Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Firefox’s Trusted Recursive Resolver DNS feature is dangerous

blog.ungleich.ch

Post reply on HN
Print view View original

191–200 of 306 posts

Re: Firefox’s Trusted Recursive Resolver DNS feature is dangerous

#191

Post by nebulous1 »

jopsen wrote: post #164
nebulous1 wrote: post #70

Earlier quoted context omitted.

The article doesn't suggest there's something sneaky going on. The article is suggesting that Mozilla are choosing to share your DNS queries with a third party service by default, which is exactly what they're doing. It's not about them choosing Cloudflare in particular, it's about them choosing any particular service by default. And the article's argument that, if you have to choose somebody to share this data with,…

So.. in some future Mozilla might select a default DNS provider on your behalf. Did you consider the upside? Mozilla can negotiate on your behalf. Mozilla can obtain favorable terms of service, concessions in privacy, third-party reviews. Things you would never be able to negotiate for. If you think of Mozilla as negotiating on your behalf, they have motive to protect you, and they have the leverage to get concession…

I can't see myself ever supporting this as opt-out rather than opt-in.

Re: Firefox’s Trusted Recursive Resolver DNS feature is dangerous

#192

Post by cptskippy »

telmich wrote: post #46
chrismorgan wrote: post #42

Earlier quoted context omitted.

I live in Australia; ISPs are basically all big entities, altogether unworthy of trust. The US is broadly similar. In both countries, you do get some obscure tiny ISPs, but they’re fairly rare overall. I’ve also spent time in India with a small ISP, and I hated their DNS: they actively intercepted all DNS and replaced it with their own OpenDNS arrangement, involving the horrible NXDOMAIN replacement that was still a…

I get the point. If your ISP is also not trustworthy, the situation probably does not change much for you. Then again, maybe the right solution is to look at how to get back trustworthy ISPs.

Which is a goal to strive for as well however this endeavor is still valid as the client can be mobile and transient across ISPs. So until you can trust all Is as you might come into contact with, having a secure and hardened client is the better of the two.

Re: Firefox’s Trusted Recursive Resolver DNS feature is dangerous

#193

Post by vetinari »

PappaPatat wrote: post #123
lol768 wrote: post #94

Earlier quoted context omitted.

>DNS over HTTPS is a great idea Why is it better than DNS over TLS? All I can see here is increased overhead.

Since HTTP(S) basically works everywhere and a new port (DNS over TLS on standard port 853) is guaranteed not to work everywhere.

Once DNS-over-HTTPS starts creating problems, port 443 to well-known IPs will be also not guaranteed to work everywhere.

Re: Firefox’s Trusted Recursive Resolver DNS feature is dangerous

#194

Post by cptskippy »

simias wrote: post #32
mhkool wrote: post #3

I rather use a DNS cloud that promises to wipe logs every 24 hours than a DNS server of an ISP who is guaranteed to spy on me.

I host my own DNS resolver on a dedicated server, Firefox hijacking my DNS traffic without telling me is definitely not an improvement. It can be a nice feature in some situations but having it activated by default without explicit consent should be a big no-no. I hate this mentality of "our users are complete idiots and we know what's good for them" (I call it the "Gnome" mentality).

I am of the same opinion and this is an experimental feature turned off by default which is why there is no UI for it.

I am imagining that if it goes live the UI will probably be like the Search Engine configuration with a default you can easily change.

Still annoying to have to change and almost impossible to notice if it should change, but not as bad as it's being made out to be.

Re: Firefox’s Trusted Recursive Resolver DNS feature is dangerous

#195

Post by vetinari »

Xylakant wrote: post #157
_Codemonkeyism wrote: post #144

Earlier quoted context omitted.

For many it is, but for billions it isn't. For those where it is an improvement they can opt in.

I think you substantially overestimate the number of providers that behave ethically with regards to DNS and substantially underestimate how many people have shitty ISPs. You seem to have a very skewed view of how the number of internet users distributes across the world. Even in Europe, providers are not refraining from hijacking DNS and using DNS blocks for certain sites.

