Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

DNS-over-HTTPS Policy Requirements for Resolvers

blog.mozilla.org

Post reply on HN
Print view View original

61–70 of 301 posts

Re: DNS-over-HTTPS Policy Requirements for Resolvers

#61

Post by Tushon »

drexlspivey wrote: post #57
nykolasz wrote: post #27

I replied sub-thread, but adding here to give some more visibility to some of the issues DoH is causing and will cause: I work at a k12 school and I am involved on many k12 IT communities. Some schools already removed Firefox from the students computers because it was being used as a "VPN" by some elementary students to access porn - at school. Guess what this VPN was? Just DNS over HTTPS. There is a fine line betwee…

So the students are advanced enough to change their firefox config but not enough to change their DNS in their computers?

There are plenty of ways to lockdown the ability to change DNS settings on your enterprise computers (you can also lockdown Firefox with the right deployment) and you can block port 53 traffic to outside your network, but you can't block DNS -> HTTPS w/o the interventions cited above.

Re: DNS-over-HTTPS Policy Requirements for Resolvers

#62

Post by floatingatoll »

nykolasz wrote: post #27

I replied sub-thread, but adding here to give some more visibility to some of the issues DoH is causing and will cause: I work at a k12 school and I am involved on many k12 IT communities. Some schools already removed Firefox from the students computers because it was being used as a "VPN" by some elementary students to access porn - at school. Guess what this VPN was? Just DNS over HTTPS. There is a fine line betwee…

Why did the schools remove Firefox rather than enforcing no-DoH in the Firefox config files (not about:config)?

Re: DNS-over-HTTPS Policy Requirements for Resolvers

#63

Post by [deleted] »

pwnna wrote: post #52
nykolasz wrote: post #27

I replied sub-thread, but adding here to give some more visibility to some of the issues DoH is causing and will cause: I work at a k12 school and I am involved on many k12 IT communities. Some schools already removed Firefox from the students computers because it was being used as a "VPN" by some elementary students to access porn - at school. Guess what this VPN was? Just DNS over HTTPS. There is a fine line betwee…

To add to this issue from a personal level: for those who use a Pihole or operate other internal services from within their own home network will now have to change the settings for _every application_ using DoH on that network. This could become a major hassle if the number of devices and owners become large. There's not even a work around for this because I do not directly manage family members' devices (nor would…

[deleted]

Re: DNS-over-HTTPS Policy Requirements for Resolvers

#64

Post by jeroenhd »

nykolasz wrote: post #27

I replied sub-thread, but adding here to give some more visibility to some of the issues DoH is causing and will cause: I work at a k12 school and I am involved on many k12 IT communities. Some schools already removed Firefox from the students computers because it was being used as a "VPN" by some elementary students to access porn - at school. Guess what this VPN was? Just DNS over HTTPS. There is a fine line betwee…

What would removing Firefox accomplish? Why would students not just download one of the bazillion Chrome VPN addons? Or regular VPNs that they can just turn on and off? How is _removing Firefox_ a solution?

What these schools need is to set up sensible group policies. Managing BYOD on a school with kids (as opposed to grown-up people whose jobs are on the line) is simply impossible.

Re: DNS-over-HTTPS Policy Requirements for Resolvers

#65

Post by Tushon »

CydeWeys wrote: post #58
captncraig wrote: post #47

Earlier quoted context omitted.

Well its a school. They (or their legal guardians) consent as a condition of using the network.

It sounds like they have root access on the computers in question. There's plenty of options thus available to them.

The OP talked about BYOB, which rarely includes "root access" (either via a root cert for decrypting traffic or admin level access to the machine)..

Re: DNS-over-HTTPS Policy Requirements for Resolvers

#66

Post by Nas808 »

stirfrykitty wrote: post #32
majke wrote: post #14

Earlier quoted context omitted.

(full disclosure: I'm affiliated to Cloudflare, but opinions here are my own of course) Thanks for posting this. I knew Paul is against DoH, but never understood his specific arguments. He has great comment about DoT (dns over TLS) couple of minutes before the linked youtube (I agree with him on that). Personally I'm not an "owner" of the networks I'm connecting to. My home router is managed by my ISP, I don't run pi…

Why not run a Pi-hole? You only stand to benefit. Whilst it doesn't address DoH, it does go a long way in preventing the tracking you mention. It also saves on bandwidth. And because it works at the DNS level, you benefit from the calls not even being made. The Pi-hole can be customized with an endless set of rules to block about any ads, beacons, trackers. Couple this with uBlock Origin, Privacy Badger, Decentraleys…

You can do both, I have a Pi-Hole running alongside the “Cloudflared” package so Dnsmasq forwards lookups to Cloudflare over DoH.

