Category Archives: Web

Minimal dnscrypt-proxy DoH Config

dnscrypt-proxy has a lot of features and can be intimidating to setup. Issues range from understanding what dnscrypt is to how to pick list of sources to understanding what a stamp is.

While it’s not a recommended configuration, I wanted to setup a very simple/minimal dnscrypt-proxy that uses a few well known DoH servers.

Steps

  1. Install dnscrypt-proxy.
  2. Edit the configuration file (/etc/dnscrypt-proxy.toml or /etc/dnscrypt-proxy/dnscrypt-proxy.toml on Linux/UNIX systems).
    1. Delete or comment out server_names
      # server_names = ['scaleway-fr', 'google', 'yandex', 'cloudflare']
    2. Delete or comment out the entries under [sources]
      [sources]
    3. If present, ensure doh_servers = true
    4. Depending on the servers you configure, you might need to edit require_dnssec, require_nolog, and require_nofilter to be compatible with the servers. Since I’m explicitly configuring a small list of servers, it’s easier to turn off all restrictions
      require_* = false
    5. Add your desired servers to the [static] section (for this you should get a basic understanding of stamps)
      static entry
      Note: each static entry requires a unique name.

Stamps

While you don’t need a detailed understanding of stamps, it’s good to have a basic understanding; so you can audit the servers you are adding and you can add custom servers.

A stamp is just dnscrypt-proxy’s format for encoding all relevant parameters for a DNS server. For a DoH server, that consists of:

  • Properties (required) – flags indicating if the server is DNSSEC capable, logs queries, or filters results.
  • IP address (optional) – If an IP address is not provided the Host will be used.
    Note: The spec says the port (if not 443) should be provided in this field; however, the public lists and the stamp calculator include the port in the Host field
  • Host (required) – self-explanatory
  • Hashes (optional) – doesn’t appear to be working. This should allow trusting custom cert chains; however, dnscrypt-proxy is only using the platform’s trust store to validate certificate chains.
  • Path (required) – for DoH servers this is generally “/dns-query”. This should be well documented with the information about each DoH server.

You have three options:

  1. Generate your own stamps using the stamp calculator
  2. Use stamps below
  3. Copy stamps from a public list:

For any pre-generated stamps, you can check the contents by pasting the stamp into to Stamp field of the stamp calculator.

DoH Server Stamps

Some stamps for common DoH servers. While I have verified these stamps work, I make no claim to the accuracy of the properties.

Quad9

Ref: https://quad9.net/doh-quad9-dns-servers/

Properties: DNSSEC, Filter (malicious domain blocking), No Logging (limited per the Quad9 FAQ):

# Quad9 Secured 9.9.9.9 DoH
[static.'quad9-doh-ipv4-filter-pri-1']
stamp = 'sdns://AgMAAAAAAAAABzkuOS45LjkADmRuczkucXVhZDkubmV0Ci9kbnMtcXVlcnk'

# Quad9 Secured 149.112.112.9 DoH
[static.'quad9-doh-ipv4-filter-pri-2']
stamp = 'sdns://AgMAAAAAAAAADTE0OS4xMTIuMTEyLjkADmRuczkucXVhZDkubmV0Ci9kbnMtcXVlcnk'

# Quad9 Secured 2620:fe::9 DoH
[static.'quad9-doh-ipv6-filter-pri-1']
stamp = 'sdns://AgMAAAAAAAAADFsyNjIwOmZlOjo5XQAOZG5zOS5xdWFkOS5uZXQKL2Rucy1xdWVyeQ'

# Quad9 Secured 2620:fe::fe:9 DoH
[static.'quad9-doh-ipv6-filter-pri-2']
stamp = 'sdns://AgMAAAAAAAAAD1syNjIwOmZlOjpmZTo5XQAOZG5zOS5xdWFkOS5uZXQKL2Rucy1xdWVyeQ'

Properties: DNSSEC, No Filter, No Logging (limited per the Quad9 FAQ):

