Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Firefox’s Trusted Recursive Resolver DNS feature is dangerous

blog.ungleich.ch

Post reply on HN
Print view View original

181–190 of 306 posts

Re: Firefox’s Trusted Recursive Resolver DNS feature is dangerous

#181

Post by crtasm »

telmich wrote: post #173
mcny wrote: post #143

Sorry if this is off topic but where does DNS over https leave my pi hole? Is it possible (in the future) to do dns over https from my router to the pihole and then dns over https from the pihole to Google or Cisco open DNS? How would it work? Wouldn’t the router need to trust the https certificate that my pihole presents? Thank you!

That would work. DoH is "just" a replacement for UDP in this context. However when Mozilla changes the default to DoH of Cloudflare, you will need to manually change all firefox installations.

Other posters on this thread point out that Firefox has no plans to make it a default.

Re: Firefox’s Trusted Recursive Resolver DNS feature is dangerous

#183

Post by the8472 »

Mister_Snuggles wrote: post #140
qiqitori wrote: post #15

More information: https://blog.nightly.mozilla.org/2018/06/01/improving-dns-pr... According to this page: - you can already test this right now - you can provide your own server And some more: https://en.wikipedia.org/wiki/DNS_over_HTTPS

> - you can provide your own server How do I RUN my own server? A few minutes of Googling hasn't revealed any DNS-over-HTTPS server that appears production-ready.

You don't need DoH for that. Just use a VPN and configure it to replace your host's resolver as long as it is up.

Another advantage of using standard UDP-based DNS over a UDP-based VPN is that it can reorder packets in flight, so it should have lower latency than anything TCP-based.

Re: Firefox’s Trusted Recursive Resolver DNS feature is dangerous

#184

Post by the8472 »

chrismorgan wrote: post #28

> My local ISP seems more trustworthy to me than a big US-based corporate which acts under the guise of a selfless privacy rights defender. I have never trusted any local ISP. They’re commonly expressly allowed by law to share roughly whatever they like about you†, and they are known to do so . Cloudflare has at least promised not to be evil, and is to be audited annually concerning it. If they desire to be evil I ha…

Cloudflare has already received NSLs. Once they provide both encrypted DNS and TLS-termination for a good chunk of the internet they'll become a juicy target for the three letter agencies and you might not know about it for years.

If you don't live in the US a local ISP might be a lesser evil and I wonder why mozilla should make that tradeoff for everyone.

Sure, some jurisdictions might be worse than the US and TRR might be a win there. But for some it's worse. So we shouldn't pretend it's a one-size-fits all solution.

Re: Firefox’s Trusted Recursive Resolver DNS feature is dangerous

#185

Post by tempest473 »

paganel wrote: post #153
true_religion wrote: post #88

Earlier quoted context omitted.

It may surprise you, but not everyone believes the military is evil, and thus working with them is evil.

Speaking for the US now (this is an outside view) but to me it looks like institutions such as the CIA or the NSA are indeed seen as evil by the majority of the public. Now, both the NSA and the CIA would mean nothing in the medium and long span of time if it weren’t for the power projected and often times actually exercised by the US military. As such, one can be forgiven for looking at the military as “bad”, if onl…

For me this comparison is seams false as it would work the same way if you replaced "military" with "US taxpayer".

Re: Firefox’s Trusted Recursive Resolver DNS feature is dangerous

#186

Post by ferongr »

foepys wrote: post #66
chrismorgan wrote: post #28

> My local ISP seems more trustworthy to me than a big US-based corporate which acts under the guise of a selfless privacy rights defender. I have never trusted any local ISP. They’re commonly expressly allowed by law to share roughly whatever they like about you†, and they are known to do so . Cloudflare has at least promised not to be evil, and is to be audited annually concerning it. If they desire to be evil I ha…

> Cloudflare has at least promised not to be evil Remember when Google did so, too? Then they bid on military contracts and bought a military contractor.

Cloudfare engaged in censorship so they've already broken that promise.

Re: Firefox’s Trusted Recursive Resolver DNS feature is dangerous

#187

Post by the8472 »

kevingadd wrote: post #103
pmlnr wrote: post #97

Earlier quoted context omitted.

> DNS over HTTPS is a great idea Putting everything, even lower-than-http level things on top of HTTP is a horrible idea, introducing yet another layer of abstraction.

It's important to understand the advantages of HTTPS via other protocols or custom crypto: * HTTPS stacks are battle tested and there are multiple of them. Browsers in particular already ship a heavily maintained one that performs great, so using DNS on top of it gets all those benefits. Because there are multiple stacks the risk of people settling on a monoculture is a lot lower. * People running a DNS resolver like…

HTTPS gives you the packet ordering costs of TCP and the handshake costs of TLS.

With an SSH-like key setup - i.e. just getting the server's pubkey on first use and rolling it over when it advertises a new one - you could asymmetrically encrypt every request in a single UDP packet and thus gain the same security and lower 99'tile latency.

Re: Firefox’s Trusted Recursive Resolver DNS feature is dangerous

#189

Post by Mister_Snuggles »

the8472 wrote: post #183
Mister_Snuggles wrote: post #140

Earlier quoted context omitted.

> - you can provide your own server How do I RUN my own server? A few minutes of Googling hasn't revealed any DNS-over-HTTPS server that appears production-ready.

You don't need DoH for that. Just use a VPN and configure it to replace your host's resolver as long as it is up. Another advantage of using standard UDP-based DNS over a UDP-based VPN is that it can reorder packets in flight, so it should have lower latency than anything TCP-based.

Sure, I don't NEED it right now, but it feels like DNS-over-HTTPS will become non-optional at some point.

I hope I'm wrong about that, but I'd like to prepare a little bit in case I'm right.

Re: Firefox’s Trusted Recursive Resolver DNS feature is dangerous

#190

Post by superkuh »

ekianjo wrote: post #78
chrismorgan wrote: post #28

> My local ISP seems more trustworthy to me than a big US-based corporate which acts under the guise of a selfless privacy rights defender. I have never trusted any local ISP. They’re commonly expressly allowed by law to share roughly whatever they like about you†, and they are known to do so . Cloudflare has at least promised not to be evil, and is to be audited annually concerning it. If they desire to be evil I ha…

Cloudfare can promise what they want, they can still be subject to warrantless spying by US agencies and not disclose anything about it.

And lets not forget that their CEO will arbitrarily censor and stop serving people he doesn't like. He's done it before. He'll do it again. Cloudflare has already lost my trust.
Post reply on HN