Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Inside Firefox’s DNS-over-HTTPS engine

daniel.haxx.se

Post reply on HN
Print view View original

81–90 of 134 posts

Re: Inside Firefox’s DNS-over-HTTPS engine

#81

Post by madmax96 »

mike-cardwell wrote: post #79

I don't like the idea of this, but even the implementation is bad. If we're going to do DNS over HTTPS, then there should be a standalone application, and the system should be reconfigured to use it, so all running applications on the system use it. I mean, do we really want all of our desktop applications to have their own built in custom ways of mapping domain names to IP addresses? [edit] E.g on Linux, it could in…

Totally agree re: implementation details.

And, like you said, this is a bad idea. Is there something wrong with efforts like DNSCrypt + DNSSec? That's supposed to provide authentication and encryption to DNS without sending everything over HTTP.

Did Mozilla just totally ignore the work that's already been done in this area?

Re: Inside Firefox’s DNS-over-HTTPS engine

#82

Post by peterwwillis »

geofft wrote: post #22
dogecoinbase wrote: post #20

Earlier quoted context omitted.

No, you wanted encryption for DNS transport, and I completely agree with that desire. This is a terrible half-measure that bypasses many existing security precautions people have intentionally taken by default , and moreover exposes private data to a company with a history of handling such poorly.

I specifically want DNS over HTTPS - except for specialized use cases over known networks where every device in between is tested as behaving properly, protocols that aren't TLS (over TCP) are a hassle to me both as an end user and as a developer, because someone is going to break them. And once you have TLS, there's little benefit in using something other than HTTP inside, and a lot of benefit in using something whe…

Why did you want this complicated hack when you could just use a SOCKS5 proxy to tunnel both your DNS and HTTP requests over a plain ssh connection on port 443? Or a TLS VPN on port 443 to properly tunnel all traffic (though admittedly it takes marginally more effort than ssh) ?

Re: Inside Firefox’s DNS-over-HTTPS engine

#83

Post by HurrdurrHodor »

madmax96 wrote: post #81
mike-cardwell wrote: post #79

I don't like the idea of this, but even the implementation is bad. If we're going to do DNS over HTTPS, then there should be a standalone application, and the system should be reconfigured to use it, so all running applications on the system use it. I mean, do we really want all of our desktop applications to have their own built in custom ways of mapping domain names to IP addresses? [edit] E.g on Linux, it could in…

Totally agree re: implementation details. And, like you said, this is a bad idea. Is there something wrong with efforts like DNSCrypt + DNSSec? That's supposed to provide authentication and encryption to DNS without sending everything over HTTP. Did Mozilla just totally ignore the work that's already been done in this area?

Just a guess but maybe they wanted to build this in a way that it would actually get used.

Re: Inside Firefox’s DNS-over-HTTPS engine

#84

Post by j0057 »

I'm not very happy we're now going to send all DNS traffic to 6 centralized DNS-over-HTTPS servers[1]. We can't trust our ISP, but we can trust Google and Cloudflare?

I also noticed that when I configure my Android's proxy settings to point at a Privoxy container that routes through a VPN, I still get DNS-hijacked to my provider's "thepiratebay.org has been blocked for you" page -- this only happens in Chrome mobile, not Firefox mobile. I was used to DNS resolving through the proxy server.

[1] https://github.com/curl/curl/wiki/DNS-over-HTTPS#publicly-av...

Re: Inside Firefox’s DNS-over-HTTPS engine

#85

Post by mike-cardwell »

HurrdurrHodor wrote: post #83
madmax96 wrote: post #81

Earlier quoted context omitted.

Totally agree re: implementation details. And, like you said, this is a bad idea. Is there something wrong with efforts like DNSCrypt + DNSSec? That's supposed to provide authentication and encryption to DNS without sending everything over HTTP. Did Mozilla just totally ignore the work that's already been done in this area?

Just a guess but maybe they wanted to build this in a way that it would actually get used.

There's no reason that Firefox couldn't check for the existence of a local DOH resolver, and if it doesn't see one, pop up a one time message offering to install one for you.

Every operating system has a system wide way of resolving names to IP addresses, and every application uses it. This new architecture of building custom name resolution into individual applications might be easier for them to build, but it's crap.

Re: Inside Firefox’s DNS-over-HTTPS engine

#86

Post by KwanEsq »

codewithcheese wrote: post #31

I am in Indonesia where Reddit, Vimeo, The Pirate Bay and other sites are blocked. I just enabled TRR in Firefox 60 (They mention best support is in 62) and now I have full unblocked access to all those sites. Awesome.

Be aware that using it in 60 you may run into frequent crashes from https://bugzilla.mozilla.org/show_bug.cgi?id=1441131

Re: Inside Firefox’s DNS-over-HTTPS engine

#88

Post by madmax96 »

HurrdurrHodor wrote: post #83
madmax96 wrote: post #81

Earlier quoted context omitted.

Totally agree re: implementation details. And, like you said, this is a bad idea. Is there something wrong with efforts like DNSCrypt + DNSSec? That's supposed to provide authentication and encryption to DNS without sending everything over HTTP. Did Mozilla just totally ignore the work that's already been done in this area?

Just a guess but maybe they wanted to build this in a way that it would actually get used.

That doesn't address my concerns, actually.

Mozilla is doing two things:

1. Bundling DNS with the browser (e.g. ignoring system DNS)

2. Using DNS over HTTPS

Mozilla could still do (1) and then use DNSCrypt + DNSSEC internally. Then, it would actually be used, but they'd be relying on existing technology that actually fits the use-case, rather than DNS-over-HTTPS.

For the record, I don't think you should ignore the system's DNS, either.

Re: Inside Firefox’s DNS-over-HTTPS engine

#89

Post by cm2187 »

What kind of headers get transmitted as part of the DNS query? With DNS, the nice thing is that it is not a chatty protocol, no authentication, no cookies, no user agent. https is exactly the opposite. It would be nice to know that it is not a new backdoor into tracking people.

[edit]: plus isn't Stateless TLS Session Resumption effectively a cookie?

Re: Inside Firefox’s DNS-over-HTTPS engine

#90

Post by Leon »

mike-cardwell wrote: post #79

I don't like the idea of this, but even the implementation is bad. If we're going to do DNS over HTTPS, then there should be a standalone application, and the system should be reconfigured to use it, so all running applications on the system use it. I mean, do we really want all of our desktop applications to have their own built in custom ways of mapping domain names to IP addresses? [edit] E.g on Linux, it could in…

There are lots of Open Source projects that will do what you are asking. Here is the first top hit on using bind to do that - https://github.com/wrouesnel/dns-over-https-proxy

However I disagree that it is a bad idea and that the implementation is bad. Regardless of how software _should_ behave, Firefox operates in how software is actually run for their users. DNS is a source of security vulnerabilities and headaches.

Demanding a higher level abstraction is not always an option for many, but using Firefox often is. This is especially important for mobile, where a lot of people don't have access or knowledge to set in place a system wide proxy after rooting their phones, but it is very easy to install Firefox mobile.

What about web browser usage on library or campus computers? Often they will have several browsers installed as well.

The point is that making security more available and easier to use where it matters most is a good idea.

Post reply on HN