Firefox’s Trusted Recursive Resolver DNS feature is dangerous • Hacker News Board

Re: Firefox’s Trusted Recursive Resolver DNS feature is dangerous

#161

Post by Xylakant » Sun, Aug 05, 2018, 1:26 PM UTC

xg15 wrote: post #159

Xylakant wrote: post #75

Earlier quoted context omitted.

Maybe all the users that turn TRR on in the first place? It’s default off and you need to enable it in the expert configuration menu. I don’t expect it to be enabled by default without a reasonable config UI.

The article states that DoH will become on-by-default in september. In general, I find it highly unlikely that it will stay off-by-default forever, because there is no way to have any meaningful adoption of it as an expert-only feature.

The article is wrong.

Nothing in Mozilla’s communication even hints at DoH becoming default on any time in the nearer future. I’m certain Mozilla would like encrypted DNS by default, but not at all cost. It will probably land as a generally available feature in September, but still default to off and still be behind about:config. There are many expert features hidden in about:config that might never become default or only after a substantial shakedown period. Third party isolation, for example. So it would not entirely surprise me if DoH would remain an expert feature for a long time. And I’m certain it won’t become default on without a very clear config UI. Messing with name resolution has massive impact on a lot of setups.

Re: Firefox’s Trusted Recursive Resolver DNS feature is dangerous

#162

Post by floatingatoll » Sun, Aug 05, 2018, 1:27 PM UTC

ekianjo wrote: post #78

chrismorgan wrote: post #28

> My local ISP seems more trustworthy to me than a big US-based corporate which acts under the guise of a selfless privacy rights defender. I have never trusted any local ISP. They’re commonly expressly allowed by law to share roughly whatever they like about you†, and they are known to do so . Cloudflare has at least promised not to be evil, and is to be audited annually concerning it. If they desire to be evil I ha…

Cloudfare can promise what they want, they can still be subject to warrantless spying by US agencies and not disclose anything about it.

As a user whose trust has already been broken by both ISPs and governments, I see no drawback in participating as a user in this public experiment. What you describe as a drawback is a privacy improvement for me.

The DNS implementation used by every non-Tor user around the world today is already subject to warrantless spying by every ISP and government in the world, due to the property known as “cleartext”. If you opt-in to the Cloudflare trial, you are only at risk of warrantless spying by Cloudflare — rather than every ISP — and the US government — rather than every government.

My cellular ISP sells my DNS queries to advertising networks, and my home ISP is wiretapped warrantlessly by the US government. This experiment decreases the chances of the resale of my personalized data to data warehouses and decreases the chances of success of warrantless wiretapping by my government.

I envy those of you that believe you can trust your ISPs and governments.

Re: Firefox’s Trusted Recursive Resolver DNS feature is dangerous

#163

Post by Xylakant » Sun, Aug 05, 2018, 1:31 PM UTC

nebulous1 wrote: post #147

Xylakant wrote: post #107

Earlier quoted context omitted.

Originally, HTTPS required a dedicated IP address (or at least a dedicated IP/Port pair) for the server. SNI is a tack-on on TLS to fix that, so that TLS can be deployed more widely, allowing to encrypt traffic that was plaintext before. Encrypted SNI is a tack-on to fix that SNI needs to transmitted in plaintext. So yes, the design goal of HTTPS is to hide as much information from all intermediaries as possible. It’…

Well, I can't get behind saying that hiding the site your visiting from your provider is the "whole point" of https when it specifically doesn't do that. I mean, we both understand what https is aiming to do in general, and I assume you aren't suggesting that https has been an complete failure since SNI was introduced. However, admittedly I'm just reacting to you using the term "whole point" in conjunction with somet…

I’m not suggesting https is a complete failure. I’m saying that HTTPS hasn’t yet achieved all that it intended to cover. It does the best it can given current real world constraints. That requires tradeoffs. But work is done to improve the situation and I’m generally happy for every feature that pushes the needle in the right direction.

Re: Firefox’s Trusted Recursive Resolver DNS feature is dangerous

#164

Post by jopsen » Sun, Aug 05, 2018, 1:37 PM UTC

nebulous1 wrote: post #70

jillesvangurp wrote: post #61

DNS over HTTPS is a great idea. There's nothing wrong with the protocol or Mozilla's implementation of it. This article is all about Mozilla's default choice for a DNS provider. I think Cloudflare is actually a reasonable choice though I'm not a big fan of their annoying captchas that I get served whenever I use vpns. There's nothing sneaky going on here; which the article seems to imply. Currently there is no UI to…

The article doesn't suggest there's something sneaky going on. The article is suggesting that Mozilla are choosing to share your DNS queries with a third party service by default, which is exactly what they're doing. It's not about them choosing Cloudflare in particular, it's about them choosing any particular service by default. And the article's argument that, if you have to choose somebody to share this data with,…

So.. in some future Mozilla might select a default DNS provider on your behalf.

Did you consider the upside?

Mozilla can negotiate on your behalf. Mozilla can obtain favorable terms of service, concessions in privacy, third-party reviews. Things you would never be able to negotiate for.

If you think of Mozilla as negotiating on your behalf, they have motive to protect you, and they have the leverage to get concessions from 3rd party vendors.

Think of Mozilla as using the collective bargaining power of it's user-base to get favorable terms. This could be a game changer.

Re: Firefox’s Trusted Recursive Resolver DNS feature is dangerous

#165

Post by jopsen » Sun, Aug 05, 2018, 1:40 PM UTC

_Codemonkeyism wrote: post #124

Xylakant wrote: post #89

Earlier quoted context omitted.