I think you substantially underestimate the number of networks that use split-horizon DNS for their functioning, and where hijacking the DNS is going to cause significant breakage.

Re: Firefox’s Trusted Recursive Resolver DNS feature is dangerous

#196

Post by vetinari »

pard68 wrote: post #105
ahnick wrote: post #95

Earlier quoted context omitted.

If this is true, then I'm okay with the feature being available if it is opt-in. Although I generally think this is a concern better left outside of the particular browser I'm using. If I want to route DNS queries through a third party then I'd like to do that for all my network traffic, not just my browser.

I agree. I use DNSCrypt and route my requests through a different server each time. That said, Joe User doesn't know how to setup any DNS server. Even going into Window's Control Panel gets Joe User anxious. Joe User doesn't care enough about privacy to learn how to set it up system wide. And for Joe User this would cover 99% of his internet usage.

And break his favourite BYOB device that he brings to the work.

Re: Firefox’s Trusted Recursive Resolver DNS feature is dangerous

#197

Post by cptskippy »

telmich wrote: post #69

If you agree and think it's dangerous, help us to spread the word on twitter https://twitter.com/ungleich/status/1026041643340845057 - maybe it helps to make Mozilla rethink this "feature".

Think what is dangerous? Encrypted DNS? Choosing a DNS provider you don't like for an experimental feature because the support that feature? Trying to make the web safer and less creepy?

I think you have a fundamental misunderstanding of what is this experiment is configured the way it is and you're just being a Chicken Little.

Re: Firefox’s Trusted Recursive Resolver DNS feature is dangerous

#198

Post by vetinari »

hkai wrote: post #67
xg15 wrote: post #52

Earlier quoted context omitted.

> They’re commonly expressly allowed by law to share roughly whatever they like about you†, and they are known to do so. Why would this not apply to Cloudflare as well?

Because you may live in a country where the government is much more hostile than cloudflare.

Those of us, who live in democracy, can do something about our government. We can do zilch about Cloudflare, when they do something wrong.

Re: Firefox’s Trusted Recursive Resolver DNS feature is dangerous

#199

Post by the8472 »

Aissen wrote: post #113
kevingadd wrote: post #103

Earlier quoted context omitted.

It's important to understand the advantages of HTTPS via other protocols or custom crypto: * HTTPS stacks are battle tested and there are multiple of them. Browsers in particular already ship a heavily maintained one that performs great, so using DNS on top of it gets all those benefits. Because there are multiple stacks the risk of people settling on a monoculture is a lot lower. * People running a DNS resolver like…

You forgot the more pragmatic reason: middleboxes. HTTPS works everywhere, and introducing a new(2 years old) protocol (DNS over TLS) working on a new port (853) is a sure way to make sure it does not work in many places.

That mostly applies to corporate environments which already want to use their own resolvers anyway. For most people DNS over dTLS should work fine and if anything should be implemented on the OS level.

Your browser is not special, everything could benefit from secure DNS.

Re: Firefox’s Trusted Recursive Resolver DNS feature is dangerous

#200

Post by vetinari »

rendx wrote: post #22

The article lacks instructions about disabling it or using some other DOH resolvers. about:config -> search for network.trr -> set network.trr.mode = 5 to completely disable it (I do not recommend this) The curl wiki has a list of DOH servers: https://github.com/curl/curl/wiki/DNS-over-HTTPS It should also point to "the other side of the story", the benefits of DOH over classic DNS resolving, for example https://hack…

Manually setting static resolvers is not adequate in many scenarios.

For example, when the user roams among several networks, and each of them has split-horizon DNS, the user is not going to re-set their setting after connecting to each specific network. Throw in VPN connections and their DNS settings, and you have quite a problem at hand.

There's a reason why DNS settings are traditionally set system-wide via DHCP, not statically. This is a step backwards.

Post reply on HN