Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Improving DNS Privacy in Firefox

blog.nightly.mozilla.org

Post reply on HN
Print view View original

81–90 of 126 posts

Re: Improving DNS Privacy in Firefox

#81

Post by patrickmcmanus »

gnode wrote: post #75
sanxiyn wrote: post #68

Earlier quoted context omitted.

If you want UDP, DNS over DTLS also exists.

Doesn't really save you anything; DTLS still involves a connection with a handshake, so you have increased latency and memory overhead. Its usefulness is in low latency transport where head-of-line blocking would be detrimental (e.g. real-time streaming video; phone calls; VPNs). DNSCurve, by comparison, is connection-less -- meaning no handshake latency, no connection overhead, and denial-of-service resilience.

DoH on QUIC is probably the end result

Re: Improving DNS Privacy in Firefox

#82

Post by Lennie »

KaiserPro wrote: post #59

No, no no and no. It does not improve privacy, it just puts all your DNS history in the hands of one provider. Not only that it adds latency for no real gain. HTTP is a terrible protocol for anything time sensitive. (its a fairly bad protocol for anything fast or efficient full stop.) The better way to do this is encourage/provide DNSsec (so we know that a provider is who they say they are) and then encrypt dns queri…

I think why Mozilla still doesn't want DNSSEC is because when it breaks it breaks in a big way. And DNSSEC still hasn't got their root key (ksk) rollover process in place. Which is something they would need to properly support to make sure nothing breaks.

On the transport front. Eventually I would expect them to use HTTP/2 over UDP/DTLS which is actually pretty darn efficient. It's the IETF standard based on Google QUIC. Which will probably be called QUIC. Because the IETF workgroup is called QUIC.

Re: Improving DNS Privacy in Firefox

#83

Post by patrickmcmanus »

sanxiyn wrote: post #72
Moru wrote: post #65

Earlier quoted context omitted.

And what happens when I stay at a hotel and need to access the login page of the local lan?

Firefox automatically disables DoH if captive portal is detected.

not in hard-fail mode; but generally yes.

Re: Improving DNS Privacy in Firefox

#84

Post by Lennie »

mike-cardwell wrote: post #63

Imagine if this became the default with only Cloudflare as a provider. Firefox users in countries all over the World will not be able to visit a website locally or anywhere else without asking an American corporation for the IP address first. I mean. I can't believe that there are going to be a lot of alternative providers. It's going to be an expensive service to provide. Especially when one of the requirements is t…

Google will be an other, I would expect. Google is working on this standard to build it into Android.

Re: Improving DNS Privacy in Firefox

#85

Post by fanf2 »

gnode wrote: post #66
sanxiyn wrote: post #62

Earlier quoted context omitted.

DNS over TLS exists as well. DNS over HTTPS is just another format for DNS over TLS.

In my opinion we don't want TLS at all, but rather a UDP based protocol, so that the latency advantages of DNS aren't lost. I believe DNSCurve solves this.

DNS-over-TLS with a persistent connection to the resolver can be more efficient than UDP-based protocols since you can put multiple queries or answers into one packet. DNS supports pipelined queries and out-of-order responses over TCP and TLS so there isn’t a head-of-line blocking problem.

Re: Improving DNS Privacy in Firefox

#86

Post by 0xffff2 »

orf wrote: post #34
Tharkun wrote: post #24

Why would I want my browser to do this? My browser should use the DNS configured by my OS -- in my case, a local, caching resolving NS. If I want to use some kind of DNS-over-HTTP I'll tell my OS to do it. I don't want my browser making DNS decisions for me. What am I missing?

Your OS does not support it.

That doesn't mean it's suddenly in scope for a browser. The solution would be for the OS to support it, not for the browser to do an end-run around the OS's DNS settings.

Re: Improving DNS Privacy in Firefox

#87

Post by myf01d »

While this is much better imo than just sending over DNS protocol as eliminates old DNS attacks like spoofing, it won't make users _practically_ any safer since all subsequent TCP requests have the resolved IP in the IP packet. But like I said, it's still better than the default protocol.

Re: Improving DNS Privacy in Firefox

#88

Post by jiveturkey »

KaiserPro wrote: post #59

No, no no and no. It does not improve privacy, it just puts all your DNS history in the hands of one provider. Not only that it adds latency for no real gain. HTTP is a terrible protocol for anything time sensitive. (its a fairly bad protocol for anything fast or efficient full stop.) The better way to do this is encourage/provide DNSsec (so we know that a provider is who they say they are) and then encrypt dns queri…

I can hear the product managers at cloudflare maniacally laughing their heads off right now.

A side-effect if you're being generous, or primary motive if you're being cynical, of 1.1.1.1 is that CF acquires all the geo info at the expense of everyone else. This puts CF in a particularly advantageous position over DIY GSLB (pushing content providers into using CF), as well as other CDNs of course. Not only that, the privacy policy promises they will not share resolver data with any other party! lol of course they won't -- why would they give up this competitive advantage! It means they are guaranteeing they will not pass on RFC7871 ECS info.

Of course DNS-based geo isn't perfect, and there are other solutions (js pixel timing, anycast, others) but using DNS is still pretty major. Combining it with anycast, as CF does, is surely powerful.

Getting FF to use 1.1.1.1 so that "user's don't have to" is incredible. Someone at CF is getting a huge bonus this year.

Re: Improving DNS Privacy in Firefox

#89

Post by Seipaho8 »

zamadatix wrote: post #61
Seipaho8 wrote: post #3

> While sophisticated users can turn to cloud-based “open resolvers” Sophisticated users run their own resolvers instead of relying on unverifiable promises from for-profit entities.

And how do these sophisticated users populate their own revolvers if not plain DNS, DNS over TLS, or DNS over HTTPS? There is no such thing as hosting a globally distributed database from your house.

The point is that they are not a single central entity easily siphoned off by an org that'll sell the information for profit.

Re: Improving DNS Privacy in Firefox

#90

Post by orf »

0xffff2 wrote: post #86
orf wrote: post #34

Earlier quoted context omitted.

Your OS does not support it.

That doesn't mean it's suddenly in scope for a browser. The solution would be for the OS to support it, not for the browser to do an end-run around the OS's DNS settings.

It is exactly in scope for a browser. The whole point is to stop your ISP getting your browsing history.

Sure, would be nice for the OS to support it, but until that future point why wait.

Post reply on HN