Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Firefox’s Trusted Recursive Resolver DNS feature is dangerous

blog.ungleich.ch

Post reply on HN
Print view View original

141–150 of 306 posts

Re: Firefox’s Trusted Recursive Resolver DNS feature is dangerous

#141

Post by _Codemonkeyism »

Xylakant wrote: post #127
_Codemonkeyism wrote: post #124

Earlier quoted context omitted.

Cloudflare is an US company, their privacy statement is worth zero to most Firefox users.

Most Firefox users are absolutely unaffected by this. Literally all people that don’t explicitly enable this. All those who do might want to make up their mind if they want to participate in this and if they want CF to be their provider of trust. Keep in mind that CF will see a substantial chunk of the traffic anyways. Mozilla seems to be confident in that agreement and I have a certain amount of trust in Mozilla whi…

FF will turn this on for everybody and Cloudflare will be the default 2018? Don't know. 2019? For sure. All FF browsing meta data flows into the US, the country with the most spies and no legal framework to go to court.

So your argument is an obvious straw man and one wonders about your motivations to support getting all the browsing meta data into the US by default.

Moving my data from Germany to the US will not make me more secure in any way.

And talking about repressed countries is like "think about the children!" for the rest of us - a nice lever to sell this massive data vacuuming.

Re: Firefox’s Trusted Recursive Resolver DNS feature is dangerous

#142

Post by Mister_Snuggles »

foepys wrote: post #48
qiqitori wrote: post #15

More information: https://blog.nightly.mozilla.org/2018/06/01/improving-dns-pr... According to this page: - you can already test this right now - you can provide your own server And some more: https://en.wikipedia.org/wiki/DNS_over_HTTPS

> - you can provide your own server Nobody will do this except for maybe 5 individuals and a few dozen cooperations simply because there are no other public DoH servers around.

Many corporations will choose to run their own resolvers for internal services.

Home/small business router vendors already include DNS resolvers on the boxes they sell which work to automatically provide hostnames for addresses that they've served up with DHCP.

Re: Firefox’s Trusted Recursive Resolver DNS feature is dangerous

#143

Post by mcny »

Sorry if this is off topic but where does DNS over https leave my pi hole?

Is it possible (in the future) to do dns over https from my router to the pihole and then dns over https from the pihole to Google or Cisco open DNS?

How would it work? Wouldn’t the router need to trust the https certificate that my pihole presents? Thank you!

Re: Firefox’s Trusted Recursive Resolver DNS feature is dangerous

#144

Post by _Codemonkeyism »

Xylakant wrote: post #111
ahnick wrote: post #95

Earlier quoted context omitted.

If this is true, then I'm okay with the feature being available if it is opt-in. Although I generally think this is a concern better left outside of the particular browser I'm using. If I want to route DNS queries through a third party then I'd like to do that for all my network traffic, not just my browser.

But that’s a different argument you’re making. For many people, routing the browsers DNS via a secure channel is a substantial improvement. You’re still free to route all your network DNS via DoH, there’s software for that. But until DoH is the operating systems default (or at least a non-expert option), this can be a viable improvement.

For many it is, but for billions it isn't. For those where it is an improvement they can opt in.

Re: Firefox’s Trusted Recursive Resolver DNS feature is dangerous

#145

Post by rini17 »

Nokinside wrote: post #72
telmich wrote: post #2

The Internet is not made for centralisation!

The internet has decentralized architecture underneath but the model is being abandoned because traffic volumes are too high for the naive decentralized architecture. Today 60% of the global internet traffic goes trough CDN's. In 2021 it will be over 70% in 2021 (over 90% in North America). There is whole "internet cache" industry standing between clients and servers. When you connect to some site in the internet, mo…

You cannot compare CDN with DNS which does not require high traffic volumes nor expensive servers.

The issue is pervasive laying of trust into "benevolent" third parties, CA's apparently are not enough and we now must have Trusted Recursive Resolvers, too. And it's more and more difficult to set up alternative infrastructure which does not rely on them.

Re: Firefox’s Trusted Recursive Resolver DNS feature is dangerous

#146

Post by jlgaddis »

pmlnr wrote: post #112
kevingadd wrote: post #103

Earlier quoted context omitted.