# Quad9 Unsecured 9.9.9.10 DoH
[static.'quad9-doh-ipv4-nofilter-pri-1']
stamp = 'sdns://AgMAAAAAAAAACDkuOS45LjEwAA9kbnMxMC5xdWFkOS5uZXQKL2Rucy1xdWVyeQ'

# Quad9 Unsecured 149.112.112.10 DoH
[static.'quad9-doh-ipv4-nofilter-pri-2']
stamp = 'sdns://AgMAAAAAAAAADjE0OS4xMTIuMTEyLjEwAA9kbnMxMC5xdWFkOS5uZXQKL2Rucy1xdWVyeQ'

# Quad9 Unsecured 2620:fe::10 DoH
[static.'quad9-doh-ipv6-nofilter-pri-1']
stamp = 'sdns://AgMAAAAAAAAADVsyNjIwOmZlOjoxMF0AD2RuczEwLnF1YWQ5Lm5ldAovZG5zLXF1ZXJ5'

# Quad9 Unsecured 2620:fe::fe:10 DoH
[static.'quad9-doh-ipv6-nofilter-pri-2']
stamp = 'sdns://AgMAAAAAAAAAEFsyNjIwOmZlOjpmZToxMF0AD2RuczEwLnF1YWQ5Lm5ldAovZG5zLXF1ZXJ5'

Cloudflare DNS

Ref: https://developers.cloudflare.com/1.1.1.1/1.1.1.1-for-families

Properties: DNSSEC, Filter (malicious content blocking), No Logging (limited per Privacy):

# Cloudflare Security 1.1.1.2 DoH
[static.'cloudflare-doh-ipv4-filter-pri-1']
stamp = 'sdns://AgMAAAAAAAAABzEuMS4xLjIAG3NlY3VyaXR5LmNsb3VkZmxhcmUtZG5zLmNvbQovZG5zLXF1ZXJ5'

# Cloudflare Security 1.0.0.2 DoH
[static.'cloudflare-doh-ipv4-filter-pri-2']
stamp = 'sdns://AgMAAAAAAAAABzEuMC4wLjIAG3NlY3VyaXR5LmNsb3VkZmxhcmUtZG5zLmNvbQovZG5zLXF1ZXJ5'

# Cloudflare Security 2606:4700:4700::1112 DoH
[static.'cloudflare-doh-ipv6-filter-pri-1']
stamp = 'sdns://AgMAAAAAAAAAFlsyNjA2OjQ3MDA6NDcwMDo6MTExMl0AG3NlY3VyaXR5LmNsb3VkZmxhcmUtZG5zLmNvbQovZG5zLXF1ZXJ5'

# Cloudflare Security 2606:4700:4700::1002 DoH
[static.'cloudflare-doh-ipv6-filter-pri-2']
stamp = 'sdns://AgMAAAAAAAAAFlsyNjA2OjQ3MDA6NDcwMDo6MTAwMl0AG3NlY3VyaXR5LmNsb3VkZmxhcmUtZG5zLmNvbQovZG5zLXF1ZXJ5'

Properties: DNSSEC, No Filter, No Logging (limited per Privacy):

# Cloudflare DNS 1.1.1.1 DoH
[static.'cloudflare-doh-ipv4-nofilter-pri-1']
stamp = 'sdns://AgMAAAAAAAAABzEuMS4xLjEAEmNsb3VkZmxhcmUtZG5zLmNvbQovZG5zLXF1ZXJ5'

# Cloudflare DNS 1.0.0.1 DoH
[static.'cloudflare-doh-ipv4-nofilter-pri-2']
stamp = 'sdns://AgMAAAAAAAAABzEuMC4wLjEAEmNsb3VkZmxhcmUtZG5zLmNvbQovZG5zLXF1ZXJ5'

