Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Firefox’s Trusted Recursive Resolver DNS feature is dangerous

blog.ungleich.ch

Post reply on HN
Print view View original

51–60 of 306 posts

Re: Firefox’s Trusted Recursive Resolver DNS feature is dangerous

#51

Post by foepys »

jpalomaki wrote: post #44

Nothing against Cloudflare, but I don’t think it is good in general for the Internet that they are getting so critical. For them this sounds like a good deal (is money involved here?). Having more control of DNS should mean they can provide better service for their customers.

> For them this sounds like a good deal (is money involved here?).

There is a lot of money involved. When you resolve DNS only over Cloudflare, all Cloudflare sites will have a much lower DNS resolution time than any domain that is not hosted by CF's DNS service. CF can also do geo DNS more efficiently, potentially saving millions in edge nodes.

Re: Firefox’s Trusted Recursive Resolver DNS feature is dangerous

#52

Post by xg15 »

chrismorgan wrote: post #28

> My local ISP seems more trustworthy to me than a big US-based corporate which acts under the guise of a selfless privacy rights defender. I have never trusted any local ISP. They’re commonly expressly allowed by law to share roughly whatever they like about you†, and they are known to do so . Cloudflare has at least promised not to be evil, and is to be audited annually concerning it. If they desire to be evil I ha…

> They’re commonly expressly allowed by law to share roughly whatever they like about you†, and they are known to do so.

Why would this not apply to Cloudflare as well?

Re: Firefox’s Trusted Recursive Resolver DNS feature is dangerous

#53

Post by silvestrov »

chrismorgan wrote: post #28

> My local ISP seems more trustworthy to me than a big US-based corporate which acts under the guise of a selfless privacy rights defender. I have never trusted any local ISP. They’re commonly expressly allowed by law to share roughly whatever they like about you†, and they are known to do so . Cloudflare has at least promised not to be evil, and is to be audited annually concerning it. If they desire to be evil I ha…

> (This is a gross simplification, but it’s broadly true enough in most countries.)

Seems like you forget Europe and e.g. GDPR.

It would be a big no-no in Denmark: My bank has one division for normal accounts and another for mastercard. The 2 divisions are separate companies, so I have to sign a paper to allow the MasterCard division to know about my normal account.

So Danes have no hesitation giving out personal information as they know it’s protected by law. “We don’t sell your info” is redundant in Denmark.

Re: Firefox’s Trusted Recursive Resolver DNS feature is dangerous

#54

Post by telmich »

evilpie wrote: post #35
majewsky wrote: post #25

Earlier quoted context omitted.

Which is clearly bonkers. Why would Firefox deliberately break people who run Nextcloud on a Raspi at home? There must be something missing here.

https://wiki.mozilla.org/Trusted_Recursive_Resolver >Set `network.trr.mode` to 2 to make DNS Over HTTPS the browser's first choice but use regular DNS as a fallback So regular DNS entries will still resolve after the lookup over DoH failed.

But which user will be able to figure that out?

Re: Firefox’s Trusted Recursive Resolver DNS feature is dangerous

#55

Post by telmich »

nebulous1 wrote: post #49
rschoultz wrote: post #43

This feature will break dns-based geo-lookup, so as a user I might get directed to services that are 130ms away from me instead of 1-5ms. For any client application, this will likely have strong negative effects on user experience.

I somewhat doubt cloudflare have overlooked that

anycast is the solution here

Re: Firefox’s Trusted Recursive Resolver DNS feature is dangerous

#58

Post by rschoultz »

nebulous1 wrote: post #49
rschoultz wrote: post #43

This feature will break dns-based geo-lookup, so as a user I might get directed to services that are 130ms away from me instead of 1-5ms. For any client application, this will likely have strong negative effects on user experience.

I somewhat doubt cloudflare have overlooked that

It seems like you are right. On the company's pages I find "... Instead of doing this, Cloudflare will make the request from one of their own IP addresses near the user. This provides geolocation without tying it to a particular user. ".

Still, my concern is that this is no longer a function of the technology, but by a service that is maintained by one company, limited to the coverage that they provide in different parts of the world.

Re: Firefox’s Trusted Recursive Resolver DNS feature is dangerous

#60

Post by pas »

sofaofthedamned wrote: post #30
petters wrote: post #6

> And your ISP knows where you connect to anyways. So the data or information generated by their DNS server provides no additional information to them. This is not correct. Your ISP only knows what IP you are connecting to and that is not enough in general. E.g. Cloudflare.

With SNI they also know the domain you're connecting to.

There are people working on encrypted SNI: https://huitema.wordpress.com/2017/09/12/cracking-the-sni-en... it'll take some time, but we'll get there hopefull soon.
Post reply on HN