Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

What’s Next in Making Encrypted DNS-over-HTTPS the Default

blog.mozilla.org

Post reply on HN
Print view View original

71–80 of 191 posts

Re: What’s Next in Making Encrypted DNS-over-HTTPS the Default

#71

Post by mtsr »

ferzul wrote: post #67
mtsr wrote: post #55

Earlier quoted context omitted.

This. And I already have to deal with smart appliances that try to contact their own DNS (I’m looking at you, Samsung) and that break if I force their requests through my own resolver. This will just allow all applications and appliances to bypass my privacy measures.

who will write the article about the weird world we live in, where the person who is mitm'ing the network connection is me, and it's the non-mitm'ed connection that is untrusted and worrying. at this point i expect to see talk of “the VPN”, a new network for hobbyists and academics, that's kinda like the old internet, and we only use devices that are wrapped in it.

Take a look at Privoxy.

It's mostly useless now with everyone defaulting to HTTPS unless you install a root certificate on all your devices.

Re: What’s Next in Making Encrypted DNS-over-HTTPS the Default

#72

Post by josteink »

GTP wrote: post #44
nicolaslem wrote: post #25

Earlier quoted context omitted.

> blocking a canary domain And how long will it take for most ISPs to block this domain when they realize that their DNS servers are not being used anymore? Some of them sell this data so they see it as a source of revenue. At this point this canary domain will have the same fate as Do Not Track. > I look forward to applications taking DNS under their own control. I am sure I can find a hundred applications/programs…

They already stated in the article that if the canary domain will be abused they will disable that check.

Yeah. Sounds like another do-not-track then.

I’ll keep my firewall-rules banning all DoH-traffic to Cloudflare, just in case.

Re: What’s Next in Making Encrypted DNS-over-HTTPS the Default

#73

Post by mtsr »

alexis_fr wrote: post #29
papaf wrote: post #3

At first, I was sceptical of DNS over HTTPS and thought that it gave Cloudflare, who already control too much access over the internet, even more control. However, other DNS providers are available. For instance Google[1] and Quad 9 [2] both provide free DNS over HTTPS services. [1] https://developers.google.com/speed/public-dns/docs/doh/ [2] https://www.quad9.net/doh-quad9-dns-servers/

The difference is, DNS-over-HTTPS seems to support cookies and identification. DNS only identified the IP of a person. So it’s clearly an upgrade for Google.

Ooh, that's an interesting tack. I wonder if Firefox stores cookies or sends enough headers for fingerprinting DoH requests.

Re: What’s Next in Making Encrypted DNS-over-HTTPS the Default

#74

Post by josteink »

EvanAnderson wrote: post #40
josteink wrote: post #11

Earlier quoted context omitted.

If true that DoH can be disabled at network level, ad-blocking solutions like pihole should probably implement it by default. Anyone have any idea if this is the case? That would at least save me a lot of trouble and work.

Already proposed: https://discourse.pi-hole.net/t/support-for-returning-nxdoma...

Make that already merged: https://github.com/pi-hole/pi-hole/pull/2915

Pi-hole is awesome.

Re: What’s Next in Making Encrypted DNS-over-HTTPS the Default

#75

Post by mtsr »

josteink wrote: post #72
GTP wrote: post #44

Earlier quoted context omitted.

They already stated in the article that if the canary domain will be abused they will disable that check.

Yeah. Sounds like another do-not-track then. I’ll keep my firewall-rules banning all DoH-traffic to Cloudflare, just in case.

Not a bad call, I guess.

Re: What’s Next in Making Encrypted DNS-over-HTTPS the Default

#76

Post by xorcist »

Jonnax wrote: post #19

There's a lot of negativity here. But this is a win overall for privacy. DNS is used by ISPs to sell user's data and is one way that oppressive regimes track what their users do. If you're technical enough to understand DNS then you are smart enough to change what the default is. If you're a system administrator for a company. You should be able to push a profile down to the user's computer to configure DNS how you w…

> DNS is used by ISPs to sell user's data

Claims like these keep surfacing in every discussion. While it is good to contemplate what your ISP spying on you would look like and what you can do to minimize that risk, it is not good to present this as normal behaviour.

