Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Encrypted SNI Comes to Firefox Nightly

blog.mozilla.org

Post reply on HN
Print view View original

41–50 of 155 posts

Re: Encrypted SNI Comes to Firefox Nightly

#41

Post by orf »

AndyMcConachie wrote: post #38
the8472 wrote: post #25

Earlier quoted context omitted.

It's even worse. To use ESNI you need DOH. To use DOH you need a resolver with a server certificates, which is kindly offered by the same cloud providers. So now all your base are belong to cloudflare.

It's even worse because they talk like ESNI is some kind of standard, but there's only been a single draft at the IETF written by a Mozilla employee, and that draft is still at version 1. Calm down Mozilla, maybe other people would like to comment on the design before you go and implement it? Doing it like this is a great way to end up in interopeability hell down the road when different parties have implemented diff…

Why does Chrome get to do this but not Mozilla? Why is field testing such an implementation a bad thing? What do more comments add over real, concrete data (up to a point)?

Re: Encrypted SNI Comes to Firefox Nightly

#42

Post by eridius »

the8472 wrote: post #25
cremp wrote: post #12

Is it me or... > If they’re willing to convert all their customers to ESNI at once Why does it seem like this is over-engineering at it's finest? Not only are CDNs now part of the problem/solution space, but they are now dictating. It is now that much harder to diagnose issues when they do crop up, instead of checking ping or nslookup. Now, you've got to see if the DNS-over-HTTPS/The DNS record itself/Host/client/any…

It's even worse. To use ESNI you need DOH. To use DOH you need a resolver with a server certificates, which is kindly offered by the same cloud providers. So now all your base are belong to cloudflare.

None of this is tied to Cloudflare though. Or really to using a cloud provider at all. Of course, if you're not using a cloud provider, then the IP address can be used to figure out what the site is, but the point remains that you can pick from any cloud provider that supports ESNI (and, separately, pick from any DNS provider that supports DOH).

At the moment if you want ESNI it looks like you have to use Cloudflare, but the solution to that is to encourage other cloud providers to support ESNI rather than to decry the notion of ESNI.

Re: Encrypted SNI Comes to Firefox Nightly

#43

Post by bryanlarsen »

AndyMcConachie wrote: post #38
the8472 wrote: post #25

Earlier quoted context omitted.

It's even worse. To use ESNI you need DOH. To use DOH you need a resolver with a server certificates, which is kindly offered by the same cloud providers. So now all your base are belong to cloudflare.

It's even worse because they talk like ESNI is some kind of standard, but there's only been a single draft at the IETF written by a Mozilla employee, and that draft is still at version 1. Calm down Mozilla, maybe other people would like to comment on the design before you go and implement it? Doing it like this is a great way to end up in interopeability hell down the road when different parties have implemented diff…

IETF standards require prior implementation and testing.

Re: Encrypted SNI Comes to Firefox Nightly

#44

Post by zzzcpan »

codetrotter wrote: post #37
zzzcpan wrote: post #24

Earlier quoted context omitted.

Someone could still make a very reasonable assumption based on IP addresses and response sizes, which is where I believe the primary focus would shift if by some chance this encrypted SNI becomes impossible to circumvent. But also someone could just block DNS-over-HTTPS requests altogether and force Firefox into cleartext DNS and therefore circumvent encrypted SNI. It also centralizes DNS requests at Cloudflare's POP…

> someone could just block DNS-over-HTTPS requests altogether If you are going to block DoH you’ll need to block all HTTPS traffic altogether, don’t you? I mean unless you are just blocking traffic to some list of known DoH providers.

DoH must be bootstrapped somehow to get IP addresses to make requests to. This is where it can be blocked. Either blocking DNS query or a known IP address or just an IP address with suspiciously tiny responses that responds to active probing requests as a DoH server. It's very hard to hide that fact, you need to actively fight those blocking attempts. And if it's done by some government, corporations just bend over backwards to help censorship, like they did in cases of Signal and Telegram recently for example.

Re: Encrypted SNI Comes to Firefox Nightly

#45

Post by zzzcpan »

toomuchtodo wrote: post #30
zzzcpan wrote: post #28

Earlier quoted context omitted.

> There are benefits (censorship circumvention) to be reaped, but also great peril. There is no way this encrypted SNI could enable censorship circumvention.

My understanding was that encrypted SNI was to avoid the sniffing of the host header that travels unencrypted with SNI, and that in combination with a large host (Cloudflare, Google, AWS), an encrypted SNI prevents censorship (unless you're dropping all traffic to the IP block or AS). Is this understanding inaccurate?

This is what was their public reasoning, but it ignores all the research and ideas in censorship circumvention from Tor, Signal, Telegram, why domain fronting didn't work and why collateral freedom doesn't work if there is a corporation to pressure, etc. At this point I believe it was entirely PR if not deception to centralize DNS.

