Windows 10: Windows 10 will improve user privacy with DNS over HTTPS

Brink · Nov 19, 2019

Here in Windows Core Networking, we’re interested in keeping your traffic as private as possible, as well as fast and reliable. While there are many ways we can and do approach user privacy on the wire, today we’d like to talk about encrypted DNS. Why? Basically, because supporting encrypted DNS queries in Windows will close one of the last remaining plain-text domain name transmissions in common web traffic.

Providing encrypted DNS support without breaking existing Windows device admin configuration won't be easy. However, at Microsoft we believe that "we have to treat privacy as a human right. We have to have end-to-end cybersecurity built into technology."

We also believe Windows adoption of encrypted DNS will help make the overall Internet ecosystem healthier. There is an assumption by many that DNS encryption requires DNS centralization. This is only true if encrypted DNS adoption isn’t universal. To keep the DNS decentralized, it will be important for client operating systems (such as Windows) and Internet service providers alike to widely adopt encrypted DNS.

With the decision made to build support for encrypted DNS, the next step is to figure out what kind of DNS encryption Windows will support and how it will be configured. Here are our team's guiding principles on making those decisions:

Windows DNS needs to be as private and functional as possible by default without the need for user or admin configuration because Windows DNS traffic represents a snapshot of the user’s browsing history. To Windows users, this means their experience will be made as private as possible by Windows out of the box. For Microsoft, this means we will look for opportunities to encrypt Windows DNS traffic without changing the configured DNS resolvers set by users and system administrators.

Privacy-minded Windows users and administrators need to be guided to DNS settings even if they don't know what DNS is yet. Many users are interested in controlling their privacy and go looking for privacy-centric settings such as app permissions to camera and location but may not be aware of or know about DNS settings or understand why they matter and may not look for them in the device settings.

Windows users and administrators need to be able to improve their DNS configuration with as few simple actions as possible. We must ensure we don't require specialized knowledge or effort on the part of Windows users to benefit from encrypted DNS. Enterprise policies and UI actions alike should be something you only have to do once rather than need to maintain.

Windows users and administrators need to explicitly allow fallback from encrypted DNS once configured. Once Windows has been configured to use encrypted DNS, if it gets no other instructions from Windows users or administrators, it should assume falling back to unencrypted DNS is forbidden.

Based on these principles, we are making plans to adopt DNS over HTTPS (or DoH) in the Windows DNS client. As a platform, Windows Core Networking seeks to enable users to use whatever protocols they need, so we’re open to having other options such as DNS over TLS (DoT) in the future. For now, we're prioritizing DoH support as the most likely to provide immediate value to everyone. For example, DoH allows us to reuse our existing HTTPS infrastructure.

For our first milestone, we'll start with a simple change: use DoH for DNS servers Windows is already configured to use. There are now several public DNS servers that support DoH, and if a Windows user or device admin configures one of them today, Windows will just use classic DNS (without encryption) to that server. However, since these servers and their DoH configurations are well known, Windows can automatically upgrade to DoH while using the same server. We feel this milestone has the following benefits:

We will not be making any changes to which DNS server Windows was configured to use by the user or network. Today, users and admins decide what DNS server to use by picking the network they join or specifying the server directly; this milestone won’t change anything about that. Many people use ISP or public DNS content filtering to do things like block offensive websites. Silently changing the DNS servers trusted to do Windows resolutions could inadvertently bypass these controls and frustrate our users. We believe device administrators have the right to control where their DNS traffic goes.

Many users and applications that want privacy will start getting the benefits without having to know about DNS. In line with principle 1, the DNS queries become more private with no action from either apps or users. When both endpoints support encryption, there’s no reason to wait around for permission to use encryption!

We can start seeing the challenges in enforcing the line on preferring resolution failure to unencrypted fallback. In line with principle 4, this DoH use will be enforced so that a server confirmed by Windows to support DoH will not be consulted via classic DNS. If this preference for privacy over functionality causes any disruption in common web scenarios, we’ll find out early.

In future milestones, we'll need to create more privacy-friendly ways for our users to discover their DNS settings in Windows as well as make those settings DoH-aware. This will give users, device admins, and enterprise admins the ability to configure DoH servers explicitly.

Why announce our intentions in advance of DoH being available to Windows Insiders? With encrypted DNS gaining more attention, we felt it was important to make our intentions clear as early as possible. We don’t want our customers wondering if their trusted platform will adopt modern privacy standards or not.

If you are interested in joining the larger industry conversation about encrypting the DNS, check out one of the IETF working groups working with DNS (ABCD, Apps Doing DNS, DNSOP, DPRIVE) or the new Encrypted DNS Deployment Initiative.
Click to expand...

Source: https://techcommunity.microsoft.com/...S/ba-p/1014229

:)

P4-630 · Nov 19, 2019

Windows 10 Creators Update to Feature New Levels of Privacy Control

Users installing new versions of Windows will see a screen upon the configuration stage where they will be able to toggle privacy settings with a more refined filter than before, and your privacy settings will now (finally) carry over between major Windows updates, which means they won't reset without your knowledge.
Click to expand...

Just a tiny step closer before I'll upgrade to windows 10....

the54thvoid · Nov 19, 2019

Windows 10 DNS leak

Did you just manually set your DNS server to google DNS or similar?
Click to expand...

No, went with a different 3rd party suggestion. Works better. I'm reliant on others for my tech needs that way.

Ahhzz · Nov 19, 2019

Windows 10 Tweaks

As you may already know, Windows 10 (as well as Windows 8) allow you to log in with a valid Microsoft account, instead of creating a local account that only works on your machine. However, you may prefer to keep a local account for privacy reasons. If you do, though, some Windows 10 features—like Cortana—may not work. Despite the default behavior, the Windows 10 Store is not one of them. You can still log in to your Microsoft account for just the Store without switching to a full Microsoft account. The process, however, is not terribly obvious. To do so, follow these steps:

Launch the Store from your Start menu.

Click the user icon next to the search box.

Click “Sign-in” from the menu that appears.

Choose “Microsoft account” and log in like normal.

When the “Make it yours” box appears do not enter your password. Instead, click “Sign in to just this app instead.”

from Lifehacker

Windows 10: Windows 10 will improve user privacy with DNS over HTTPS

Windows 10 will improve user privacy with DNS over HTTPS

Windows 10 will improve user privacy with DNS over HTTPS

Windows 10 will improve user privacy with DNS over HTTPS

Windows 10 will improve user privacy with DNS over HTTPS - Similar Threads - improve user privacy

DNS over HTTPS in Windows 11

DNS over HTTPS in Windows 11

DNS over HTTPS on Windows 10

How to use the DNS over HTTPS privacy feature in Windows 11

Enabling DNS over https in Edge

DNS over HTTPS?

Firefox DNS over HTTPS rollout begins for US users

Microsoft will integrate DNS over HTTPS in Windows 10

DNS over HTTPS with Firefox