Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Improving DNS Privacy in Firefox

blog.nightly.mozilla.org

Post reply on HN
Print view View original

1–10 of 126 posts

Re: Improving DNS Privacy in Firefox

#5

Post by zzzcpan »

gnode wrote: post #4

There seems to be little point of doing this, in my opinion, when SNI doesn't secure the hostname.

Agreed, SNI and DNS need to be fixed together, not separately. And definitely without centralized services, like Cloudflare. Otherwise why not just go all the way with centralization and provide secure proxy for everyone in the browser.

Re: Improving DNS Privacy in Firefox

#6

Post by userbinator »

Because there is no encryption, other devices along the way might collect (or even block or change) this data too.

...which is sometimes very desirable[1][2][3]. I get the whole "more security!" movement, but also feel like it's just contributing to turning general-purpose computers into locked-down media consumption devices.

[1] https://pi-hole.net/

[2] https://en.wikipedia.org/wiki/Proxomitron

[3] https://news.ycombinator.com/item?id=17196888

Re: Improving DNS Privacy in Firefox

#7

Post by phicoh »

zzzcpan wrote: post #5
gnode wrote: post #4

There seems to be little point of doing this, in my opinion, when SNI doesn't secure the hostname.

Agreed, SNI and DNS need to be fixed together, not separately. And definitely without centralized services, like Cloudflare. Otherwise why not just go all the way with centralization and provide secure proxy for everyone in the browser.

They are completely independent protocols, with their own issues in this area.

For the DNS, the specification for DNS over TLS is almost trivial. DNS over HTTPS is a bit more tricky because their are more possibilities, interactions with HTTPS, etc. But still not very hard from a protocol point of view.

Operationally, DNS over TLS/HTTPS is mostly unknown. So it will take quite a bit of time before it is well know how to actually run that as a service at scale.

Encrypting the SNI in TLS is mostly the other way around. Fixing that has significant impact on the protocol.

There is no point in making very complex changes in TLS, which is already a tricky protocol without the DNS community committing to provide DNS over TLS/HTTPS at scale.

At the same time, securing traffic between a DNS stub resolver and the recursive resolver prevents are lot of middle box issues (but also creates a completely new set of issues). So it is worth deploying the even if TLS still leaks the SNI.

Re: Improving DNS Privacy in Firefox

#9

Post by lima »

userbinator wrote: post #6

Because there is no encryption, other devices along the way might collect (or even block or change) this data too. ...which is sometimes very desirable[1][2][3]. I get the whole "more security!" movement, but also feel like it's just contributing to turning general-purpose computers into locked-down media consumption devices. [1] https://pi-hole.net/ [2] https://en.wikipedia.org/wiki/Proxomitron [3] https://news.ycom…

Important for intrusion detection in locked-down enterprise environments, too. But you can still inspect TLS handshakes, it's just a lot more work...

Re: Improving DNS Privacy in Firefox

#10

Post by nbsd4life »

so, there's a concurrent post about how 1.1.1.1 had an outage. Does that mean web browsing won't work if that happens again? If not, does that mean it will fallback to unencrypted DNS if 1.1.1.1 is blocked?

Making this a default means that Firefox users all bypass censorship in several countries, what do they expect to happen as a result of it? Firefox blocked? 1.1.1.1 blocked?

Post reply on HN