The default applies currently if you enable an experimental feature. They hammered out a tight privacy agreement for one service and use that as default while this is stabilized. You can pick any other resolver if you prefer. Seems a legit way of handling this. > And the article's argument that, if you have to choose somebody to share this data with, it might as well be the people you already share it with, seems pre…

Cloudflare is an US company, their privacy statement is worth zero to most Firefox users.

I believe Mozillas goal is to use the collective bargaining power of it's user-base to get favorable terms and conditions from vendors like cloudflare.

This could include 3rd party reviews, etc.. Who knows?

Re: Firefox’s Trusted Recursive Resolver DNS feature is dangerous

#166

Post by the8472 » Sun, Aug 05, 2018, 1:43 PM UTC

angry_octet wrote: post #148

I know my ISP is required by govt to log all meta data (websites, IPs, email headers). If I'm not using a VPN, it's all logged. Encrypted SNI is coming, but without encrypted DNS it's all still logged. So it seems like a net win, even if cloudflare is logging everything. Too bad dnscurve hasn't taken off more.

But you don't need to depend on cloudflare here. If you have a VPN you can also tunnel your DNS lookups to a custom resolver through the VPN.

Re: Firefox’s Trusted Recursive Resolver DNS feature is dangerous

#167

Post by Xylakant » Sun, Aug 05, 2018, 1:44 PM UTC

xg15 wrote: post #158

orf wrote: post #126

Earlier quoted context omitted.

Do you seriously believe that Mozilla is issuing a patch in September that will somehow force you to use Cloudflare as a DNS provider? That 'any DNS change you configure in your network won't have any effect anymore'? Do you know many setups that would break? Of course the article is wrong. Classic FUD.

Actually, yes, I do. From their blog: > We believe that negotiating a privacy first operating agreement is something that Firefox can do for people that is just impractical to ask them to do for themselves. Imagine calling up your residential ISP and asking them to agree to an audit that demonstrates they do not log your IP address on their DNS server. And then repeating the process for your favorite coffee shop, lib…

And you expect that to happen within the next month? Without any warning that it will happen with the 62 release? After they have just started an experiment intended to shake down the feature on both the server and the client side? Even after having it default off in nightly? With no practical experience of how a large-scale DoH setup behaves in a real-world environment? Breaking all setups that use an internal DNS to resolve internal names (such as any larger-scale corporate setup)?

If you intend to say “sometime in the unspecified future Mozilla will probably default to this.”, then I’d agree but this is not what’s being discussed. At that point in the future, the whole environment in which this is operating in will look different. More DoH-capable providers, a better understanding of the benefits and drawbacks, a config UI,...

Re: Firefox’s Trusted Recursive Resolver DNS feature is dangerous

#168

Post by Xylakant » Sun, Aug 05, 2018, 1:45 PM UTC

jopsen wrote: post #165

_Codemonkeyism wrote: post #124

Earlier quoted context omitted.

Cloudflare is an US company, their privacy statement is worth zero to most Firefox users.

I believe Mozillas goal is to use the collective bargaining power of it's user-base to get favorable terms and conditions from vendors like cloudflare. This could include 3rd party reviews, etc.. Who knows?

Cloudflare agreed to having the DNS infrastructure audited, something that does set it apart from a lot of ISPs. So that seems to be working.

Re: Firefox’s Trusted Recursive Resolver DNS feature is dangerous

#169

Post by jopsen » Sun, Aug 05, 2018, 1:45 PM UTC

silvestrov wrote: post #53

chrismorgan wrote: post #28

> My local ISP seems more trustworthy to me than a big US-based corporate which acts under the guise of a selfless privacy rights defender. I have never trusted any local ISP. They’re commonly expressly allowed by law to share roughly whatever they like about you†, and they are known to do so . Cloudflare has at least promised not to be evil, and is to be audited annually concerning it. If they desire to be evil I ha…

> (This is a gross simplification, but it’s broadly true enough in most countries.) Seems like you forget Europe and e.g. GDPR. It would be a big no-no in Denmark: My bank has one division for normal accounts and another for mastercard. The 2 divisions are separate companies, so I have to sign a paper to allow the MasterCard division to know about my normal account. So Danes have no hesitation giving out personal inf…

What prevents them from selling aggregated DNS statistics?

For what was queried on their servers.

Re: Firefox’s Trusted Recursive Resolver DNS feature is dangerous

#170

Post by kingofhdds » Sun, Aug 05, 2018, 1:46 PM UTC

_Codemonkeyism wrote: post #132

kingofhdds wrote: post #86

There are many countries where ISPs are obliged by law to spy on users, and retain logs for many years. DNS manipulation also used as a cheap censorship mechanism. So Cloudflare easily can be a better option for hundreds of millions if not billions of people. As a rule, local actors present way more serious threat compared to US agencies for majority of the planet's population. That said, Mozilla, of course, must be…

So data is safest in the country with the largest spying budget and the most spies. Not convinced.

You are refuting the statement I never made. There's no such thing as general threat. So who's data? If you are Julian Assange you should be afraid of US spying agencies, but if you are an Uzbekistani dissident it's your gov't repressive machine you should care about, and tracking possibilities of your direct adversary will be diminished with the discussed Mozilla's move. If you are an average Joe in a small town you may find it safer to trust faraway commercial entity rather then your neighbor's nephew who works in a local ISP.