Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Improving DNS Privacy in Firefox

blog.nightly.mozilla.org

Post reply on HN
Print view View original

31–40 of 126 posts

Re: Improving DNS Privacy in Firefox

#31

Post by AlphaWeaver »

nbsd4life wrote: post #10

so, there's a concurrent post about how 1.1.1.1 had an outage. Does that mean web browsing won't work if that happens again? If not, does that mean it will fallback to unencrypted DNS if 1.1.1.1 is blocked? Making this a default means that Firefox users all bypass censorship in several countries, what do they expect to happen as a result of it? Firefox blocked? 1.1.1.1 blocked?

The post also notes that they won't be using the 1.1.1.1 address, though they'll be using Cloudflare. They'll likely be using another address which is less likely to be blocked.

Re: Improving DNS Privacy in Firefox

#32

Post by felipelemos »

Tharkun wrote: post #24

Why would I want my browser to do this? My browser should use the DNS configured by my OS -- in my case, a local, caching resolving NS. If I want to use some kind of DNS-over-HTTP I'll tell my OS to do it. I don't want my browser making DNS decisions for me. What am I missing?

As long it is opt in I don't see this as a decision issue.

Re: Improving DNS Privacy in Firefox

#33

Post by zzzcpan »

phicoh wrote: post #7
zzzcpan wrote: post #5

Earlier quoted context omitted.

Agreed, SNI and DNS need to be fixed together, not separately. And definitely without centralized services, like Cloudflare. Otherwise why not just go all the way with centralization and provide secure proxy for everyone in the browser.

They are completely independent protocols, with their own issues in this area. For the DNS, the specification for DNS over TLS is almost trivial. DNS over HTTPS is a bit more tricky because their are more possibilities, interactions with HTTPS, etc. But still not very hard from a protocol point of view. Operationally, DNS over TLS/HTTPS is mostly unknown. So it will take quite a bit of time before it is well know how…

They cannot be independent if actual privacy is concerned. At least sharing a threat model that touches both layers.

Re: Improving DNS Privacy in Firefox

#34

Post by orf »

Tharkun wrote: post #24

Why would I want my browser to do this? My browser should use the DNS configured by my OS -- in my case, a local, caching resolving NS. If I want to use some kind of DNS-over-HTTP I'll tell my OS to do it. I don't want my browser making DNS decisions for me. What am I missing?

Your OS does not support it.

Re: Improving DNS Privacy in Firefox

#36

Post by falcolas »

tialaramex wrote: post #22
st3fan wrote: post #13

Earlier quoted context omitted.

You have to start somewhere. Security is the sum of all parts. This is a small part, but it may have a big impact already. I'm sure SNI is next on the list, it will just take a bit longer. Until then, let's harden other parts of the infrastructure.

Encrypted SNI is very hard. The TLS working group agreed a problem statement, seeing out what should be achieved, but they haven't found any viable way forward on achieving that. If I'm in a city square and I want to tell Bob something, but I refuse to let anybody know that I want to communicate with Bob, it's hard to see what I can do. Bob has no way to know I'm even trying to contact him, so he can't help.

You yell "Hey, Zanizabo, call Fylnatis" at the top of your lungs. Zanizabo being a phrase encrypted such that only Bob knows you are talking to him, and Fylnatis is your similarly encrypted contact information.

Sure, scaling is harder, but it's not impossible.

Re: Improving DNS Privacy in Firefox

#37

Post by zzzcpan »

majewsky wrote: post #25
OptionX wrote: post #18

Could people in heavly-restricted regions, like China and such, access blocked sites if they use DoH to DNS outside the control of the censoring entity?

The censoring entity can still block the IPs of the services, but it's an additional difficulty (unless they're willing to block e.g. all of Cloudfront when someone hosts their website on S3).

They can't block something like domain fronting themselves, have to "ask" companies that host them to help. But they can easily block resolvers by IP, SNI, etc, if not already.

Re: Improving DNS Privacy in Firefox

#38

Post by cremp »

andrewaylett wrote: post #29
Tharkun wrote: post #24

Why would I want my browser to do this? My browser should use the DNS configured by my OS -- in my case, a local, caching resolving NS. If I want to use some kind of DNS-over-HTTP I'll tell my OS to do it. I don't want my browser making DNS decisions for me. What am I missing?

I, too, have a local caching resolver. And I'm unlikely to turn this on at the browser level, although I'm occasionally tempted to play with it in the resolver. But I strongly suspect we're in the minority and that something like this is the easiest -- and quite possibly the only -- way for many users to avoid DNS poisoning by ISPs.

Not just ISPs; those using DNS-based adblockers (pi-hole and the like) will be impacted too (from my understanding.)

Re: Improving DNS Privacy in Firefox

#39

Post by gnode »

tialaramex wrote: post #22
st3fan wrote: post #13

Earlier quoted context omitted.

You have to start somewhere. Security is the sum of all parts. This is a small part, but it may have a big impact already. I'm sure SNI is next on the list, it will just take a bit longer. Until then, let's harden other parts of the infrastructure.

Encrypted SNI is very hard. The TLS working group agreed a problem statement, seeing out what should be achieved, but they haven't found any viable way forward on achieving that. If I'm in a city square and I want to tell Bob something, but I refuse to let anybody know that I want to communicate with Bob, it's hard to see what I can do. Bob has no way to know I'm even trying to contact him, so he can't help.

> but I refuse to let anybody know that I want to communicate with Bob

That's not the problem though. You're not trying to stop an eavesdropper knowing you're communicating with a particular server, but rather which hostname you're talking to them as.

To extend the Bob analogy; you're not trying to hide that you're communicating with Bob, but that you're speaking to each other as members of Fight Club.

It's certainly not impossible, although overcoming issues of scaling or increased handshake round trips is a difficulty.

Re: Improving DNS Privacy in Firefox

#40

Post by j605 »

cerberusss wrote: post #27
Tharkun wrote: post #24

Why would I want my browser to do this? My browser should use the DNS configured by my OS -- in my case, a local, caching resolving NS. If I want to use some kind of DNS-over-HTTP I'll tell my OS to do it. I don't want my browser making DNS decisions for me. What am I missing?

Because at the moment, no major OS supports it.

dnscrypt-proxy (https://github.com/jedisct1/dnscrypt-proxy) supports all major platforms and checkout https://dnscrypt.info for more options.
Post reply on HN