<story><title>The FBI now recommends using an ad blocker when searching the web</title><url>https://www.standard.co.uk/tech/fbi-recommends-ad-blocker-online-scams-b1048998.html</url></story><parent_chain><item><author>giobox</author><text>While these are all good practices, killing DoH conclusively on your home network is more difficult than you&amp;#x27;ve made it seem, as ultimately all you can really do is use domain blacklists at your firewall. It&amp;#x27;s no longer as straight forward as just control port 53 traffic, not like you can realistically shut down 443... Blocking DoH is largely whack-a-mole and I think is only going to get worse as this and similar techniques spread. There are so many sneaky ways to resolve a hostname an app or device can choose to use now.&lt;p&gt;You can force traditional port 53 DNS protocol traffic to your own resolver with firewall rules, the same doesn&amp;#x27;t work for DoH. a DoH request to a domain your firewall blacklist doesn&amp;#x27;t have looks just like ordinary https&amp;#x2F;443 traffic and will pass unhindered.</text></item><item><author>TacticalCoder</author><text>Here are a few things I do to combat nasty websites:&lt;p&gt;- blacklists entire domains using wildcards (using an &amp;quot;unbound&amp;quot; DNS resolver and forcing all traffic to my DNS resolver, preventing &lt;i&gt;my browser&lt;/i&gt; to use DoH -- I can still then use DoH if I want, from unbound)&lt;p&gt;- reject or drop a huge number of known bad actors, regularly updated: they go into gigantic &amp;quot;ip sets&amp;quot; firewall rules&lt;p&gt;- (I came up with this one): use a little firewall rule that prevents &lt;i&gt;any&lt;/i&gt; IDN from resolving.  That&amp;#x27;s a one line UDP rule and it stops cold dead any IDN homograph attack.  Basically searching any UDP packet for the &amp;quot;xn--&amp;quot; string.&lt;p&gt;I do &lt;i&gt;not&lt;/i&gt; care about what this breaks.  The Web still works totally fine for me, including Google&amp;#x27;s G Suite (yeah, I know).&lt;p&gt;EDIT: just to be clear seen the comments for I realize I wasn&amp;#x27;t very precise... I&amp;#x27;m not saying all IDN domains are bad! What I&amp;#x27;m saying is that in my day to day Web surfing, 99.99% of the websites I&amp;#x27;m using do not use IDN and so, in my case, blocking IDN, up until today, is totally fine as it not only doesn&amp;#x27;t prevent &lt;i&gt;me&lt;/i&gt; from surfing the Web (I haven&amp;#x27;t seen a single site I need breaking) but it also protects me from IDN homograph attacks.  Your mileage may vary and you live in a country where it&amp;#x27;s normal to go on website with internationalized domain names, then obviously you cannot simply drop all UDP packets attempting to resolve IDNs.</text></item></parent_chain><comment><author>denkmoon</author><text>This is exactly why DoH is a trojan horse. You can&amp;#x27;t control it as a network administrator, all it takes is a piece of software to simply remove the controls for users to configure their own DoH and bam, end user has little to no control over how their applications perform name resolution.&lt;p&gt;Little pro-tip for anyone who tries to run their own private DoH infrastructure too, Firefox doesn&amp;#x27;t like RFC1918 addresses for the DoH resolver. Set `network.trr.allow-rfc1918=true` if you run DoH on a private IP.</text></comment>
<story><title>The FBI now recommends using an ad blocker when searching the web</title><url>https://www.standard.co.uk/tech/fbi-recommends-ad-blocker-online-scams-b1048998.html</url></story><parent_chain><item><author>giobox</author><text>While these are all good practices, killing DoH conclusively on your home network is more difficult than you&amp;#x27;ve made it seem, as ultimately all you can really do is use domain blacklists at your firewall. It&amp;#x27;s no longer as straight forward as just control port 53 traffic, not like you can realistically shut down 443... Blocking DoH is largely whack-a-mole and I think is only going to get worse as this and similar techniques spread. There are so many sneaky ways to resolve a hostname an app or device can choose to use now.&lt;p&gt;You can force traditional port 53 DNS protocol traffic to your own resolver with firewall rules, the same doesn&amp;#x27;t work for DoH. a DoH request to a domain your firewall blacklist doesn&amp;#x27;t have looks just like ordinary https&amp;#x2F;443 traffic and will pass unhindered.</text></item><item><author>TacticalCoder</author><text>Here are a few things I do to combat nasty websites:&lt;p&gt;- blacklists entire domains using wildcards (using an &amp;quot;unbound&amp;quot; DNS resolver and forcing all traffic to my DNS resolver, preventing &lt;i&gt;my browser&lt;/i&gt; to use DoH -- I can still then use DoH if I want, from unbound)&lt;p&gt;- reject or drop a huge number of known bad actors, regularly updated: they go into gigantic &amp;quot;ip sets&amp;quot; firewall rules&lt;p&gt;- (I came up with this one): use a little firewall rule that prevents &lt;i&gt;any&lt;/i&gt; IDN from resolving.  That&amp;#x27;s a one line UDP rule and it stops cold dead any IDN homograph attack.  Basically searching any UDP packet for the &amp;quot;xn--&amp;quot; string.&lt;p&gt;I do &lt;i&gt;not&lt;/i&gt; care about what this breaks.  The Web still works totally fine for me, including Google&amp;#x27;s G Suite (yeah, I know).&lt;p&gt;EDIT: just to be clear seen the comments for I realize I wasn&amp;#x27;t very precise... I&amp;#x27;m not saying all IDN domains are bad! What I&amp;#x27;m saying is that in my day to day Web surfing, 99.99% of the websites I&amp;#x27;m using do not use IDN and so, in my case, blocking IDN, up until today, is totally fine as it not only doesn&amp;#x27;t prevent &lt;i&gt;me&lt;/i&gt; from surfing the Web (I haven&amp;#x27;t seen a single site I need breaking) but it also protects me from IDN homograph attacks.  Your mileage may vary and you live in a country where it&amp;#x27;s normal to go on website with internationalized domain names, then obviously you cannot simply drop all UDP packets attempting to resolve IDNs.</text></item></parent_chain><comment><author>LinuxBender</author><text>&lt;i&gt;Blocking DoH is largely whack-a-mole&lt;/i&gt;&lt;p&gt;Maybe this is so but I have yet to see it.  AFAIK all the DoT&amp;#x2F;DoH are on known dedicated IP addresses.  I know they don&amp;#x27;t have to be.  They could be on generic Akamai&amp;#x2F;CF&amp;#x2F;BunnyCDN&amp;#x2F;etc... end points but I have yet to come across one utilized in the wild.  Have you found any?  What are their IP addresses?  I would like to add them to my DNS timing&amp;#x2F;monitoring scripts.&lt;p&gt;I null route about 24 DoT&amp;#x2F;DoH IP addresses and my one smartphone seemed to figure out automagically that my router was serving up DoT on 853.  I can tell if something is bypassing Unbound because there are things I know should not resolve correctly.</text></comment>