Improving DNS Privacy in Firefox • Hacker News Board

Re: Improving DNS Privacy in Firefox

#101

Post by r-w » Fri, Jun 01, 2018, 5:08 PM UTC

jiveturkey wrote: post #88

KaiserPro wrote: post #59

No, no no and no. It does not improve privacy, it just puts all your DNS history in the hands of one provider. Not only that it adds latency for no real gain. HTTP is a terrible protocol for anything time sensitive. (its a fairly bad protocol for anything fast or efficient full stop.) The better way to do this is encourage/provide DNSsec (so we know that a provider is who they say they are) and then encrypt dns queri…

I can hear the product managers at cloudflare maniacally laughing their heads off right now. A side-effect if you're being generous, or primary motive if you're being cynical, of 1.1.1.1 is that CF acquires all the geo info at the expense of everyone else. This puts CF in a particularly advantageous position over DIY GSLB (pushing content providers into using CF), as well as other CDNs of course. Not only that, the p…

Please do your research.

“Any data Cloudflare handles as a result of its resolver for Firefox is as a date processor acting pursuant to Firefox’s data processing instructions. Therefore, the data Cloudflare collects and processes pursuant to its agreement with Firefox is not covered by the Cloudflare Privacy Policy. As part of its agreement with Firefox, Cloudflare has agreed to collect only a limited amount of data about the DNS requests that are sent to the Cloudflare Resolver for Firefox via the Firefox browser. Cloudflare will collect only the following information from Firefox users: […] All of the above information will be stored briefly as part of Cloudflare’s temporary logs, and then permanently deleted within 24 hours of Cloudflare’s receipt of such information.”

source: https://developers.cloudflare.com/1.1.1.1/commitment-to-priv...

Re: Improving DNS Privacy in Firefox

#102

Post by tialaramex » Fri, Jun 01, 2018, 5:27 PM UTC

gnode wrote: post #39

tialaramex wrote: post #22

Earlier quoted context omitted.

Encrypted SNI is very hard. The TLS working group agreed a problem statement, seeing out what should be achieved, but they haven't found any viable way forward on achieving that. If I'm in a city square and I want to tell Bob something, but I refuse to let anybody know that I want to communicate with Bob, it's hard to see what I can do. Bob has no way to know I'm even trying to contact him, so he can't help.

> but I refuse to let anybody know that I want to communicate with Bob That's not the problem though. You're not trying to stop an eavesdropper knowing you're communicating with a particular server, but rather which hostname you're talking to them as. To extend the Bob analogy; you're not trying to hide that you're communicating with Bob, but that you're speaking to each other as members of Fight Club. It's certainly…

You say "difficulty", the evidence seems to suggest impossibility. I am 100% certain that if you have an actual plan for how to do this without an extra round trip the TLS WG wants to hear about it (but please read the draft with the problem statement first so that you don't embarrass yourself and propose something that doesn't actually solve the problem)

In order to be sure we're talking to Bob, so that it's OK if Bob knows we want his Fight Club certificate, I think we have to incur an extra round trip while we obtain the proof he's Bob and send back the request for Fight Club.

If we try to skip that step, Mallory simply interposes, we send our message to Mallory, believing she is Bob, and she reads it to determine we want Fight Club, we are undone. So we have to wait until Bob proves his identity, and only then reveal that we wanted Fight Club.

Re: Improving DNS Privacy in Firefox

#103

Post by kensey » Fri, Jun 01, 2018, 5:29 PM UTC

peterwwillis wrote: post #94

The New Cabal of the Web: 1) CloudFlare, 2) Google, 3) Mozilla, 4) Let's Encrypt, 5) a smattering of contributing vendors, 6) internet-related standards bodies, and a few other orgs I'm forgetting or not familiar with. Pretty much the entire WWW is being shaped and controlled by this group. "Open Web" my ass. The really insane thing to me is that a lot of this tech is being pushed with the argument that they need to…

This is different from how Internet standards have always developed how, again?

