Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Encrypted SNI Comes to Firefox Nightly

blog.mozilla.org

Post reply on HN
Print view View original

141–150 of 155 posts

Re: Encrypted SNI Comes to Firefox Nightly

#141

Post by Ajedi32 »

xg15 wrote: post #135
tialaramex wrote: post #55

Earlier quoted context omitted.

Not _only_ about trust. One of the things DoH gets you for free is that it means that your ISP doesn't get to touch DNS requests, which was not true previously. You can get Internet service from whatever bunch of money-grabbing assholes are available where you live, and get DNS from somebody else without that being tampered with since it's encrypted on the wire. You do still have to trust the DoH provider (outside of…

Conventiently, the same will also apply to me trying to block apps from talking over the network with things they should not talk to.

You could always point your DNS at your own DNS-over-HTTPS server, then configure that server to forward requests over an encrypted connection to another DNS-over-HTTPS server.

Don't know if there are any tools available right now that will do that for you, but there's no technical reason why it isn't possible.

Re: Encrypted SNI Comes to Firefox Nightly

#142

Post by nine_k »

davidu wrote: post #139
floatingatoll wrote: post #85

Earlier quoted context omitted.

DNS is plaintext, like HTTP, so running your own resolves does nothing to protect your internet provider from selling your domains resolved list - in aggregate or in specific - to other companies for revenue. There are three well-known trusted public DNS resolvers, run by Cloudflare, Verizon, and Google. Which of those three would you encrypt your DNS traffic to, if those were the only three options available other t…

DNS does not need to be plaintext and DoH is not the only alternative. It's the alternative that the advertising engines and CDNs prefer because it extends control. The privacy of DNS argument is a major red herring. DNSCrypt (or DNS over TLS or DTLS) is a wonderful alternative that works in-band and works with DNSSEC. People are also ignoring the consequences of the switch from UDP to TCP.

I remember that DNS over HTTPS just landed recently in the generally-available Firefox 62?

Re: Encrypted SNI Comes to Firefox Nightly

#143

Post by dang »

comesee wrote: post #100
dagenix wrote: post #96

Earlier quoted context omitted.

That example does make a very strong case for the feature - which I guess was the point. But, the audience for the post already knows that encrypted SNI is and why it's important. And if they don't, a much more light-hearted example would do. And it's not like there is much of an anti-encrypted-SNI movement that warrants a powerful response. So, yeah, I'd agree it seemed both jarring and unnecessary.

Yeah not sure why I'm being downvoted. Imagine if the example was HIV.org or ebola.org, totally doesn't seem necessary.

Probably because of the "Shame on Mozilla" bit, which is a trope of the online callout/shaming culture, which we're trying to avoid here. The rest of your comment looks fine to me, and you're obviously speaking from hard experience, which makes comments much more substantive.

Re: Encrypted SNI Comes to Firefox Nightly

#144

Post by u801e »

rocqua wrote: post #129
floatingatoll wrote: post #85

Earlier quoted context omitted.

DNS is plaintext, like HTTP, so running your own resolves does nothing to protect your internet provider from selling your domains resolved list - in aggregate or in specific - to other companies for revenue. There are three well-known trusted public DNS resolvers, run by Cloudflare, Verizon, and Google. Which of those three would you encrypt your DNS traffic to, if those were the only three options available other t…

I think the specific question is: Why prefer `DNS over HTTPS` over e.g. `DNS over TLS`. The relevant matter is that DNS requests are encrypted. How exactly it is encrypted should not matter.

What about applications that communicate over protocols other than HTTP(S)?

Re: Encrypted SNI Comes to Firefox Nightly

#145

Post by auslander »

jgrahamc wrote: post #125
auslander wrote: post #123

Earlier quoted context omitted.

Thing is, it does bargain, and trusts third-party privacy policy, but I, for example, do not trust Cloudflare. "We’ve chosen Cloudflare because they agreed to a very strong privacy agreement" [0]. Like, legally agreed? With regular audits and full access for Mozilla people? Where does that leave me, if it gets baked into my browser? [0] https://blog.nightly.mozilla.org/2018/06/01/improving-dns-pr...

The quote you make there from your reference [0] has a link to the legal agreement with Cloudflare. It's here: https://developers.cloudflare.com/1.1.1.1/commitment-to-priv... So you can read the legal agreement. Of course, if you still don't want to use Cloudflare for DoH you can just configure your favourite resolver in Firefox itself. The blog you refer to as [0] contains detailed instructions on how to do that. So…

My concern is whether this integration with CF will make its way into default FF install.