Re: DNS-over-HTTPS Policy Requirements for Resolvers

#67

Post by phicoh »

cremp wrote: post #12
flarex wrote: post #4

Earlier quoted context omitted.

His main argument seems to be that the network operator should have control over DNS requests for safety reasons. Control and monitoring. This is the antithesis of privacy and encryption. I wouldn't be surprised if he was pro http over https either.

Because they should! Think a corporate network. If I as a sysadmin set our DHCP options to give out our own resolvers, I expect that every machine on the domain to use ours. DoH breaks that completely; and hence the network operator should have the final say. As a sysadmin myself, if browsers are overriding the basic model of top down, and it hurts me, because when something is wrong, I cant just look on my machine,…

I don't like software defaulting to sending all DNS queries to a large cloud provider. That strikes me as bad for privacy.

But I don't understand the network argument. If you are perfectly fine with TLS traffic then insisting on seeing DNS traffic sounds weird to me.

At the same time, if you force TLS traffic to go through a proxy then that will immediately restore visibility of DNS as well.

I guess network operators still have to come to terms with the idea that in the future all traffic will be encrypted.

Yes, it is annoying if you can't see anything in wireshark. But plain text is just a thing of the past.

Re: DNS-over-HTTPS Policy Requirements for Resolvers

#68

Post by judge2020 »

zzzcpan wrote: post #26
wbl wrote: post #22

Earlier quoted context omitted.

How is DoH a net negative? ESNI is coming soon. Also ISPs do all sorts of other badness with DNS like NXDOMAIN interception.

If you can't trust your ISP, leaking all of your DNS traffic to another party still doesn't let you trust your ISP, but now you have to trust that other party too, hence net negative. To avoid trusting your ISP you need at least a VPN.

ISPs already don't have a good track record, so I would argue them NXDOMAIN advertising (like Spectrum does by redirecting you to a yahoo search page) won't make someone unsubscribe from their services. But if a service like 1^4, that specifically states they don't track you, lies about it, then that would be a huge issue for all of the customers that pay for the company's other products.

Re: DNS-over-HTTPS Policy Requirements for Resolvers

#69

Post by est31 »

jeroenhd wrote: post #64
nykolasz wrote: post #27

I replied sub-thread, but adding here to give some more visibility to some of the issues DoH is causing and will cause: I work at a k12 school and I am involved on many k12 IT communities. Some schools already removed Firefox from the students computers because it was being used as a "VPN" by some elementary students to access porn - at school. Guess what this VPN was? Just DNS over HTTPS. There is a fine line betwee…

What would removing Firefox accomplish? Why would students not just download one of the bazillion Chrome VPN addons? Or regular VPNs that they can just turn on and off? How is _removing Firefox_ a solution? What these schools need is to set up sensible group policies. Managing BYOD on a school with kids (as opposed to grown-up people whose jobs are on the line) is simply impossible.

I think the poster was talking about two separate schools. One which doesn't allow BYOD and tackled the problem by removing Firefox, and a second where the poster works at which does allow BYOD and therefore removing Firefox is not an option.

Re: DNS-over-HTTPS Policy Requirements for Resolvers

#70

Post by nykolasz »

pwnna wrote: post #52
nykolasz wrote: post #27

I replied sub-thread, but adding here to give some more visibility to some of the issues DoH is causing and will cause: I work at a k12 school and I am involved on many k12 IT communities. Some schools already removed Firefox from the students computers because it was being used as a "VPN" by some elementary students to access porn - at school. Guess what this VPN was? Just DNS over HTTPS. There is a fine line betwee…

To add to this issue from a personal level: for those who use a Pihole or operate other internal services from within their own home network will now have to change the settings for _every application_ using DoH on that network. This could become a major hassle if the number of devices and owners become large. There's not even a work around for this because I do not directly manage family members' devices (nor would…

Yep. What happens when Chrome adds DoH support? And Safari?

And whatever Gaming app the kids download? Suddenly it will become impossible to manage and maintain.

Not even talking about the troubleshooting nightmare.

DNS should be a system-level setting, not an App-level setting.

Post reply on HN