Re: Improving DNS Privacy in Firefox

#104

Post by tialaramex » Fri, Jun 01, 2018, 5:51 PM UTC

falcolas wrote: post #36

tialaramex wrote: post #22

Earlier quoted context omitted.

Encrypted SNI is very hard. The TLS working group agreed a problem statement, seeing out what should be achieved, but they haven't found any viable way forward on achieving that. If I'm in a city square and I want to tell Bob something, but I refuse to let anybody know that I want to communicate with Bob, it's hard to see what I can do. Bob has no way to know I'm even trying to contact him, so he can't help.

You yell "Hey, Zanizabo, call Fylnatis" at the top of your lungs. Zanizabo being a phrase encrypted such that only Bob knows you are talking to him, and Fylnatis is your similarly encrypted contact information. Sure, scaling is harder, but it's not impossible.

For this to work you unsolve the key-sharing problem. Everybody who will ever want to communicate with anybody must agree in advance shared secrets with every such party and then retain them indefinitely. You assert the resulting scaling "is harder, but it's not impossible" and I'm sure that by some technical definition of "impossible" this statement is even true, but in practical terms it's never going get done which is why such systems are used (if at all) only by secret agents.

If you decide well that's OK, we can do something simpler - everybody will have an infinite set of aliases like "Zanizabo" or "Fylnatis" but they won't be one-to-one shared secrets, alas Mallory simply hears you say "Zanizabo" and she says "Hey, Zanizabo, call Oxymoron" (Oxymoron is an alias Mallory has chosen for this purpose) and soon discovers that Bob answers so now she knows who you wanted to talk to.

Re: Improving DNS Privacy in Firefox

#105

Post by comex » Fri, Jun 01, 2018, 6:08 PM UTC

peterwwillis wrote: post #94

The New Cabal of the Web: 1) CloudFlare, 2) Google, 3) Mozilla, 4) Let's Encrypt, 5) a smattering of contributing vendors, 6) internet-related standards bodies, and a few other orgs I'm forgetting or not familiar with. Pretty much the entire WWW is being shaped and controlled by this group. "Open Web" my ass. The really insane thing to me is that a lot of this tech is being pushed with the argument that they need to…

> They could get everyone to open up a god damn firewall port if they wanted.

No. They couldn’t. That’s the paradox. Together they control the client software running on just about everyone’s computers and phones… but they have very little control or influence over your random IT administrator running a corporate firewall or middleware box, who’s decided to block everything but 80 and 443 for “security” reasons. They don’t even have much influence over the vendors of those devices. Witness Chrome having to roll back TLS 1.3 support after initially deploying it, because BlueCoat and other vendors’ proxies were dropping all TLS 1.3 connections [1], despite TLS 1.3 having been many years in the making, and theoretically bring fully backward-compatible due to making use of the TLS version negotiation mechanism. In that case the relevant vendors did eventually release software updates, but only after Chrome forced their hand by unintentionally breaking all SSL sites for users behind those proxies – including Chrome’s own self-update server, so those users couldn’t even receive the rollback update! I’m sure that’s not an experience Google (or anyone else) is eager to repeat.

Besides, for the sake of privacy, it’s best to limit the information transmitted in cleartext over the Internet to the absolute minimum – and that includes what type of service is being accessed. Why should an adversary intercepting traffic get to learn that for free from the port number, when that information could be transmitted as part of the encrypted connection instead? (Yes, the adversary might be able to figure it out anyway through traffic analysis, but at least that has limits and potential countermeasures.)

[1] http://web.archive.org/web/20170311013249/https://bugs.chrom...

