should mention here in a warning or something about for Anycast providers, this may not be the most reliable check then...

Yeah, good point :thinking: the server location difference is due to Anycast, correct (which we call out in the table)? Maybe we should mention here in a warning or something about for Anycast providers, this may not be the most reliable check then...
nitrohorse (Migrated from github.com) reviewed 2019-08-20 02:22:24 +00:00
_includes/sections/dns.html
nitrohorse (Migrated from github.com) commented 2019-08-20 02:22:24 +00:00

Hmm... that's a good point... there's ongoing discussions about how the about:config tweaks section could potentially go or not so maybe its worth calling out in a warning or something here about this?

Hmm... that's a good point... there's ongoing discussions about how the about:config tweaks section could potentially go or not so maybe its worth calling out in a warning or something here about this?
nitrohorse (Migrated from github.com) reviewed 2019-08-20 02:23:09 +00:00
_includes/sections/dns.html
nitrohorse (Migrated from github.com) commented 2019-08-20 02:23:08 +00:00

yeah 🤔

yeah :thinking:
nitrohorse (Migrated from github.com) reviewed 2019-08-20 02:23:28 +00:00
_includes/sections/dns.html
nitrohorse (Migrated from github.com) commented 2019-08-20 02:23:28 +00:00

hmm, yeah good callout 🤔

hmm, yeah good callout :thinking:
jonah reviewed 2019-08-20 02:53:52 +00:00
_includes/sections/dns.html
jonah commented 2019-08-20 02:53:51 +00:00

I would literally just call it "DNSSEC Resolver Test by University of Duisburg-Essen"

I would literally just call it "DNSSEC Resolver Test by University of Duisburg-Essen"
jonah reviewed 2019-08-20 02:54:27 +00:00
_includes/sections/dns.html
jonah commented 2019-08-20 02:54:26 +00:00

Alternatively, "DNSSEC Resolver Test by Matthäus Wander"

Alternatively, "DNSSEC Resolver Test by Matthäus Wander"
jonah reviewed 2019-08-20 02:59:13 +00:00
_includes/sections/dns.html
jonah commented 2019-08-20 02:59:13 +00:00

On Ubuntu and Debian (and presumably Trisquel) it's just dnsutils. On Fedora and CentOS it is bind-utils. On Arch (and presumably Parabola) it's bind-tools.

On Ubuntu and Debian (and presumably Trisquel) it's just `dnsutils`. On Fedora and CentOS it is `bind-utils`. On Arch (and presumably Parabola) it's `bind-tools`.
nitrohorse (Migrated from github.com) reviewed 2019-08-20 03:26:36 +00:00
_includes/sections/dns.html
nitrohorse (Migrated from github.com) commented 2019-08-20 03:26:36 +00:00

Hmm, should we just link to something like https://en.wikipedia.org/wiki/Dig_(command)?

Hmm, should we just link to something like https://en.wikipedia.org/wiki/Dig_(command)?
nitrohorse (Migrated from github.com) reviewed 2019-08-20 04:14:35 +00:00
_includes/sections/dns.html
nitrohorse (Migrated from github.com) commented 2019-08-20 04:14:35 +00:00

I'll push an update.

I'll push an update.
nitrohorse (Migrated from github.com) reviewed 2019-08-20 04:15:01 +00:00
_includes/sections/dns.html
nitrohorse (Migrated from github.com) commented 2019-08-20 04:15:00 +00:00

Will push an update.

Will push an update.
nitrohorse (Migrated from github.com) reviewed 2019-08-20 04:21:20 +00:00
_includes/sections/dns.html
nitrohorse (Migrated from github.com) commented 2019-08-20 04:21:20 +00:00

I'll push an update for this.

