Macs, iPhones, iPads to get encrypted DNS – how'd you like them Apples?
(2020/06/27)
- Reference: 1593219354
- News link: https://www.theregister.co.uk/2020/06/27/apple_dns_macos_ios/
- Source link:
WWDC Apple this year will boldly go where its peers have gone before by implementing support for encrypted DNS in iOS and macOS.
"Starting this year, Apple platforms natively support encrypted DNS," said Tommy Pauly, internet technologies engineer, in a [1]video presentation for Apple's 2020 Worldwide Developer Conference, virtualized this year by necessity.
More specifically, macOS 11, iOS 14, and Mac Catalyst framework 14 (for Mac version of iPad apps) will support DNS-over-TLS (DoT) and DNS-over-HTTPS (DoH). These Apple operating system updates are scheduled for release later this year, likely in September or October.
When you visit a website with a browser, or connect to a service via an app, the software will, typically, in the background send domain-name system (DNS) queries to DNS servers, such as ones provided by your ISP, to translate domain names, like theregister.com, into network IP addresses the programs can use. These queries are typically sent unencrypted, meaning eavesdroppers on the network path can snoop on the names of sites and services you're using, and modify the query results to redirect you to malicious websites.
Encrypted DNS, as its name suggests, encrypts those queries to shield them from snoops and meddlers.
DoT started taking shape [2]in 2014 . A proposal to establish DoH as a standard was [3]drafted in 2017. And a year later, a research paper presented at a Usenix conference underscored the need for better security when it [4]reported that about 8.5 per cent of DNS queries were intercepted by service providers.
Around that time, with standards in place, internet companies got serious about encrypting DNS queries, and people had arguments about how [5]DoH disempowers network administrators and [6]let people flout filters put in place to protect them from smut and illegal content.
Cloudflare began supporting DNS-over-TLS and DNS-over-HTTPS queries in 2018 with the launch of its [7]1.1.1.1 DNS service . Mozilla [8]began rolling out DoH support last year.
Google began testing DoH last year and just implemented it [9]in Chrome 83 recently. Microsoft [10]talked about secure DNS last year and is now [11]testing it for Windows . Even Comcast [12]joined the party this week with Firefox.
Which brings us back to Apple.
[13]
Apple's encrypted DNS support shown off at WWDC this year
Apple's updated code will allow those offering DNS services, and enterprise organizations administering corporate software via Mobile Device Management, to create apps for configuring DNS settings so they use an encrypted transport.
For example, a service provider like Cloudflare could create a network extension app using the [14]NEDNSSettings class to switch a device to use DoT/DoH systemwide using Cloudflare's resolvers. Organizations using MDM will be able to do so by applying a Profile to managed devices.
Developers will also be able to create individual apps that allow users to choose to make app-specific connections over encrypted DNS using the NWParameters.PrivacyContext object and standard networking APIs.
As demonstrated in the video, an iOS app implementing encrypted DNS can be activated via Settings -> General -> VPN & Network (a menu called simply "VPN" on current iOS 13 systems).
Better fashionably late than never. ®
Sponsored: [15]Free Hands-on Training: Google Cloud Run Serverless
[1] https://developer.apple.com/videos/play/wwdc2020/10047/
[2] https://datatracker.ietf.org/doc/rfc7858/
[3] https://datatracker.ietf.org/doc/rfc8484/
[4] https://www.theregister.com/2018/08/20/dns_interception/
[5] https://www.theregister.com/2018/10/23/paul_vixie_slaps_doh_as_dns_privacy_feature_becomes_a_standard/
[6] https://www.theregister.com/2019/07/10/ispa_clears_mozilla/
[7] https://www.theregister.com/2018/04/03/cloudflare_dns_privacy/
[8] https://www.theregister.com/2019/09/09/mozilla_firefox_dns/
[9] https://www.theregister.com/2020/05/20/google_chrome_83/
[10] https://www.theregister.com/2019/11/19/microsoft_joins_doh/
[11] https://techcommunity.microsoft.com/t5/networking-blog/windows-insiders-can-now-test-dns-over-https/ba-p/1381282
[12] https://www.theregister.com/2020/06/26/firefox_comcast_dns_https/
[13] https://regmedia.co.uk/2020/06/26/apple_doh_dot.jpg
[14] https://developer.apple.com/documentation/networkextension/nednssettings
[15] https://go.theregister.com/tl/1956/-9051/free-hands-on-training-google-cloud-run-serverless?td=wptl1956
"Starting this year, Apple platforms natively support encrypted DNS," said Tommy Pauly, internet technologies engineer, in a [1]video presentation for Apple's 2020 Worldwide Developer Conference, virtualized this year by necessity.