Re: Improving DNS Privacy in Firefox

#106

Post by zackbloom » Fri, Jun 01, 2018, 6:37 PM UTC

jiveturkey wrote: post #88

KaiserPro wrote: post #59

No, no no and no. It does not improve privacy, it just puts all your DNS history in the hands of one provider. Not only that it adds latency for no real gain. HTTP is a terrible protocol for anything time sensitive. (its a fairly bad protocol for anything fast or efficient full stop.) The better way to do this is encourage/provide DNSsec (so we know that a provider is who they say they are) and then encrypt dns queri…

I can hear the product managers at cloudflare maniacally laughing their heads off right now. A side-effect if you're being generous, or primary motive if you're being cynical, of 1.1.1.1 is that CF acquires all the geo info at the expense of everyone else. This puts CF in a particularly advantageous position over DIY GSLB (pushing content providers into using CF), as well as other CDNs of course. Not only that, the p…

The reason we (Cloudflare) don't share ECS info is to protect the privacy of the querying user by not exposing their full IP address to the authoritative resolver. We are exploring ways we can pass a subset of this information such that the user can be roughly geolocated without exposing their identity.

Cloudflare runs an Anycast network, we do geographic load balancing by terminating the user's connection at our closest point of presence (as determined by BGP) and then routing their traffic to the origin of the customer's choice from there. As we're not doing geo load balancing using DNS, I'm not sure what the information provided by 1.1.1.1 would do for us.

Re: Improving DNS Privacy in Firefox

#107

Post by cpeterso » Fri, Jun 01, 2018, 6:37 PM UTC

mike-cardwell wrote: post #63

Imagine if this became the default with only Cloudflare as a provider. Firefox users in countries all over the World will not be able to visit a website locally or anywhere else without asking an American corporation for the IP address first. I mean. I can't believe that there are going to be a lot of alternative providers. It's going to be an expensive service to provide. Especially when one of the requirements is t…

Does Chrome use Google's DNS servers? I've read conflicting information online. Chrome would need to use the local DNS provider to find hosts on your LAN.

Re: Improving DNS Privacy in Firefox

#108

Post by zackbloom » Fri, Jun 01, 2018, 6:40 PM UTC

avian wrote: post #53

I don't see how this improves privacy. Yes, my local ISP, whose DNS I'm using, knows the domains I'm connecting with. They most likely can also access this info in cleartext in other ways, if they care enough. For instance through SNI. Beyond my ISP, it's doubtful that unencrypted nature of DNS has any impact on my privacy due to heavy caching and the fact that my requests are merged together with requests from many…

Your ISP is very likely literally selling your DNS data to the highest bidder right now. They don't not have a strong privacy agreement out of laziness, they don't have one because your traffic data is valuable.

Re: Improving DNS Privacy in Firefox

#109

Post by zackbloom » Fri, Jun 01, 2018, 6:43 PM UTC

lossolo wrote: post #74

I hope they are not making this a default setting. What about GeoDNS load balancing/routing that a lot of companies are using? Some time ago I've tested Google DNS servers and got worse location from Akamai than using my ISP DNS servers. It was before Google introduced EDNS Client Subnet (rfc7871)[1] so I don't know how things are now but probably biggest CDN providers like Akamai now give exactly the same results as…

It's a balancing act between protecting the privacy of the requesting user and trying to provide enough location information that legacy services know how to route their traffic. We (Cloudflare) will likely begin providing an approximation of the ECS information which tries to strike the right balance.

Re: Improving DNS Privacy in Firefox

#110

Post by bluejekyll » Fri, Jun 01, 2018, 6:45 PM UTC

gnode wrote: post #75

sanxiyn wrote: post #68

Earlier quoted context omitted.

If you want UDP, DNS over DTLS also exists.

Doesn't really save you anything; DTLS still involves a connection with a handshake, so you have increased latency and memory overhead. Its usefulness is in low latency transport where head-of-line blocking would be detrimental (e.g. real-time streaming video; phone calls; VPNs). DNSCurve, by comparison, is connection-less -- meaning no handshake latency, no connection overhead, and denial-of-service resilience.

DNSCurve requires an out-of-band process for the exchange of key information. This is how it works around the handshake requirement. It's been a while since I read the spec though, so not sure what the current process is.