I'll push an update for this.
Mikaela (Migrated from github.com) requested changes 2019-08-20 09:28:11 +00:00
Mikaela (Migrated from github.com) left a comment

There are sme things I would still like to see addressed

There are sme things I would still like to see addressed
_includes/sections/dns.html
Mikaela (Migrated from github.com) commented 2019-08-20 09:20:00 +00:00 
  <h4>How to verify DNS is encrypted</h4>

This is not a perfect suggestion either, but "Validate" is a bit unclear on what is being validated.

```suggestion <h4>How to verify DNS is encrypted</h4> ``` This is not a perfect suggestion either, but "Validate" is a bit unclear on what is being validated.
Mikaela (Migrated from github.com) commented 2019-08-20 09:23:59 +00:00

It's not only the case with anycast or at least I think DNSLeaktest showed BlahDNS Swizerland as etna.switch.cz or similar.

        <li>Check <a href="https://www.dnsleaktest.com/">DNSLeakTest.com</a>. <span class="badge badge-warning" data-toggle="tooltip" data-placement="bottom" data-original-title="Your DNS provider may not appear with their own name, so compare the responses to what you know or can find about your DNS provider. The main point is that you shouldn't see your ISP or old unencrypted DNS provider."><i class="fas fa-exclamation-triangle"></i></span></li>
It's not only the case with anycast or at least I think DNSLeaktest showed BlahDNS Swizerland as etna.switch.cz or similar. ```suggestion <li>Check <a href="https://www.dnsleaktest.com/">DNSLeakTest.com</a>. <span class="badge badge-warning" data-toggle="tooltip" data-placement="bottom" data-original-title="Your DNS provider may not appear with their own name, so compare the responses to what you know or can find about your DNS provider. The main point is that you shouldn't see your ISP or old unencrypted DNS provider."><i class="fas fa-exclamation-triangle"></i></span></li> ```
jonah reviewed 2019-08-20 15:30:24 +00:00
_includes/sections/dns.html
jonah commented 2019-08-20 15:30:24 +00:00

The tests will always show the owner of the IP address block, which is typically the upstream ISP of the VPN provider. This suggestion is worded fine though I think. However, I would change "The main point is that you shouldn't" to "Just ensure you don't".

The tests will always show the owner of the IP address block, which is typically the upstream ISP of the VPN provider. This suggestion is worded fine though I think. However, I would change "The main point is that you shouldn't" to "Just ensure you don't".
Mikaela (Migrated from github.com) reviewed 2019-08-21 21:23:11 +00:00
nitrohorse (Migrated from github.com) reviewed 2019-08-23 04:06:55 +00:00
_includes/sections/dns.html
nitrohorse (Migrated from github.com) commented 2019-08-23 04:06:55 +00:00

Also found https://www.dnssec.cz/ by CZ.NIC.

Also found https://www.dnssec.cz/ by CZ.NIC.
nitrohorse (Migrated from github.com) reviewed 2019-08-23 04:23:36 +00:00
_includes/sections/dns.html
nitrohorse (Migrated from github.com) commented 2019-08-23 04:23:35 +00:00

Added as a second option.

Added as a second option.
Mikaela (Migrated from github.com) reviewed 2019-08-23 11:28:01 +00:00
Mikaela (Migrated from github.com) left a comment

👍

:+1:
_includes/sections/dns.html
@ -288,3 +303,4 @@
<h3>Worth Mentioning and Additional Information</h3>
<ul>
Mikaela (Migrated from github.com) commented 2019-08-23 11:27:53 +00:00

Does the CZ NIC page have English somewhere or do we assume that everyone can read Czech? 😄

I am learning it and can somewhat understand the gist on having DNSSEC, but I am not entirely sure what it's trying to tell me.

Does the CZ NIC page have English somewhere or do we assume that everyone can read Czech? :smile: I am learning it and can somewhat understand the gist on having DNSSEC, but I am not entirely sure what it's trying to tell me.