More specifically, macOS 11, iOS 14, and Mac Catalyst framework 14 (for Mac version of iPad apps) will support DNS-over-TLS (DoT) and DNS-over-HTTPS (DoH). These Apple operating system updates are scheduled for release later this year, likely in September or October.
When you visit a website with a browser, or connect to a service via an app, the software will, typically, in the background send domain-name system (DNS) queries to DNS servers, such as ones provided by your ISP, to translate domain names, like theregister.com, into network IP addresses the programs can use. These queries are typically sent unencrypted, meaning eavesdroppers on the network path can snoop on the names of sites and services you're using, and modify the query results to redirect you to malicious websites.
Encrypted DNS, as its name suggests, encrypts those queries to shield them from snoops and meddlers.
DoT started taking shape [2]in 2014 . A proposal to establish DoH as a standard was [3]drafted in 2017. And a year later, a research paper presented at a Usenix conference underscored the need for better security when it [4]reported that about 8.5 per cent of DNS queries were intercepted by service providers.
Around that time, with standards in place, internet companies got serious about encrypting DNS queries, and people had arguments about how [5]DoH disempowers network administrators and [6]let people flout filters put in place to protect them from smut and illegal content.
Cloudflare began supporting DNS-over-TLS and DNS-over-HTTPS queries in 2018 with the launch of its [7]1.1.1.1 DNS service . Mozilla [8]began rolling out DoH support last year.
Google began testing DoH last year and just implemented it [9]in Chrome 83 recently. Microsoft [10]talked about secure DNS last year and is now [11]testing it for Windows . Even Comcast [12]joined the party this week with Firefox.
Which brings us back to Apple.
[13]
Apple's encrypted DNS support shown off at WWDC this year
Apple's updated code will allow those offering DNS services, and enterprise organizations administering corporate software via Mobile Device Management, to create apps for configuring DNS settings so they use an encrypted transport.
For example, a service provider like Cloudflare could create a network extension app using the [14]NEDNSSettings class to switch a device to use DoT/DoH systemwide using Cloudflare's resolvers. Organizations using MDM will be able to do so by applying a Profile to managed devices.
Developers will also be able to create individual apps that allow users to choose to make app-specific connections over encrypted DNS using the NWParameters.PrivacyContext object and standard networking APIs.
As demonstrated in the video, an iOS app implementing encrypted DNS can be activated via Settings -> General -> VPN & Network (a menu called simply "VPN" on current iOS 13 systems).
Better fashionably late than never. ®
Sponsored: [15]Free Hands-on Training: Google Cloud Run Serverless
[1] https://developer.apple.com/videos/play/wwdc2020/10047/
[2] https://datatracker.ietf.org/doc/rfc7858/
[3] https://datatracker.ietf.org/doc/rfc8484/
[4] https://www.theregister.com/2018/08/20/dns_interception/
[5] https://www.theregister.com/2018/10/23/paul_vixie_slaps_doh_as_dns_privacy_feature_becomes_a_standard/
[6] https://www.theregister.com/2019/07/10/ispa_clears_mozilla/
[7] https://www.theregister.com/2018/04/03/cloudflare_dns_privacy/
[8] https://www.theregister.com/2019/09/09/mozilla_firefox_dns/
[9] https://www.theregister.com/2020/05/20/google_chrome_83/
[10] https://www.theregister.com/2019/11/19/microsoft_joins_doh/
[11] https://techcommunity.microsoft.com/t5/networking-blog/windows-insiders-can-now-test-dns-over-https/ba-p/1381282
[12] https://www.theregister.com/2020/06/26/firefox_comcast_dns_https/
[13] https://regmedia.co.uk/2020/06/26/apple_doh_dot.jpg
[14] https://developer.apple.com/documentation/networkextension/nednssettings
[15] https://go.theregister.com/tl/1956/-9051/free-hands-on-training-google-cloud-run-serverless?td=wptl1956
Big G
Kevin McMurtrie
Then install Chrome so everything you type into the address bar is collected by the world's largest private data hoarder.
Default?
Better late than never. But, they really need to make it on by default.
I'm using Firefox and when I went to check if I had the option, I found that one of the updates had given me the option and enabled it automatically and, if want or need to, I can disable it.
From a user point of view, this is how it should work.