{"id":36652,"date":"2019-10-31T22:12:57","date_gmt":"2019-10-31T19:12:57","guid":{"rendered":"https:\/\/prohoster.info\/blog\/lyubit-i-ne-lyubit-dns-over-https\/"},"modified":"2019-10-31T22:12:57","modified_gmt":"2019-10-31T19:12:57","slug":"lyubit-i-ne-lyubit-dns-over-https","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/lyubit-i-ne-lyubit-dns-over-https","title":{"rendered":"\u201eMiluje a nemiluje\u201c: DNS over HTTPS","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Analyzujeme n\u00e1zory na vlastnosti fungov\u00e1n\u00ed DNS over HTTPS, kter\u00e9 se v posledn\u00ed dob\u011b staly \"jablkem sv\u00e1ru\" mezi poskytovateli internetu a v\u00fdvoj\u00e1\u0159i prohl\u00ed\u017ee\u010d\u016f.<\/p>\n

\"\u201eMiluje<\/a><\/noindex><\/a><\/noindex>
\n\/ Unsplash \/ Steve Halama<\/a><\/noindex><\/i><\/p>\n

Podstata neshod<\/h2>\n

\nV posledn\u00ed dob\u011b velk\u00e1 m\u00e9dia<\/a><\/noindex> a tematick\u00e9 platformy<\/a><\/noindex> (v\u010detn\u011b Habr), \u010dasto p\u00ed\u0161\u00ed o protokolu DNS over HTTPS (DoH). Ten \u0161ifruje dotazy na DNS server a jejich odpov\u011bdi. Tento p\u0159\u00edstup umo\u017e\u0148uje skr\u00fdt n\u00e1zvy hostitel\u016f, na kter\u00e9 se u\u017eivatel obrac\u00ed. Z publikac\u00ed lze usoudit, \u017ee nov\u00fd protokol (v IETF byl schv\u00e1len<\/a><\/noindex> v roce 2018) rozd\u011blil IT komunitu na dva t\u00e1bory.<\/p>\n

Polovina se domn\u00edv\u00e1, \u017ee nov\u00fd protokol zv\u00fd\u0161\u00ed bezpe\u010dnost internetu, a implementuje ho do sv\u00fdch aplikac\u00ed a slu\u017eeb. Druh\u00e1 polovina je p\u0159esv\u011bd\u010dena, \u017ee technologie jen zkomplikuje pr\u00e1ci syst\u00e9mov\u00fdm administr\u00e1tor\u016fm. D\u00e1le prozkoum\u00e1me argumenty obou stran. <\/p>\n

Jak funguje DoH<\/h2>\n

\nNe\u017e p\u0159ejdeme k diskuzi o tom, pro\u010d se poskytovatel\u00e9 internetu a dal\u0161\u00ed \u00fa\u010dastn\u00edci trhu stav\u00ed za nebo proti DNS over HTTPS, kr\u00e1tce si objasn\u00edme jeho principy fungov\u00e1n\u00ed.<\/p>\n

V p\u0159\u00edpad\u011b DoH je dotaz na ur\u010den\u00ed IP adresy zapouzd\u0159en do HTTPS provozu. Pot\u00e9 putuje na HTTP server, kde je zpracov\u00e1n pomoc\u00ed API. Zde je p\u0159\u00edklad dotazu z RFC 8484 (str.6<\/a><\/noindex>):<\/p>\n

   :method = GET\n   :scheme = https\n   :authority = dnsserver.example.net\n   :path = \/dns-query?\n           dns=AAABAAABAAAAAAAAAWE-NjJjaGFyYWN0ZXJsYWJl\n           bC1tYWtlcy1iYXNlNjR1cmwtZGlzdGluY3QtZnJvbS1z\n           dGFuZGFyZC1iYXNlNjQHZXhhbXBsZQNjb20AAAEAAQ\n   accept = application\/dns-message\n<\/code><\/pre>\n
\nT\u00edmto zp\u016fsobem je DNS provoz skryt v HTTPS provozu. Klient a server komunikuj\u00ed na standardn\u00edm portu 443. V\u00fdsledkem jsou anonymn\u00ed dotazy na syst\u00e9m dom\u00e9nov\u00fdch jmen.<\/p>\n
Pro\u010d jej neuzn\u00e1vaj\u00ed<\/h2>\n
\nOdp\u016frci DNS over HTTPS , \u017ee pokud Google, Apple, Facebook a makl\u00e9\u0159i dat maj\u00ed povoleno prod\u00e1vat osobn\u00ed \u00fadaje klient\u016f bez jejich souhlasu, m\u011bla by m\u00edt tuto mo\u017enost i internetov\u00e1 poskytovatel\u00e9. Av\u0161ak stoj\u00ed za zm\u00ednku, \u017ee na feder\u00e1ln\u00ed \u00farovni<\/a><\/noindex>, \u017ee nov\u00fd protokol sn\u00ed\u017e\u00ed bezpe\u010dnost p\u0159ipojen\u00ed. Podle slov<\/a><\/noindex> Paula Vixieho, \u010dlena t\u00fdmu v\u00fdvoj\u00e1\u0159\u016f DNS, budou m\u00edt administr\u00e1to\u0159i syst\u00e9m\u016f pot\u00ed\u017ee s blokov\u00e1n\u00edm potenci\u00e1ln\u011b \u0161kodliv\u00fdch webov\u00fdch str\u00e1nek. B\u011b\u017en\u00ed u\u017eivatel\u00e9 t\u00edm ztrat\u00ed mo\u017enost nastavit podm\u00ednkovou rodi\u010dovskou kontrolu v prohl\u00ed\u017ee\u010d\u00edch.<\/p>\n
N\u00e1zor Paula sd\u00edlej\u00ed poskytovatel\u00e9 internetu ve Velk\u00e9 Brit\u00e1nii. Legislativa zem\u011b nuk\u00e1\u017ee<\/a><\/noindex> jim blokovat zdroje s nepovolen\u00fdm obsahem. Ale podpora DoH v prohl\u00ed\u017ee\u010d\u00edch zt\u011b\u017euje \u00fakol filtrov\u00e1n\u00ed provozu. Mezi kritiky nov\u00e9ho protokolu pat\u0159\u00ed tak\u00e9 Centrum vl\u00e1dn\u00ed komunikace Anglie (GCHQ<\/a><\/noindex>) a fond Internet Watch Foundation (IWF<\/a><\/noindex>), kter\u00fd vede registr blokovan\u00fdch zdroj\u016f.<\/p>\n
Na na\u0161em blogu na Habr:<\/b><\/p>\n