Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

What’s Next in Making Encrypted DNS-over-HTTPS the Default

blog.mozilla.org

Post reply on HN
Print view View original

41–50 of 191 posts

Re: What’s Next in Making Encrypted DNS-over-HTTPS the Default

#41

Post by hannob »

elcomet wrote: post #31

Why don't they rather include a resolver in Firefox ? This way, no privacy problems, you're directly contacting authoritarive servers. And you don't rely on a single dns-over-https provider. Is the latency a big problem there? I would say that with caching it is not too bad.

1. The connection to the authoritative servers isn't encrypted, so the whole point of DoH is undermined.

2. There's plenty of networks that don't let arbitrary DNS traffic out, so this doesn't work without another fallbacks. Fallbacks for security features are bad.

I see that there are legit controversies around DoH. But these "Why don't you just do X?" comments aren't helpful. Try to understand the problem they're trying to resolve.

Re: What’s Next in Making Encrypted DNS-over-HTTPS the Default

#42

Post by Jonnax »

pmontra wrote: post #37

DoH bypasses the OS and the /etc/hosts file. This breaks some workflows.

Oh no.

Maybe you can configure this? https://support.mozilla.org/en-US/kb/customizing-firefox-usi...

Or perhaps use their canary domain to force Firefox to use local DNS?

Or just configure it yourself?

It's not security if an application can still access the internet. Why not block all internet access except via a proxy server? Which is what a "real" enterprise would do because they can block what they want and have a secure network.

Re: What’s Next in Making Encrypted DNS-over-HTTPS the Default

#43

Post by elcomet »

hannob wrote: post #41
elcomet wrote: post #31

Why don't they rather include a resolver in Firefox ? This way, no privacy problems, you're directly contacting authoritarive servers. And you don't rely on a single dns-over-https provider. Is the latency a big problem there? I would say that with caching it is not too bad.

1. The connection to the authoritative servers isn't encrypted, so the whole point of DoH is undermined. 2. There's plenty of networks that don't let arbitrary DNS traffic out, so this doesn't work without another fallbacks. Fallbacks for security features are bad. I see that there are legit controversies around DoH. But these "Why don't you just do X?" comments aren't helpful. Try to understand the problem they're t…

Well I'm asking because I'm trying to understand the drawbacks of a resolving server. Thanks for the explanation !

Re: What’s Next in Making Encrypted DNS-over-HTTPS the Default

#44

Post by GTP »

nicolaslem wrote: post #25
modeless wrote: post #15

Earlier quoted context omitted.

The article explicitly mentions the way to tell applications including Firefox not to disregard the OS DNS: blocking a canary domain. It even links to detailed instructions. Frankly, given how much trouble I've had with systemd's DNS meddling, I look forward to applications taking DNS under their own control.

> blocking a canary domain And how long will it take for most ISPs to block this domain when they realize that their DNS servers are not being used anymore? Some of them sell this data so they see it as a source of revenue. At this point this canary domain will have the same fate as Do Not Track. > I look forward to applications taking DNS under their own control. I am sure I can find a hundred applications/programs…

They already stated in the article that if the canary domain will be abused they will disable that check.

Re: What’s Next in Making Encrypted DNS-over-HTTPS the Default

#45

Post by z3t4 »

jlgaddis wrote: post #7
nicolaslem wrote: post #6

The article is not clear about one issue: are all applications expected to disregard the OS DNS? Is there an option to tell all applications that they should not bypass it? I will be pretty pissed if I wake up one day and find that Firefox decided to stop using my DNS server and instead started sending my requests to a third-party.

That's exactly what their plan is -- and if you have experiments enabled, they may have already started sending your DNS queries to Cloudflare.

I guess thats Mozillas new monetizing strategy, sell user data to cloudflare, and market it as privacy.

If you want privacy you better firewall everything your computer want to send to Cloudflare, Akamai, et.al.

Re: What’s Next in Making Encrypted DNS-over-HTTPS the Default

#46

Post by poizan42 »

elcomet wrote: post #31

Why don't they rather include a resolver in Firefox ? This way, no privacy problems, you're directly contacting authoritarive servers. And you don't rely on a single dns-over-https provider. Is the latency a big problem there? I would say that with caching it is not too bad.

Besides what the other commenters have said, it also just seems like a bad idea to add 170 million extra recursive resolvers, I don't know how well the dns infrastructure would cope with that extra amount of traffic.

Re: What’s Next in Making Encrypted DNS-over-HTTPS the Default

#47

Post by floatboth »

zajio1am wrote: post #39
Jonnax wrote: post #19

There's a lot of negativity here. But this is a win overall for privacy. DNS is used by ISPs to sell user's data and is one way that oppressive regimes track what their users do. If you're technical enough to understand DNS then you are smart enough to change what the default is. If you're a system administrator for a company. You should be able to push a profile down to the user's computer to configure DNS how you w…

Not if one trusts more his/her ISP more than Cloudflare. At least, an ISP is a contractual partner and under the same jurisdiction, in Europe including GDPR.

Being in the same jurisdiction is bad: your ISP is THE place for your local law enforcement to get info on your browsing.

Re: What’s Next in Making Encrypted DNS-over-HTTPS the Default

#48

Post by EvanAnderson »

hannob wrote: post #41
elcomet wrote: post #31

Why don't they rather include a resolver in Firefox ? This way, no privacy problems, you're directly contacting authoritarive servers. And you don't rely on a single dns-over-https provider. Is the latency a big problem there? I would say that with caching it is not too bad.

1. The connection to the authoritative servers isn't encrypted, so the whole point of DoH is undermined. 2. There's plenty of networks that don't let arbitrary DNS traffic out, so this doesn't work without another fallbacks. Fallbacks for security features are bad. I see that there are legit controversies around DoH. But these "Why don't you just do X?" comments aren't helpful. Try to understand the problem they're t…

I disagree that the OP's comment isn't helpful. Mozilla could have taken a tack that would have increased decentralization and promoted privacy (DNS-over-TLS exists). Instead, they went the way of a centralized protocol that just trades one set of potentially bad actors (ISPs) for another.

re: network policy - If you're paying to use a network with policy that you disagree with vote w/ your wallet. If you're using somebody else's network (i.e. a corporate network I'm paid to administer, for example) it's reasonable to accept that you're bound by the owner's policy-- it's their network.

Re: What’s Next in Making Encrypted DNS-over-HTTPS the Default

#50

Post by lota-putty »

We're getting an option to bypass TSP's DNS to a 3rd party over secure connection; be it DoH or DoT.

TSPs can easily map your usage behaviour to your identity while 3rd party DNS provider will have your behaviour alone. Albeit, TSP will still have IPs you've accessed for data transfer.

TSPs that honour their customers' privacy will allow 3rd party DoH/DoT, esp DoT(ie port:853).

TSP: Telecom service provider

Post reply on HN