Improving DNS Privacy in Firefox • Hacker News Board

Re: Improving DNS Privacy in Firefox

#91

Post by Lennie » Fri, Jun 01, 2018, 3:47 PM UTC

tialaramex wrote: post #22

st3fan wrote: post #13

Earlier quoted context omitted.

You have to start somewhere. Security is the sum of all parts. This is a small part, but it may have a big impact already. I'm sure SNI is next on the list, it will just take a bit longer. Until then, let's harden other parts of the infrastructure.

Encrypted SNI is very hard. The TLS working group agreed a problem statement, seeing out what should be achieved, but they haven't found any viable way forward on achieving that. If I'm in a city square and I want to tell Bob something, but I refuse to let anybody know that I want to communicate with Bob, it's hard to see what I can do. Bob has no way to know I'm even trying to contact him, so he can't help.

Well, Diffie-Hellman Key Exchange does something similar.

Create a key out of nowhere for 2 parties to boot strap communicate safely. (obviously Diffie-Hellman doesn't solve all problems like knowing who you are actually talking to)

Re: Improving DNS Privacy in Firefox

#92

Post by Lennie » Fri, Jun 01, 2018, 3:51 PM UTC

sanxiyn wrote: post #48

josteink wrote: post #35

Core internet protocols like DNS over HTTP? Yet another step closer to HTTP/IP, I guess. Can’t say I condone it.

There is also DNS over TLS. DNS over HTTPS is basically DNS over TLS, but with workaround for port blocking.

With eventually a plan to allow for HTTP-caching, use of CDNs, pushing updates over HTTP/2 push, running it over QUIC, etc.

Re: Improving DNS Privacy in Firefox

#93

Post by Seipaho8 » Fri, Jun 01, 2018, 4:09 PM UTC

Tharkun wrote: post #24

Why would I want my browser to do this? My browser should use the DNS configured by my OS -- in my case, a local, caching resolving NS. If I want to use some kind of DNS-over-HTTP I'll tell my OS to do it. I don't want my browser making DNS decisions for me. What am I missing?

Because browsers follow a pattern of reinventing the wheel with different tradeoffs, primarily focusing on "secure" execution of untrusted code from the web. Just look at the stack of web technologies, they provide an ever-expanding set of abstractions and reinventions of what OSes already provide.

Re: Improving DNS Privacy in Firefox

#94

Post by peterwwillis » Fri, Jun 01, 2018, 4:11 PM UTC

The New Cabal of the Web: 1) CloudFlare, 2) Google, 3) Mozilla, 4) Let's Encrypt, 5) a smattering of contributing vendors, 6) internet-related standards bodies, and a few other orgs I'm forgetting or not familiar with. Pretty much the entire WWW is being shaped and controlled by this group. "Open Web" my ass.

The really insane thing to me is that a lot of this tech is being pushed with the argument that they need to get around "port blocking". Uh. These groups setting these new standards run the most critical parts of the WWW, which is the most critical part of the Internet outside of the routing of it. They could get everyone to open up a god damn firewall port if they wanted. I mean this is just ridiculous. There's 65,535 ports and we only get to use one of them (443) because people are too lazy to do anything else?

Re: Improving DNS Privacy in Firefox

#95

Post by peterwwillis » Fri, Jun 01, 2018, 4:21 PM UTC

userbinator wrote: post #6

Because there is no encryption, other devices along the way might collect (or even block or change) this data too. ...which is sometimes very desirable[1][2][3]. I get the whole "more security!" movement, but also feel like it's just contributing to turning general-purpose computers into locked-down media consumption devices. [1] https://pi-hole.net/ [2] https://en.wikipedia.org/wiki/Proxomitron [3] https://news.ycom…

It's a more privacy movement, not a more security movement. None of this really affects security at all. They're only using encryption because it obscures things. We already have DNSSEC to ensure integrity and authenticity, which is what these DNS-over-HTTP providers will be doing on their side anyway.

Re: Improving DNS Privacy in Firefox

#96

Post by peterwwillis » Fri, Jun 01, 2018, 4:32 PM UTC

I'm not sure how it's supposed to work through captive portals. I guess if you can't get to the DNS-over-HTTPS page, use the system resolver? But then networks will just block the DNS-over-HTTPS page implicitly to force the system resolver when they need it.

Another thing this will break: corporate intranet sites. Suddenly you can't browse to your intranet site because Mozilla never checked the DNS server that your computer was assigned by the company.

Re: Improving DNS Privacy in Firefox

#97

Post by pitaj » Fri, Jun 01, 2018, 4:35 PM UTC

peterwwillis wrote: post #94

The New Cabal of the Web: 1) CloudFlare, 2) Google, 3) Mozilla, 4) Let's Encrypt, 5) a smattering of contributing vendors, 6) internet-related standards bodies, and a few other orgs I'm forgetting or not familiar with. Pretty much the entire WWW is being shaped and controlled by this group. "Open Web" my ass. The really insane thing to me is that a lot of this tech is being pushed with the argument that they need to…

You forgot the media publishers and the government. The DMCA had and has a huge effect on the web.

Re: Improving DNS Privacy in Firefox

#98

Post by peterwwillis » Fri, Jun 01, 2018, 4:36 PM UTC

pitaj wrote: post #97

peterwwillis wrote: post #94

The New Cabal of the Web: 1) CloudFlare, 2) Google, 3) Mozilla, 4) Let's Encrypt, 5) a smattering of contributing vendors, 6) internet-related standards bodies, and a few other orgs I'm forgetting or not familiar with. Pretty much the entire WWW is being shaped and controlled by this group. "Open Web" my ass. The really insane thing to me is that a lot of this tech is being pushed with the argument that they need to…

You forgot the media publishers and the government. The DMCA had and has a huge effect on the web.

Yes, but not on the architecture/design of it.

Re: Improving DNS Privacy in Firefox

#99

Post by beokop » Fri, Jun 01, 2018, 4:37 PM UTC

peterwwillis wrote: post #94

The New Cabal of the Web: 1) CloudFlare, 2) Google, 3) Mozilla, 4) Let's Encrypt, 5) a smattering of contributing vendors, 6) internet-related standards bodies, and a few other orgs I'm forgetting or not familiar with. Pretty much the entire WWW is being shaped and controlled by this group. "Open Web" my ass. The really insane thing to me is that a lot of this tech is being pushed with the argument that they need to…

This is the world we live in. Why can’t I access websites over ipv6 even though they’re hosted on cloud providers with ipv6 support? Because just getting people to change their configuration without an immediate benefit to themselves is arguably the hardest problem for the Internet right now.

Re: Improving DNS Privacy in Firefox

#100

Post by gcp » Fri, Jun 01, 2018, 5:00 PM UTC

peterwwillis wrote: post #94

The New Cabal of the Web: 1) CloudFlare, 2) Google, 3) Mozilla, 4) Let's Encrypt, 5) a smattering of contributing vendors, 6) internet-related standards bodies, and a few other orgs I'm forgetting or not familiar with. Pretty much the entire WWW is being shaped and controlled by this group. "Open Web" my ass. The really insane thing to me is that a lot of this tech is being pushed with the argument that they need to…

Pretty much the entire WWW is being shaped and controlled by this group. "Open Web" my ass.

In reality, "they" couldn't even ship Array.prototype.flatten because a few sites won't update MooTools. What you describe couldn't be further removed from reality.

https://groups.google.com/a/chromium.org/forum/#!msg/blink-d...