# Cloudflare DNS 2606:4700:4700::1111 DoH
[static.'cloudflare-doh-ipv6-nofilter-pri-1']
stamp = 'sdns://AgMAAAAAAAAAFlsyNjA2OjQ3MDA6NDcwMDo6MTExMV0AEmNsb3VkZmxhcmUtZG5zLmNvbQovZG5zLXF1ZXJ5'

# Cloudflare DNS 2606:4700:4700::1001 DoH
[static.'cloudflare-doh-ipv6-nofilter-pri-2']
stamp = 'sdns://AgMAAAAAAAAAFlsyNjA2OjQ3MDA6NDcwMDo6MTAwMV0AEmNsb3VkZmxhcmUtZG5zLmNvbQovZG5zLXF1ZXJ5'

Google DNS

Ref: https://developers.google.com/speed/public-dns/docs/doh

Properties: DNSSEC, No Filter, Logging (generally full logs are only temporary per the Privacy Statement):

# Google DNS 8.8.8.8 DoH
[static.'google-doh-ipv4-nofilter-1']
stamp = 'sdns://AgMAAAAAAAAABzguOC44LjgACmRucy5nb29nbGUKL2Rucy1xdWVyeQ'

# Google DNS 8.8.4.4 DoH
[static.'google-doh-ipv4-nofilter-2']
stamp = 'sdns://AgMAAAAAAAAABzguOC40LjQACmRucy5nb29nbGUKL2Rucy1xdWVyeQ'

# Google DNS 2001:4860:4860::8888 DoH
[static.'google-doh-ipv6-nofilter-1']
stamp = 'sdns://AgMAAAAAAAAAFlsyMDAxOjQ4NjA6NDg2MDo6ODg4OF0ACmRucy5nb29nbGUKL2Rucy1xdWVyeQ'

# Google DNS 2001:4860:4860::8844 DoH
[static.'google-doh-ipv6-nofilter-2']
stamp = 'sdns://AgMAAAAAAAAAFlsyMDAxOjQ4NjA6NDg2MDo6ODg0NF0ACmRucy5nb29nbGUKL2Rucy1xdWVyeQ'

Enabling the Google Advanced Protection Program with iOS

Required

Setup

  1. Plug the Bluetooth bridge into your computer. Wait for the Yellow LED to stop blinking. If it does not stop blinking (indicating a problem installing the drivers), try a different computer
  2. In Chrome, add the DIGIPASS SecureClick Manager app to Chrome
  3. Launch DIGIPASS SecureClick Manager and click "Add SecureClick"
  4. Follow the instructions and enter PIN "000000" when prompted
  5. Enable the Advanced Protection Program and pair your U2F tokens. The initial setup only allows the configuration of two tokens, but additional tokens can be added the normal way (My Account → Sign-in & security → 2-Step Verification → ADD SECURITY KEY)
  6. On your iOS device, launch the Smart Lock App
  7. Login to your Google account
  8. When prompted to pair your security key, hold down the on the SecureClick until the LEDs flash red, select SClick U2F in Smart Lock, and enter PIN "000000".
  9. Your iOS device is now authenticated and your SecureClick is now paired as a BLE device
  10. Open your Google apps, and enable the account you authenticated in Smart Lock

Notes

You do not need to install the DIGIPASS Secure Click Manager app on your iOS devices. The Google Smart Lock app will handle the pairing.

Enabling Advanced Proteciton clears you 2 Step Verificaiotn methods, so you must re-enroll andy additional security keys.

The only feature I miss is contact syncing.

I had problems using the Bluetooth bridge on my macOS computers for initial setup, but it has started working on High Sierra (10.13.2) and El Capitan (10.11.6).

Chripify Permissions

I was going to link my Marriott Rewards account to my Twitter and Instagram accounts to take advantage of the #REWARDSPOINTS social promotions and start taking advantage of the Extra Point Sunday Twitter trivia, but Chipify is asking too much.

