Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Firefox’s Trusted Recursive Resolver DNS feature is dangerous

blog.ungleich.ch

Post reply on HN
Print view View original

111–120 of 306 posts

Re: Firefox’s Trusted Recursive Resolver DNS feature is dangerous

#111

Post by Xylakant »

ahnick wrote: post #95
Xylakant wrote: post #91

Earlier quoted context omitted.

The article provides no source for this assertion and this Mozilla blog post is pretty clear that DNS-over-HTTPS is off by default and defaults to CF if you enable it or are part of the shield study (which requires nightly and opt-in to shield studies in the first place) https://blog.nightly.mozilla.org/2018/06/01/improving-dns-pr...

If this is true, then I'm okay with the feature being available if it is opt-in. Although I generally think this is a concern better left outside of the particular browser I'm using. If I want to route DNS queries through a third party then I'd like to do that for all my network traffic, not just my browser.

But that’s a different argument you’re making. For many people, routing the browsers DNS via a secure channel is a substantial improvement. You’re still free to route all your network DNS via DoH, there’s software for that. But until DoH is the operating systems default (or at least a non-expert option), this can be a viable improvement.

Re: Firefox’s Trusted Recursive Resolver DNS feature is dangerous

#112

Post by pmlnr »

kevingadd wrote: post #103
pmlnr wrote: post #97

Earlier quoted context omitted.

> DNS over HTTPS is a great idea Putting everything, even lower-than-http level things on top of HTTP is a horrible idea, introducing yet another layer of abstraction.

It's important to understand the advantages of HTTPS via other protocols or custom crypto: * HTTPS stacks are battle tested and there are multiple of them. Browsers in particular already ship a heavily maintained one that performs great, so using DNS on top of it gets all those benefits. Because there are multiple stacks the risk of people settling on a monoculture is a lot lower. * People running a DNS resolver like…

Is there anything left, that's not on HTTP? Maybe NTP. I know about JMAP to replace IMAP.

Here's another idea: other protocols are useful as well, sometimes more useful, than HTTP.

> HTTPS stacks are battle tested and there are multiple of them.

So is DNS. I wonder how the HTTP servers deal with DNS amplification attacks.

> People running a DNS resolver likely have the ability to run a good HTTPS server already

Your conclusion lacks any indication of evidence.

> Because there are multiple stacks the risk of people settling on a monoculture is a lot lower.

HTTP _is_ becoming a monoculture. Sort of. I know it's an open standard, and everything, but still.

Re: Firefox’s Trusted Recursive Resolver DNS feature is dangerous

#113

Post by Aissen »

kevingadd wrote: post #103
pmlnr wrote: post #97

Earlier quoted context omitted.

> DNS over HTTPS is a great idea Putting everything, even lower-than-http level things on top of HTTP is a horrible idea, introducing yet another layer of abstraction.

It's important to understand the advantages of HTTPS via other protocols or custom crypto: * HTTPS stacks are battle tested and there are multiple of them. Browsers in particular already ship a heavily maintained one that performs great, so using DNS on top of it gets all those benefits. Because there are multiple stacks the risk of people settling on a monoculture is a lot lower. * People running a DNS resolver like…

You forgot the more pragmatic reason: middleboxes. HTTPS works everywhere, and introducing a new(2 years old) protocol (DNS over TLS) working on a new port (853) is a sure way to make sure it does not work in many places.

Re: Firefox’s Trusted Recursive Resolver DNS feature is dangerous

#114

Post by Xylakant »

soziawa wrote: post #100
Xylakant wrote: post #89

Earlier quoted context omitted.

The default applies currently if you enable an experimental feature. They hammered out a tight privacy agreement for one service and use that as default while this is stabilized. You can pick any other resolver if you prefer. Seems a legit way of handling this. > And the article's argument that, if you have to choose somebody to share this data with, it might as well be the people you already share it with, seems pre…

> The whole point of HTTPS and DNS-over-HTTPS is to not share any data at all with your provider. Won't they still see which website you then request?

Currently, the provider could read the SNI value from the request, but work is done to encrypt that as well. This would allow them to see which Hostnamen was requested, but they cannot peek into the actual transmission (which is incidentally how domain fronting works: announce a different SNI than the actual requests Host header)

Re: Firefox’s Trusted Recursive Resolver DNS feature is dangerous

#115

Post by wild_preference »

jpalomaki wrote: post #44

Nothing against Cloudflare, but I don’t think it is good in general for the Internet that they are getting so critical. For them this sounds like a good deal (is money involved here?). Having more control of DNS should mean they can provide better service for their customers.