It's important to understand the advantages of HTTPS via other protocols or custom crypto: * HTTPS stacks are battle tested and there are multiple of them. Browsers in particular already ship a heavily maintained one that performs great, so using DNS on top of it gets all those benefits. Because there are multiple stacks the risk of people settling on a monoculture is a lot lower. * People running a DNS resolver like…

Is there anything left, that's not on HTTP? Maybe NTP. I know about JMAP to replace IMAP. Here's another idea: other protocols are useful as well, sometimes more useful, than HTTP. > HTTPS stacks are battle tested and there are multiple of them. So is DNS. I wonder how the HTTP servers deal with DNS amplification attacks. > People running a DNS resolver likely have the ability to run a good HTTPS server already Your…

> Is there anything left, that's not on HTTP? Maybe NTP.

OpenNTPD also uses HTTPS (TLS, technically) by default [0].

Fortunately, they aren't yet trying to tunnel actual NTP packets over HTTP or anything like that, just using the information in the "Date: " header as a sanity check.

[0]: https://www.undeadly.org/cgi?action=article&sid=201502101036...

Re: Firefox’s Trusted Recursive Resolver DNS feature is dangerous

#147

Post by nebulous1 »

Xylakant wrote: post #107
nebulous1 wrote: post #99

Earlier quoted context omitted.

> The whole point of HTTPS and DNS-over-HTTPS is to not share any data at all with your provider. It’s not entirely working right now due to SNI being plaintext, but work is being done on that, too. So that’s really not a good argument. If that was the whole point of https then we wouldn't have plaintext SNI. I can't even begin to understand why you think that there being a draft of an SNI encryption standard makes i…

Originally, HTTPS required a dedicated IP address (or at least a dedicated IP/Port pair) for the server. SNI is a tack-on on TLS to fix that, so that TLS can be deployed more widely, allowing to encrypt traffic that was plaintext before. Encrypted SNI is a tack-on to fix that SNI needs to transmitted in plaintext. So yes, the design goal of HTTPS is to hide as much information from all intermediaries as possible. It’…

Well, I can't get behind saying that hiding the site your visiting from your provider is the "whole point" of https when it specifically doesn't do that. I mean, we both understand what https is aiming to do in general, and I assume you aren't suggesting that https has been an complete failure since SNI was introduced.

However, admittedly I'm just reacting to you using the term "whole point" in conjunction with something it's failing to do.

Re: Firefox’s Trusted Recursive Resolver DNS feature is dangerous

#148

Post by angry_octet »

I know my ISP is required by govt to log all meta data (websites, IPs, email headers). If I'm not using a VPN, it's all logged. Encrypted SNI is coming, but without encrypted DNS it's all still logged. So it seems like a net win, even if cloudflare is logging everything.

Too bad dnscurve hasn't taken off more.

Re: Firefox’s Trusted Recursive Resolver DNS feature is dangerous

#149

Post by patrickmcmanus »

lol768 wrote: post #94
jillesvangurp wrote: post #61

DNS over HTTPS is a great idea. There's nothing wrong with the protocol or Mozilla's implementation of it. This article is all about Mozilla's default choice for a DNS provider. I think Cloudflare is actually a reasonable choice though I'm not a big fan of their annoying captchas that I get served whenever I use vpns. There's nothing sneaky going on here; which the article seems to imply. Currently there is no UI to…

>DNS over HTTPS is a great idea Why is it better than DNS over TLS? All I can see here is increased overhead.

https://bitsup.blogspot.com/2018/05/the-benefits-of-https-fo...

Re: Firefox’s Trusted Recursive Resolver DNS feature is dangerous

#150

Post by Xylakant »

_Codemonkeyism wrote: post #141
Xylakant wrote: post #127

Earlier quoted context omitted.

Most Firefox users are absolutely unaffected by this. Literally all people that don’t explicitly enable this. All those who do might want to make up their mind if they want to participate in this and if they want CF to be their provider of trust. Keep in mind that CF will see a substantial chunk of the traffic anyways. Mozilla seems to be confident in that agreement and I have a certain amount of trust in Mozilla whi…

FF will turn this on for everybody and Cloudflare will be the default 2018? Don't know. 2019? For sure. All FF browsing meta data flows into the US, the country with the most spies and no legal framework to go to court. So your argument is an obvious straw man and one wonders about your motivations to support getting all the browsing meta data into the US by default. Moving my data from Germany to the US will not mak…

Why do you believe that this will be default on at any time in the near future without a reasonable configuration UI and without a reasonable set of DoH-capable nameservers? Especially given that this would break a substantial number of existing setupts? If you have this little faith into the FF/Mozilla folks, why do you keep using FF? If you’re not using Firefox, what are you concerned about?
Post reply on HN