Re: Encrypted SNI Comes to Firefox Nightly

#146

Post by tialaramex »

tptacek wrote: post #138
tialaramex wrote: post #117

Earlier quoted context omitted.

Thomas Ptacek (the guy whose blog post you've linked) agrees with Thomas Ptacek (tptacek, the guy whose sub-thread you're replying to)? Not exactly a revelation. Also Thomas has rejected the suggestion that the parts of his post that are now hopelessly wrong should be mentioned in the FAQ he prominently links. So, that post is wrong and explicitly won't be fixed, you should not rely on the "facts" in it unless you wa…

You keep alluding to parts of that post that are outdated, but you never provide specifics. I appreciate and will remember the concession that security for .COM is hopeless.

Actually I keep providing specifics which you ignore, for example the blog post declares that DNSSEC is "unsafe" because it can cause hostnames to be revealed and you give the example of Bank of America, owners of the bankofamerica.com domain for which you say such a policy "does not work so well".

But today actually FQDNs like 14021-nonprod.bankofamerica.com or whkgm04ye.hktskcy.apac.bankofamerica.com are not just accessible if you brute force DNS, they're automatically published, because Bank of America heavily relies, in fact, on the Web PKI and its issuers log the certificates.

It seems very strange to focus on the security for .COM when my point is that that entire TLD is badly run, it's like you're focused on how good the lock is on the front door (somebody call Deviant Ollam) at Lehman Brothers when the actual problem was they've invested all this money in worthless mortgage securities.

Re: Encrypted SNI Comes to Firefox Nightly

#147

Post by tptacek »

tialaramex wrote: post #146
tptacek wrote: post #138

Earlier quoted context omitted.

You keep alluding to parts of that post that are outdated, but you never provide specifics. I appreciate and will remember the concession that security for .COM is hopeless.

Actually I keep providing specifics which you ignore, for example the blog post declares that DNSSEC is "unsafe" because it can cause hostnames to be revealed and you give the example of Bank of America, owners of the bankofamerica.com domain for which you say such a policy "does not work so well". But today actually FQDNs like 14021-nonprod.bankofamerica.com or whkgm04ye.hktskcy.apac.bankofamerica.com are not just a…

That's simply false. Bank of America's public servers with TLS certificates are logged (which, by the way, is also an operational security problem for them), but their other services are not.

You've picked an odd point to quibble with, since there's not only NSEC and NSEC3 but now, after the last RWC, a proposed NSEC5 to address this supposed non-problem.

Re: Encrypted SNI Comes to Firefox Nightly

#148

Post by xg15 »

Ajedi32 wrote: post #141
xg15 wrote: post #135

Earlier quoted context omitted.

Conventiently, the same will also apply to me trying to block apps from talking over the network with things they should not talk to.

You could always point your DNS at your own DNS-over-HTTPS server, then configure that server to forward requests over an encrypted connection to another DNS-over-HTTPS server. Don't know if there are any tools available right now that will do that for you, but there's no technical reason why it isn't possible.

I think the problem will be apps with a DoH service hardwired. There wouldn't be anything for me to point anywhere short of patching the app.

Yes, apps could theoretically already do this today if the developers are willing to run their own endpoints. However, my guess is this will become vastly easier to do when there are already public DoH endpoints available to connect to.

Re: Encrypted SNI Comes to Firefox Nightly

#149

Post by jhabdas »

rqs wrote: post #98
koolba wrote: post #95

Earlier quoted context omitted.

If Bob works at your ISP, he could see the DNS queries before you even connect to the site. There’s work arounds for that as well but the average Joe isn’t going to set any of them up.

Of course. But what if DNS can also be encrypted?

What if it already was? https://dnscrypt.info/

Re: Encrypted SNI Comes to Firefox Nightly

#150

Post by jopsen »

auslander wrote: post #145
jgrahamc wrote: post #125

Earlier quoted context omitted.

The quote you make there from your reference [0] has a link to the legal agreement with Cloudflare. It's here: https://developers.cloudflare.com/1.1.1.1/commitment-to-priv... So you can read the legal agreement. Of course, if you still don't want to use Cloudflare for DoH you can just configure your favourite resolver in Firefox itself. The blog you refer to as [0] contains detailed instructions on how to do that. So…

My concern is whether this integration with CF will make its way into default FF install.

But if you do DNS resolution yourself you'll loose privacy.

You'll probably always be able to run your own. If you so desire.

Post reply on HN