Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Firefox’s Trusted Recursive Resolver DNS feature is dangerous

blog.ungleich.ch

Post reply on HN
Print view View original

81–90 of 306 posts

Re: Firefox’s Trusted Recursive Resolver DNS feature is dangerous

#81

Post by Xylakant »

kelnage wrote: post #4
mhkool wrote: post #3

I rather use a DNS cloud that promises to wipe logs every 24 hours than a DNS server of an ISP who is guaranteed to spy on me.

Great! And you can already choose to do so. But it seems pretty likely that Firefox will be making that decision on behalf of all its users (except those with the wherewithal to know how to opt out), without effectively communicating the risks of that decision to them (based upon their communication about this feature so far).

It’s currently an expert feature that’s off by default. There is documentation in the wiki and a blog post on the nightly news blog for those that are interested in turning it on. It’s quite the opposite of opt-out. It’s opt-in for the technical inclined. What would your expected level of communication be?

Re: Firefox’s Trusted Recursive Resolver DNS feature is dangerous

#82

Post by Xylakant »

a012 wrote: post #5
mhkool wrote: post #3

I rather use a DNS cloud that promises to wipe logs every 24 hours than a DNS server of an ISP who is guaranteed to spy on me.

There are many public DNS providers those promise to not logs DNS queries. I don't know precisely but if Mozilla forces user to use Cloudflare DNS is the deal breaker.

They don’t. It’s the default if you choose to enable the feature, but there are other compatible DNS providers, pick any that suits you (or just don’t enable the feature and keep doing what you’re doing now)

Re: Firefox’s Trusted Recursive Resolver DNS feature is dangerous

#84

Post by Xylakant »

geertj wrote: post #65
StavrosK wrote: post #13

I use Cloudflare's resolver, but I actually agree with this. I don't want every device in my local network ignoring my Pi hole or my custom DNS entries, I don't want the device of everyone in my country being subject to surveillance requests from the NSA (and Cloudflare is legally (if you call warrantless wiretaps legal) required to comply), and I don't like the centralization this brings. If I recall correctly, this…

> I don't want the device of everyone in my country being subject to surveillance requests from the NSA (and Cloudflare is legally (if you call warrantless wiretaps legal) required to comply), and I don't like the centralization this brings. Agreed that this introduces additional centralization. Maybe Mozilla could work to with other third parties in different jurisdictions to see if there's interest to spin up addit…

There are other DoH providers.

Re: Firefox’s Trusted Recursive Resolver DNS feature is dangerous

#85

Post by dingo_bat »

jillesvangurp wrote: post #61

DNS over HTTPS is a great idea. There's nothing wrong with the protocol or Mozilla's implementation of it. This article is all about Mozilla's default choice for a DNS provider. I think Cloudflare is actually a reasonable choice though I'm not a big fan of their annoying captchas that I get served whenever I use vpns. There's nothing sneaky going on here; which the article seems to imply. Currently there is no UI to…

I have configured my network settings to use a particular set of DNS servers. The issue is Firefox going out of the way to use something else.

Re: Firefox’s Trusted Recursive Resolver DNS feature is dangerous

#86

Post by kingofhdds »

There are many countries where ISPs are obliged by law to spy on users, and retain logs for many years. DNS manipulation also used as a cheap censorship mechanism. So Cloudflare easily can be a better option for hundreds of millions if not billions of people. As a rule, local actors present way more serious threat compared to US agencies for majority of the planet's population. That said, Mozilla, of course, must be very transparent with such big changes, and explain them to users not using just "more secure" wording.

Re: Firefox’s Trusted Recursive Resolver DNS feature is dangerous

#87

Post by Xylakant »

foepys wrote: post #48
qiqitori wrote: post #15

More information: https://blog.nightly.mozilla.org/2018/06/01/improving-dns-pr... According to this page: - you can already test this right now - you can provide your own server And some more: https://en.wikipedia.org/wiki/DNS_over_HTTPS

> - you can provide your own server Nobody will do this except for maybe 5 individuals and a few dozen cooperations simply because there are no other public DoH servers around.

No other public resolver?

https://developers.google.com/speed/public-dns/docs/dns-over... https://ripe76.ripe.net/on-site/technical-information/dns-ov...

The DNScrypt project has a longer list here:

https://download.dnscrypt.info/resolvers-list/v2/public-reso...

Keep in mind that this is currently all pretty much experimental.

Re: Firefox’s Trusted Recursive Resolver DNS feature is dangerous

#88

Post by true_religion »

foepys wrote: post #66
chrismorgan wrote: post #28

> My local ISP seems more trustworthy to me than a big US-based corporate which acts under the guise of a selfless privacy rights defender. I have never trusted any local ISP. They’re commonly expressly allowed by law to share roughly whatever they like about you†, and they are known to do so . Cloudflare has at least promised not to be evil, and is to be audited annually concerning it. If they desire to be evil I ha…

> Cloudflare has at least promised not to be evil Remember when Google did so, too? Then they bid on military contracts and bought a military contractor.

It may surprise you, but not everyone believes the military is evil, and thus working with them is evil.

Re: Firefox’s Trusted Recursive Resolver DNS feature is dangerous

#89

Post by Xylakant »

nebulous1 wrote: post #70
jillesvangurp wrote: post #61

DNS over HTTPS is a great idea. There's nothing wrong with the protocol or Mozilla's implementation of it. This article is all about Mozilla's default choice for a DNS provider. I think Cloudflare is actually a reasonable choice though I'm not a big fan of their annoying captchas that I get served whenever I use vpns. There's nothing sneaky going on here; which the article seems to imply. Currently there is no UI to…

The article doesn't suggest there's something sneaky going on. The article is suggesting that Mozilla are choosing to share your DNS queries with a third party service by default, which is exactly what they're doing. It's not about them choosing Cloudflare in particular, it's about them choosing any particular service by default. And the article's argument that, if you have to choose somebody to share this data with,…

The default applies currently if you enable an experimental feature. They hammered out a tight privacy agreement for one service and use that as default while this is stabilized. You can pick any other resolver if you prefer. Seems a legit way of handling this.

> And the article's argument that, if you have to choose somebody to share this data with, it might as well be the people you already share it with, seems pretty valid to me.

The whole point of HTTPS and DNS-over-HTTPS is to not share any data at all with your provider. It’s not entirely working right now due to SNI being plaintext, but work is being done on that, too. So that’s really not a good argument.

Post reply on HN