Re: Encrypted SNI Comes to Firefox Nightly

#46

Post by hannob »

mholt wrote: post #27

So what's the plan for when IPv6 gains more adoption and we don't need SNI as much since every site can have its own public IP address (thus making tracking easier, subverting the benefits of encrypted SNI). Do you think encrypted SNI and NAT will become preferred to using IPv6 for routing because of the privacy benefits of ESNI (either real or imagined, depending on who you trust, since this seems to be relying on c…

> So what's the plan for when IPv6 gains more adoption

Our great great grandchildren will surely figure something out.

Re: Encrypted SNI Comes to Firefox Nightly

#47

Post by Brybry »

drb91 wrote: post #21
cremp wrote: post #17

Earlier quoted context omitted.

They can't, because that's handled at the OS level, not the application level. If a browser starts (purposefully) subverting the hosts file or not adhering to resolv addresses, then we've got a bigger problem. Think, a fat client resolving an address differently than a browser; then that's all sort of Pandora's Box.

DNS over HTTPS is still handled at the OS level? Related, it should be possible to have “correct” dns in userland that behaves as you describe sans falling back to the system resolver. In my understanding the whole point of DNS over https is to avoid the DHCP assigned DNS address (and of course encrypt) Finally, I’m pretty sure Firefox at least does its own dns caching. I’ve had to force reload to pick up dns changes…

I think the typical way to do DNS over HTTPS is to run a DoH client/DNS proxy and then point your nameservers at localhost.

I'm not really sure what benefit there is to doing this compared to DNS over TLS with a resolver like Unbound but I suppose that's a different discussion.

What Firefox seems to be doing, unless I'm mistaken, is running their own resolver that implements DoH/connects to Cloudflare and bypasses OS settings.[1][2]

I haven't dug into the details yet to see how it interacts with the hosts file.

It does sound like it falls back to the OS if it fails to resolve with DoH but this solution at first glance appears unideal.

Wouldn't it be best if Microsoft/Apple/*nix distros/ISPs/third party nameservers used resolvers and nameservers that support DNS over TLS?

Then end users/administrators could choose who they trust and everything would still be encrypted.

[1] https://wiki.mozilla.org/Trusted_Recursive_Resolver

[2] https://bugzilla.mozilla.org/show_bug.cgi?id=1434852

Re: Encrypted SNI Comes to Firefox Nightly

#48

Post by ploxiln »

tptacek wrote: post #19
toomuchtodo wrote: post #16

Earlier quoted context omitted.

It's not you. It's a combination of startups and incumbent tech behemoths attempting to operate outside of the formalized process for internet standards by using their market power to push for the change they deem appropriate. There are benefits (censorship circumvention) to be reaped, but also great peril.

Funny, I think we've had exactly the opposite problem . See, for instance, Heartbleed, which is pure product of IETF standardization of a feature no mainstream commercial entity asked for.

It was not required to implement the tls heartbeat feature, and IIRC most tls implementations did not implement it - except for openssl. The real problem there was openssl (and it was a big problem, being both the widespread default choice, and too hairy for most competent engineers to bother to dig into, at the same time ...)

Re: Encrypted SNI Comes to Firefox Nightly

#49

Post by the8472 »

eridius wrote: post #42
the8472 wrote: post #25

Earlier quoted context omitted.

It's even worse. To use ESNI you need DOH. To use DOH you need a resolver with a server certificates, which is kindly offered by the same cloud providers. So now all your base are belong to cloudflare.

None of this is tied to Cloudflare though. Or really to using a cloud provider at all. Of course, if you're not using a cloud provider, then the IP address can be used to figure out what the site is, but the point remains that you can pick from any cloud provider that supports ESNI (and, separately, pick from any DNS provider that supports DOH). At the moment if you want ESNI it looks like you have to use Cloudflare,…

> (and, separately, pick from any DNS provider that supports DOH).

But why do I have to? I already have a trusted DNS resolver operated by myself wired to my OS. Why require the whole DoH rube goldberg machinery to let me try ESNI?

Re: Encrypted SNI Comes to Firefox Nightly

#50

Post by mehrdadn »

Someone1234 wrote: post #33
mholt wrote: post #27

So what's the plan for when IPv6 gains more adoption and we don't need SNI as much since every site can have its own public IP address (thus making tracking easier, subverting the benefits of encrypted SNI). Do you think encrypted SNI and NAT will become preferred to using IPv6 for routing because of the privacy benefits of ESNI (either real or imagined, depending on who you trust, since this seems to be relying on c…

You could ignore the eSNI on the web server completely if you wished. But even on HTTP servers serving only a single IP it is still typical to only respond to requests targeting the correct hostname (i.e. direct IP requests are bounced). There's numerous reasons to bounce direct (non-hostname) requests including: - Discourage users visiting via the IP Address, adding that to favorites, sharing it, etc. Making it diff…

I understood the question wasn't whether SNI is useless, but whether its primary goal of making it difficult to track website connections is being at least partially subverted by IPv6.
Post reply on HN