Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Improving DNS Privacy in Firefox

blog.nightly.mozilla.org

Post reply on HN
Print view View original

21–30 of 126 posts

Re: Improving DNS Privacy in Firefox

#21

Post by Seipaho8 »

arghwhat wrote: post #14
nbsd4life wrote: post #10

so, there's a concurrent post about how 1.1.1.1 had an outage. Does that mean web browsing won't work if that happens again? If not, does that mean it will fallback to unencrypted DNS if 1.1.1.1 is blocked? Making this a default means that Firefox users all bypass censorship in several countries, what do they expect to happen as a result of it? Firefox blocked? 1.1.1.1 blocked?

This isn't any different from if your normal DNS server is blocked, and 1.1.1.1 is not the only encrypted DNS provider. If whatever DNS you use doesn't work, then you cannot resolve any new domain names until you change to another DNS server or it gets fixed. Recently used domains will be cached in will thus still work.

> Recently used domains will be cached in will thus still work.

Except for the many domains that set very low TTLs for load balancing and cloudiness reasons.

Re: Improving DNS Privacy in Firefox

#22

Post by tialaramex »

st3fan wrote: post #13
gnode wrote: post #4

There seems to be little point of doing this, in my opinion, when SNI doesn't secure the hostname.

You have to start somewhere. Security is the sum of all parts. This is a small part, but it may have a big impact already. I'm sure SNI is next on the list, it will just take a bit longer. Until then, let's harden other parts of the infrastructure.

Encrypted SNI is very hard. The TLS working group agreed a problem statement, seeing out what should be achieved, but they haven't found any viable way forward on achieving that.

If I'm in a city square and I want to tell Bob something, but I refuse to let anybody know that I want to communicate with Bob, it's hard to see what I can do. Bob has no way to know I'm even trying to contact him, so he can't help.

Re: Improving DNS Privacy in Firefox

#23

Post by arghwhat »

userbinator wrote: post #6

Because there is no encryption, other devices along the way might collect (or even block or change) this data too. ...which is sometimes very desirable[1][2][3]. I get the whole "more security!" movement, but also feel like it's just contributing to turning general-purpose computers into locked-down media consumption devices. [1] https://pi-hole.net/ [2] https://en.wikipedia.org/wiki/Proxomitron [3] https://news.ycom…

#1 and #2 are not hindered by "more security". They're local proxies you set up and decide to trust. In a proper setup, you would use encrypted communication towards that proxy, and that proxy would use encrypted communication towards the appropriate server, maintaining privacy and authentication while implementing their purpose. Both of them are a bit of a hack, though, as this really belongs in the client application.

More generally, more security does not stop any legitimate use-cases. You just chose to extend your trust.

#3 doesn't have anything to do with the subject at hand.

Network interception is never something a user wants, and does not implement additional security. It's common in enterprise and banking environments for all the wrong reasons (enough that these industries were trying to harm TLS1.3 when they realized that the increased security was troublesome). Such a setup is by no means necessary, and due to there being Bad People in this world, the ability to do so is dangerous.

Repressive governments that wish to control or manipulate information is a very good example, and sacrificing silly enterprise politics is a very small price to pay to help the repressed. The result of There are quite a few places where this is the case, even though it might be hard to imagine for someone in the west (despite filtering occurring in the west too, whenever the government dislikes a site).

Re: Improving DNS Privacy in Firefox

#24

Post by Tharkun »

Why would I want my browser to do this? My browser should use the DNS configured by my OS -- in my case, a local, caching resolving NS. If I want to use some kind of DNS-over-HTTP I'll tell my OS to do it. I don't want my browser making DNS decisions for me. What am I missing?

Re: Improving DNS Privacy in Firefox

#25

Post by majewsky »

OptionX wrote: post #18

Could people in heavly-restricted regions, like China and such, access blocked sites if they use DoH to DNS outside the control of the censoring entity?

The censoring entity can still block the IPs of the services, but it's an additional difficulty (unless they're willing to block e.g. all of Cloudfront when someone hosts their website on S3).

Re: Improving DNS Privacy in Firefox

#26

Post by Proven »

Tharkun wrote: post #24

Why would I want my browser to do this? My browser should use the DNS configured by my OS -- in my case, a local, caching resolving NS. If I want to use some kind of DNS-over-HTTP I'll tell my OS to do it. I don't want my browser making DNS decisions for me. What am I missing?

You’re missing the BS PR - Mozilla is trying to “stay relevant”. While they harvest and aggregate user data.

Your actual privacy is of secondary concern.

Re: Improving DNS Privacy in Firefox

#27

Post by cerberusss »

Tharkun wrote: post #24

Why would I want my browser to do this? My browser should use the DNS configured by my OS -- in my case, a local, caching resolving NS. If I want to use some kind of DNS-over-HTTP I'll tell my OS to do it. I don't want my browser making DNS decisions for me. What am I missing?

Because at the moment, no major OS supports it.

Re: Improving DNS Privacy in Firefox

#28

Post by dao- »

Tharkun wrote: post #24

Why would I want my browser to do this? My browser should use the DNS configured by my OS -- in my case, a local, caching resolving NS. If I want to use some kind of DNS-over-HTTP I'll tell my OS to do it. I don't want my browser making DNS decisions for me. What am I missing?

You're missing that you can still configure the browser to your needs? You seem to be a power user so you can do this. Mozilla cares about average users too, and doesn't have control over OS defaults that may not be optimal for average users' privacy.

Re: Improving DNS Privacy in Firefox

#29

Post by andrewaylett »

Tharkun wrote: post #24

Why would I want my browser to do this? My browser should use the DNS configured by my OS -- in my case, a local, caching resolving NS. If I want to use some kind of DNS-over-HTTP I'll tell my OS to do it. I don't want my browser making DNS decisions for me. What am I missing?

I, too, have a local caching resolver. And I'm unlikely to turn this on at the browser level, although I'm occasionally tempted to play with it in the resolver.

But I strongly suspect we're in the minority and that something like this is the easiest -- and quite possibly the only -- way for many users to avoid DNS poisoning by ISPs.

Re: Improving DNS Privacy in Firefox

#30

Post by zzzcpan »

tialaramex wrote: post #22
st3fan wrote: post #13

Earlier quoted context omitted.

You have to start somewhere. Security is the sum of all parts. This is a small part, but it may have a big impact already. I'm sure SNI is next on the list, it will just take a bit longer. Until then, let's harden other parts of the infrastructure.

Encrypted SNI is very hard. The TLS working group agreed a problem statement, seeing out what should be achieved, but they haven't found any viable way forward on achieving that. If I'm in a city square and I want to tell Bob something, but I refuse to let anybody know that I want to communicate with Bob, it's hard to see what I can do. Bob has no way to know I'm even trying to contact him, so he can't help.

> If I'm in a city square and I want to tell Bob something, but I refuse to let anybody know that I want to communicate with Bob, it's hard to see what I can do

You can tell a few people near you that "someone" wants to tell something to Bob and an answer from Bob. They tell people near them and so on, until it reaches Bob. He then answers and tells people near him, they tell those who told them and so on, until the answer is delivered back to you. And since no one can hear what people tell each other, no one can assume that "someone" is you and not someone else talking to you in secrecy, many connections away from you.

Think overlay peer-to-peer networks.

But the minimum viable threat model is ISP appliances that do classification and identification of traffic, both passively and actively, like trying to probe for protocols and hostnames. If you are not targeting them, you are effectively doing nothing, but pretend privacy PR. Which is the case with Cloudflare's DNS.

Post reply on HN