From my perspective I am absolutely certain that this is not something that is routinely done, not in established ISPs in democratic countries. The risks would be far too great for a tiny income. Who would you sell to? The advertising networks have their own data sources, and even the web giants with billions of users and trackers embedded in pretty much every web page you visit can't charge much.

Even if you wanted to do this, DNS would be a low value target considering it is cached at every layer. Data mining sFlow logs, which is something every ISP would use anyway for diagnostic purposes, would give you better view of which kind of services users connect to and for how long.

So please don't normalize something that is at best a niche for bad actors. That can lead to decisions for end users, many of whom would be wiser not sending their data off to a foreign third party.

Re: What’s Next in Making Encrypted DNS-over-HTTPS the Default

#77

Post by lovelearning »

zzzcpan wrote: post #69
Jonnax wrote: post #19

There's a lot of negativity here. But this is a win overall for privacy. DNS is used by ISPs to sell user's data and is one way that oppressive regimes track what their users do. If you're technical enough to understand DNS then you are smart enough to change what the default is. If you're a system administrator for a company. You should be able to push a profile down to the user's computer to configure DNS how you w…

> But this is a win overall for privacy. > DNS is used by ISPs to sell user's data and is one way that oppressive regimes track what their users do. It's not a win for privacy, ISPs will still have that data and now third parties will have that data, state actors will have that data in a nice convenient centralized locations, governments will have an ability to force those centralized providers to do censorship for t…

DoH does not imply centralization in any way. Any trusted party can provide their own DoH endpoint. I can run my own DoH server on a cheap VPS hosted in another country.

I live in an increasingly oppressive regime. Most of the blocking is done at DNS level. DoH is a great solution. Slamming DoH because they can anyway spy one way or another is a poor argument.

Re: What’s Next in Making Encrypted DNS-over-HTTPS the Default

#78

Post by s_tec »

nicolaslem wrote: post #6

The article is not clear about one issue: are all applications expected to disregard the OS DNS? Is there an option to tell all applications that they should not bypass it? I will be pretty pissed if I wake up one day and find that Firefox decided to stop using my DNS server and instead started sending my requests to a third-party.

> Firefox decided to stop using my DNS server

In an ideal world, your probably want some sort of encrypted connection to your own DNS server (unless your LAN is 100% trusted). Maybe something like HTTPS would work... oh wait.

Most people don't have their own DNS server, so their DNS traffic is already who-knows-what server with who-knows-what monetization in place (plus its in plaintext, so the rest of the internet gets it too).

DNS over HTTPS seems like a net win for both types of users. Power users like you get way to encrypt your DNS traffic, and non-technical users get an encrypted connection to a potentially less-hostile DNS server. It sucks that there is now a second place to configure things, but hopefully seeing this work well will put pressure on the OS to adopt DNS over HTTPS natively, bringing the experiment to its final goal (at least, I assume this is the endgame).

Re: What’s Next in Making Encrypted DNS-over-HTTPS the Default

#79

Post by TazeTSchnitzel »

I wonder if this will break TP-Link's tplinklogin.net and tplinkrepeater.net for logging into their routers/repeaters? At least the latter is supposed to be intercepted by the device, and if it isn't, you get a message saying things are misconfigured.

Re: What’s Next in Making Encrypted DNS-over-HTTPS the Default

#80

Post by TazeTSchnitzel »

jlgaddis wrote: post #5

I didn't see it mentioned in the article. Has Mozilla said whose servers they will be sending unsuspecting users queries to by default? (IIRC, it was Cloudflare previously. Any reason to believe this has changed?) --- If, like me, you already have a solution in place you are happy with and don't like the idea of others (deciding they know what's best for you and) circumventing it, simply ensure that your existing res…

I wonder if UK ISPs that complained about DoH will block use-application-dns.net network-wide.
Post reply on HN