Chirpify Twitter PermissionsTwitter permissions requested:

  • Read Tweets from your timeline. – reasonable
  • See who you follow, and follow new people. – reasonable
  • Update your profile. – why do they want/need to be able to update my profile?
  • Post Tweets for you. – why do they want/need to be able to post tweets?
  • See your email address. – reasonable

Chirpify Instagram PermissionsInstagram permissions requested:

  • Access your basic information: Your media & profile info – reasonable
  • Access public content: Media & profile info of public users – reasonable
  • Comment on photos: Post and delete comments on your behalf – why do they want/need to be able to comment?
  • Follow accounts: Follow and unfollow accounts on your behalf. – why do they want/need to follow/unfollow accounts?

Maximize LastPass Security with a Yubikey

While LastPass is very convenient and I want to be as cautious as possible when putting all of my eggs (passwords) in one basket. I have two factor authentication enabled has native YubiKey support as a second authentication factor

Protections:

  • LastPass Premium – alows simple use of unique passwords for each account
  • Typed/Remembered Password – protects from a stolen YubiKey allowing access to your vault
  • YubiKey OTP – Prevents a keylogger from allowing access to your LastPass Vault
  • YubiKey Static Password – ensures your Master Password is strong enough to prevent an attacker from brute forcing your password if they are able dump the LastPass database

What you need:

Setup Your YubiKey

YubiKey Programming Dialog

YubiKey Programming Dialog (not my real password)

  1. Launch the YubiKey Personalization Tool
  2. Select "Static Password Mode"
  3. Click the "Scan Code" button
  4. Select:
    • Configuration Slot 2
    • Program Multiple YubiKeys
    • Keyboard: US Keyboard
  5. Enter a stong password
  6. Insert each YubiKey, and click "Write Configuration"

Configure LastPass

Add YubiKeys to LastPass

Add YubiKeys to LastPass

  1. Open your LastPass Vault and Click Account Settings
  2. If you have not already configured your Yubikey as a second factor
    1. Click Multifactor Options, Scroll down to yubico, Click the pencil
    2. Set Enabled to Yes
    3. If you use iOS, you will want to set Permit Mobile Device Access to Allow, even though it is slightly less secure
    4. Pick which ever option you like for Permit Offline Access. Since you should only be loging in to LastPass from trusted computers, there not much of a security risk
  3. For each of your YubiKeys, put the cursor in a YubiKey box and press the button on the YubiKey
  4. When all of your YubiKeys have been entered, click Update
  5. Under the General tab, Change Master Password. For your new master password, type a good password (it can be your current password), followed by the password in your YubiKey. This is the only time you will have to type the YubiKey password.

Use

Now when you log into LastPass, you will type your password, insert your YubiKey, press the YubiKey button for 2 seconds. The YubiKey will type its portion of your master password and <enter>. LastPass will prompt you for your second factor. Use a short press on the YubiKey button to enter the YubiKey OTP code.

Mobile Protection

Since my iPhone SE is not compatible with YubiKeys, I had to take a different approach. This one phone is the only mobile device allowed to access my account (restricted by UUID). I authorized it using the Google Authenticator app before disabling Google Authenticator. My phone is protected by TouchID and the LastPass app is protected by a PIN. I store the "YubiKey portion" of my master password in NoteCrypt which is proteced by a different/shorter password.

NoteCrypt https://itunes.apple.com/tc/app/notecrypt-encrypted-notes/id897154139 which appears to be developed by Tom King (LinkedIn). While I can’t audit what NoteCrypt actually does, it says all of the right things about encryption and password based key derivation. It also costs $2.99, so there is an economic model that doesn’t involve ads or selling of user data. Finally, the developer’s LinkedIn profile looks respectable.

Manual Podcast Feed

I recently transition from using Downcast to Overcast. Unfortunately, I was pretty far behind listening to some of my podcasts, and Overcast was not able to "see" some old episodes of some podcasts (e.g. Security Now!, since TWiT only keeps the latest 10 episodes in the feed). I create a javascript/php Manual Podcast Feed Generator that allows for the quick creation of non-updateable podcast feeds. All of the information is encoded in the URL, so I don’t need to store data.