Hide the user agent in DoH requests to be more anonymous.

[PeterDaveHello]

Recently, I found that dnscrypt-proxy is using the user agent dnscrypt-proxy, to those DNS-over-HTTPS servers, iOS and Firefox are both using empty user agent string.

Just wondering if you'd like to use an empty user agent string here to make the DNS requests more anonymous? Would like to send a pull request if it's acceptable, thanks!

[ghost]

Good idea. I guess if you only remove it for DoH and keep it for DNSCrypt-queries Frank might accepts it.

[jedisct1]

It can be removed, but I found it convenient for debugging. It doesn't leak any personal information either.

[jedisct1]

The DNSCrypt protocol doesn't allow including any extra information beyond the DNS query. Neither does Anonymized DNSCrypt.

[PeterDaveHello]

Yeah, it doesn't contain any personal info, just would be part of fingerprinting to profile a user and the behavior of the user. For the debugging purpose, maybe could have a debug mode? I guess at this moment, users using DoH, especially using dnscrypt-proxy, would like to keep privacy more :)

[PeterDaveHello]

@jedisct1 do you mind me sending a pull request to remove it?

[PeterDaveHello]

I just made a very tiny patch here for a little bit privacy enhancement: PeterDaveHello@8b141a9

[PeterDaveHello]

Just another point I'm not sure, dnscrypt-proxy also sends query string body_hash in the requests, didn't find other DoH client's do the same yet, it'll be part of the anonymous if it's a unique behavior. @jedisct1 would you like to give us some comments?

[PeterDaveHello]

@jedisct1 for those servers doesn't support the GET method, does body_hash still make sense? Does dnscrypt-proxy try http GET first, and use POST for those who don't support http GET? (doesn't look like so)

[jedisct1]

Yes! body_hash is specifically useful for POST. Fastly caches resources based on the URL and some headers, not the POST content. It's possible to handle the content, but that requires custom code, is slower and more expensive. With default settings, things appear to work during testing, except that people may end up seeing other people's traffic.

Cloudflare doesn't allow caching POST requests at all except with Cloudflare Workers, hence GET being preferred. GET requests are also less likely to be compressed, which improves security.

[PeterDaveHello]

Sounds like Fastly implemented a different cache policy? Not sure there are too many CDN or proxy cache normal POST requests.

[jedisct1]

They have this notion of cache keys. A cache key is a hash of whatever you want from the HEAD portion of the request. Other CDNs probably work in a similar way. POST queries can be cached if the method is not part of the hash. But then you still need something to make the distinction between different queries.

I've no idea how to include the POST query content with nginx either. Having that hash solves the problem without having to worry about it.

doh-server adds HTTP caching headers based on the DNS records TTL, so caching at CDN level is fine, the original TTL is respected.

[PeterDaveHello]

Cool, I will try to figure it out, might not understand enough yet 😅