Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Firefox’s Trusted Recursive Resolver DNS feature is dangerous

blog.ungleich.ch

Post reply on HN
Print view View original

21–30 of 306 posts

Re: Firefox’s Trusted Recursive Resolver DNS feature is dangerous

#21

Post by xg15 »

StavrosK wrote: post #17
xg15 wrote: post #11

Earlier quoted context omitted.

I think as far as browsers are concerned, there are no private DNS names anymore for a good while already - either everyone on the internet knows your DNS or it doesn't exist. See the similar problem with TLS certificates... (edit) Ok, that was indeed put more dramatically than necessary. My point is that private DNS names seem to be heavily discouraged by browsers default configurations. You can change both the DNS…

Why do you think that? My home router will happily resolve sites that only exist on my home server.

Your home router will. However, as the article made clear, you won't be able to open that site in Firefox.

Even if you were, you won't be able to get a public TLS certificate for that site, making you unable to serve the site as HTTPS and locking you out of many current and all(!) futue JS and CSS features.

Yes, you can solve both problems by installing overrides. However, this has to be done separately for every client that you want to use and (potentially) for every app that you want to connect to.

If you want to make an intranet-only web page that "just works" with off-the-shelf clients, you'll have to stick to public domain names.

Re: Firefox’s Trusted Recursive Resolver DNS feature is dangerous

#22

Post by rendx »

The article lacks instructions about disabling it or using some other DOH resolvers.

about:config -> search for network.trr -> set network.trr.mode = 5 to completely disable it (I do not recommend this)

The curl wiki has a list of DOH servers: https://github.com/curl/curl/wiki/DNS-over-HTTPS

It should also point to "the other side of the story", the benefits of DOH over classic DNS resolving, for example https://hacks.mozilla.org/2018/05/a-cartoon-intro-to-dns-ove...

Re: Firefox’s Trusted Recursive Resolver DNS feature is dangerous

#23

Post by kijin »

I don't like the way Cloudflare is centralizing everything, but I would use Cloudflare any day over my ISP. Seriously, fuck my ISP.

I would support this feature on the condition that users are able to choose which DNS service to use by default, especially as more public DNS services begin to adopt DoH. Developers like us will also need the ability to use /etc/hosts or route queries to a local instance of dnsmasq.

Obviously there's a switch somewhere in about:config, because Firefox is also involved with the Tor project which requires the ability to route DNS queries through Tor. This switch should be accessible to the user, just like the choice of default search provider.

Re: Firefox’s Trusted Recursive Resolver DNS feature is dangerous

#25

Post by majewsky »

xg15 wrote: post #21
StavrosK wrote: post #17

Earlier quoted context omitted.

Why do you think that? My home router will happily resolve sites that only exist on my home server.

Your home router will. However, as the article made clear, you won't be able to open that site in Firefox. Even if you were, you won't be able to get a public TLS certificate for that site, making you unable to serve the site as HTTPS and locking you out of many current and all(!) futue JS and CSS features. Yes, you can solve both problems by installing overrides. However, this has to be done separately for every cli…

Which is clearly bonkers. Why would Firefox deliberately break people who run Nextcloud on a Raspi at home? There must be something missing here.

Re: Firefox’s Trusted Recursive Resolver DNS feature is dangerous

#28

Post by chrismorgan »

> My local ISP seems more trustworthy to me than a big US-based corporate which acts under the guise of a selfless privacy rights defender.

I have never trusted any local ISP. They’re commonly expressly allowed by law to share roughly whatever they like about you†, and they are known to do so.

Cloudflare has at least promised not to be evil, and is to be audited annually concerning it. If they desire to be evil I have no doubt they could wangle it, but I still trust them way more than I trust any ISP, because they’re already known to be evil under these definitions.

----

† (This is a gross simplification, but it’s broadly true enough in most countries.)

Re: Firefox’s Trusted Recursive Resolver DNS feature is dangerous

#29

Post by currysausage »

petters wrote: post #6

> And your ISP knows where you connect to anyways. So the data or information generated by their DNS server provides no additional information to them. This is not correct. Your ISP only knows what IP you are connecting to and that is not enough in general. E.g. Cloudflare.

That might be true in the future if and when SNI encryption is widely implemented.

Re: Firefox’s Trusted Recursive Resolver DNS feature is dangerous

#30

Post by sofaofthedamned »

petters wrote: post #6

> And your ISP knows where you connect to anyways. So the data or information generated by their DNS server provides no additional information to them. This is not correct. Your ISP only knows what IP you are connecting to and that is not enough in general. E.g. Cloudflare.

With SNI they also know the domain you're connecting to.
Post reply on HN