nitrohorse (Migrated from github.com) reviewed 2019-08-24 14:52:28 +00:00
_includes/sections/dns.html
@ -288,3 +303,4 @@
<h3>Worth Mentioning and Additional Information</h3>
<ul>
nitrohorse (Migrated from github.com) commented 2019-08-24 14:52:27 +00:00

Hmm so they don't have an English translation... yeah, maybe this is more confusing to add. From my understanding is that as long as there's a big green lock icon next to "DNSSEC", DNSSEC is enabled 😄 But I think the original link is fine to have. I'll remove the CZ.NIC link.

Hmm so they don't have an English translation... yeah, maybe this is more confusing to add. From my understanding is that as long as there's a big green lock icon next to "DNSSEC", DNSSEC is enabled :smile: But I think the original link is fine to have. I'll remove the CZ.NIC link.
Mikaela (Migrated from github.com) approved these changes 2019-08-24 15:47:04 +00:00
Mikaela (Migrated from github.com) left a comment

👍

:+1:
dawidpotocki (Migrated from github.com) approved these changes 2019-08-24 17:21:42 +00:00
This repo is archived. You cannot comment on pull requests.
Reviewers
No reviewers
jonah
blacklight447
Mikaela
dawidpotocki
Labels
Clear labels   
🔍🤖 Search Engines

   
approved

approved, waiting for a PR

  
dependencies

Pull requests that update a dependency file

  
duplicate

   
feedback wanted

   
high priority

   
I2P

The Invisible Internet Project (I2P)

  
iOS

   
low priority

   
OS

Operating Systems

  
Self-contained networks

   
Social media

   
stale

A label for stalebot if it gets added

  
streaming

Anything related to media streaming.

  
todo

   
Tor

Anything covering the Tor network

  
WIP

active work in progress, do not merge or PR (yet)!

  
wontfix

Issues or bugs that will not be fixed and/or do not have significant impact on the project.

  
XMPP

Extensible Messaging and Presence Protocol

  
[m]

Matrix protocol

  
₿ cryptocurrency

   
ℹ️ help wanted

   
↔️ file sharing

   
⚙️ web extensions

Browser Extension related issues

  
✨ enhancement

   
❌ software removal

   
💬 discussion

   
🤖 Android

   
🐛 bug

   
💢 conflicting

   
📝 correction

Correction of content on the website

  
🆘 critical

   
📧 email

   
🔒 file encryption

   
📁 file storage

   
🦊 Firefox

Firefox & forks, about:config etc.

  
💻 hardware

   
🌐 hosting

   
🏠 housekeeping

Anything primarily related to site cleanup.

  
🔐 password managers

   
🧰 productivity tools

   
🔎 research required

   
🌐 Social News Aggregators

   
🆕 software suggestion

   
👥 team chat

   
🔒 VPN

Virtual Private Network

  
🌐 website issue

*Technical* issues with the website.

  
🚫 Windows

   
👁️ browsers

   
🖊️ digital notebooks

   
🗄️ DNS

Domain Name System

  
🗨️ instant messaging (im)

   
🇦🇶 translations

Anything covering a translated version of the site

No Label
🔍🤖 Search Engines
approved
dependencies
duplicate
feedback wanted
high priority
I2P
iOS
low priority
OS
Self-contained networks
Social media
stale
streaming
todo
Tor
WIP
wontfix
XMPP
[m]
₿ cryptocurrency
ℹ️ help wanted
↔️ file sharing
⚙️ web extensions
✨ enhancement
❌ software removal
💬 discussion
🤖 Android
🐛 bug
💢 conflicting
📝 correction
🆘 critical
📧 email
🔒 file encryption
📁 file storage
🦊 Firefox
💻 hardware
🌐 hosting
🏠 housekeeping
🔐 password managers
🧰 productivity tools
🔎 research required
🌐 Social News Aggregators
🆕 software suggestion
👥 team chat
🔒 VPN
🌐 website issue
🚫 Windows
👁️ browsers
🖊️ digital notebooks
🗄️ DNS
🗨️ instant messaging (im)
🇦🇶 translations
Milestone
Clear milestone
No items
No Milestone
Assignees
Clear assignees
No Assignees
1 Participants
Due Date
The due date is invalid or out of range. Please use the format 'yyyy-mm-dd'.

No due date set.

Dependencies

No dependencies set.

Reference: privacyguides/privacytools.io#1176
No description provided.
Delete Branch "1152"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?