Cloudflare shows how broken the internet is. For example, imagine a world where you would clearly see that your computer or toaster were used in a botnet because it showed up in your billing. DDoS wouldn’t be $5 anymore.

Saying Cloudflare ruins the decentralized internet got the events out of order.

Re: Firefox’s Trusted Recursive Resolver DNS feature is dangerous

#116

Post by anticensor »

xg15 wrote: post #21
StavrosK wrote: post #17

Earlier quoted context omitted.

Why do you think that? My home router will happily resolve sites that only exist on my home server.

Your home router will. However, as the article made clear, you won't be able to open that site in Firefox. Even if you were, you won't be able to get a public TLS certificate for that site, making you unable to serve the site as HTTPS and locking you out of many current and all(!) futue JS and CSS features. Yes, you can solve both problems by installing overrides. However, this has to be done separately for every cli…

Does Firefox enforce HTTPS for IPs in the same subnet?

Re: Firefox’s Trusted Recursive Resolver DNS feature is dangerous

#117

Post by oxymoron »

nebulous1 wrote: post #70
jillesvangurp wrote: post #61

DNS over HTTPS is a great idea. There's nothing wrong with the protocol or Mozilla's implementation of it. This article is all about Mozilla's default choice for a DNS provider. I think Cloudflare is actually a reasonable choice though I'm not a big fan of their annoying captchas that I get served whenever I use vpns. There's nothing sneaky going on here; which the article seems to imply. Currently there is no UI to…

The article doesn't suggest there's something sneaky going on. The article is suggesting that Mozilla are choosing to share your DNS queries with a third party service by default, which is exactly what they're doing. It's not about them choosing Cloudflare in particular, it's about them choosing any particular service by default. And the article's argument that, if you have to choose somebody to share this data with,…

That’s simply not true. Mozilla is not sharing DNS queries with Cloudfare by default, nor are they overriding your configured DNS servers per default. This is an experimental opt-in feature, and they are also running an opt-in study. There has been no announcement of an ”on by default” for DOH. If you enable the experimental feature there is no default provided and you have to set your own server, but if you opt in to the study, you’ll get Cloudfare. This is almost pure FUD at this point.

Re: Firefox’s Trusted Recursive Resolver DNS feature is dangerous

#118

Post by oxymoron »

dingo_bat wrote: post #85
jillesvangurp wrote: post #61

DNS over HTTPS is a great idea. There's nothing wrong with the protocol or Mozilla's implementation of it. This article is all about Mozilla's default choice for a DNS provider. I think Cloudflare is actually a reasonable choice though I'm not a big fan of their annoying captchas that I get served whenever I use vpns. There's nothing sneaky going on here; which the article seems to imply. Currently there is no UI to…

I have configured my network settings to use a particular set of DNS servers. The issue is Firefox going out of the way to use something else.

The feature is opt-in. Firefox will use your system configured DNS servers unless you explicitly enable DOH. In that case you can still change Cloudfare for some other server if you’d like.

Re: Firefox’s Trusted Recursive Resolver DNS feature is dangerous

#119

Post by opencl »

telmich wrote: post #62
rendx wrote: post #22

The article lacks instructions about disabling it or using some other DOH resolvers. about:config -> search for network.trr -> set network.trr.mode = 5 to completely disable it (I do not recommend this) The curl wiki has a list of DOH servers: https://github.com/curl/curl/wiki/DNS-over-HTTPS It should also point to "the other side of the story", the benefits of DOH over classic DNS resolving, for example https://hack…

Thanks for the hint! We added that to our blog entry - please let us know if it sounds right to you.

The default is already off[1] though...

Mozilla has stated plans to eventually turn it on by default[2] but I have yet to see any timeline or details of what the default config will actually be. Your article seems to assert that it will be on by default in FF62, where did Mozilla ever say this? Everything I have read seems to indicate that FF62 is just adding support, which is off by default, and requires a change to about:config to enable in the first place.

[1] https://gist.github.com/bagder/5e29101079e9ac78920ba2fc718ac...

[2] https://blog.nightly.mozilla.org/2018/06/01/improving-dns-pr...

Re: Firefox’s Trusted Recursive Resolver DNS feature is dangerous

#120

Post by dingo_bat »

oxymoron wrote: post #118
dingo_bat wrote: post #85

Earlier quoted context omitted.

I have configured my network settings to use a particular set of DNS servers. The issue is Firefox going out of the way to use something else.

The feature is opt-in. Firefox will use your system configured DNS servers unless you explicitly enable DOH. In that case you can still change Cloudfare for some other server if you’d like.

The impression I got from TFA is that the feature will be on by default and you have to dig into about:config to disable it.
Post reply on HN