Firefox’s Trusted Recursive Resolver DNS feature is dangerous

Post by PappaPatat » Sun, Aug 05, 2018, 12:30 PM UTC

pmlnr wrote: post #112

kevingadd wrote: post #103

Earlier quoted context omitted.

It's important to understand the advantages of HTTPS via other protocols or custom crypto: * HTTPS stacks are battle tested and there are multiple of them. Browsers in particular already ship a heavily maintained one that performs great, so using DNS on top of it gets all those benefits. Because there are multiple stacks the risk of people settling on a monoculture is a lot lower. * People running a DNS resolver like…

Is there anything left, that's not on HTTP? Maybe NTP. I know about JMAP to replace IMAP. Here's another idea: other protocols are useful as well, sometimes more useful, than HTTP. > HTTPS stacks are battle tested and there are multiple of them. So is DNS. I wonder how the HTTP servers deal with DNS amplification attacks. > People running a DNS resolver likely have the ability to run a good HTTPS server already Your…

Post by _Codemonkeyism » Sun, Aug 05, 2018, 12:32 PM UTC

Xylakant wrote: post #89

nebulous1 wrote: post #70

Earlier quoted context omitted.

The article doesn't suggest there's something sneaky going on. The article is suggesting that Mozilla are choosing to share your DNS queries with a third party service by default, which is exactly what they're doing. It's not about them choosing Cloudflare in particular, it's about them choosing any particular service by default. And the article's argument that, if you have to choose somebody to share this data with,…

The default applies currently if you enable an experimental feature. They hammered out a tight privacy agreement for one service and use that as default while this is stabilized. You can pick any other resolver if you prefer. Seems a legit way of handling this. > And the article's argument that, if you have to choose somebody to share this data with, it might as well be the people you already share it with, seems pre…

Post by orf » Sun, Aug 05, 2018, 12:35 PM UTC

_Codemonkeyism wrote: post #121

oxymoron wrote: post #117

Earlier quoted context omitted.

That’s simply not true. Mozilla is not sharing DNS queries with Cloudfare by default, nor are they overriding your configured DNS servers per default. This is an experimental opt-in feature, and they are also running an opt-in study. There has been no announcement of an ”on by default” for DOH. If you enable the experimental feature there is no default provided and you have to set your own server, but if you opt in t…

Just to be clear, the authors are wrong? There will not be a September patch that overrides my network DNS settings? "With the next Mozilla patch in September any DNS change you configure in your network won't have any effect anymore, at least for browsing with Firefox, because Mozilla has partnered up with Cloudflare and will resolve the domain names from the application itself via a DNS server from Cloudflare based…

Post by _Codemonkeyism » Sun, Aug 05, 2018, 12:38 PM UTC

chrismorgan wrote: post #28

> My local ISP seems more trustworthy to me than a big US-based corporate which acts under the guise of a selfless privacy rights defender. I have never trusted any local ISP. They’re commonly expressly allowed by law to share roughly whatever they like about you†, and they are known to do so . Cloudflare has at least promised not to be evil, and is to be audited annually concerning it. If they desire to be evil I ha…

Post by Mister_Snuggles » Sun, Aug 05, 2018, 12:40 PM UTC

telmich wrote: post #34

TimMeade wrote: post #7

What about if you have private DNS servers that has sites that cloudflare does not have? For example internal intranets etc? So mozilla will not work at all in that case?

That one actually breaks in the new release :-/