Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

What’s Next in Making Encrypted DNS-over-HTTPS the Default

blog.mozilla.org

Post reply on HN
Print view View original

131–140 of 191 posts

Re: What’s Next in Making Encrypted DNS-over-HTTPS the Default

#131

Post by Spivak »

mtsr wrote: post #55
rnhmjoj wrote: post #52

Earlier quoted context omitted.

Or if you run your own resolver and don't want a completely unrelated third party like Cloudflare siphoning your traffic.

This. And I already have to deal with smart appliances that try to contact their own DNS (I’m looking at you, Samsung) and that break if I force their requests through my own resolver. This will just allow all applications and appliances to bypass my privacy measures.

I mean this is pretty much the end goal. It’s a Samsung owned, controlled, and managed device.

You as the local network operator are their adversary and it’s in Samsung’s every interest to bypass. They want and expect a clean connection to the internet. Giving it anything else is a problem to them.

If you’re installing one of these spyware devices in your network and relying on DNS to keep your information private then that’s on you when it doesn’t work. DoH neither creates nor solves human problems.

Re: What’s Next in Making Encrypted DNS-over-HTTPS the Default

#132

Post by the8472 »

andreareina wrote: post #21

> Fall back to operating system defaults for DNS when split horizon configuration or other DNS issues cause lookup failures. I hope we'll be given the opportunity to disable this, or at the very least show a warning (similar to cert warnings?) that something's off.

the network.trr.mode setting provides fine control

https://wiki.mozilla.org/Trusted_Recursive_Resolver

Re: What’s Next in Making Encrypted DNS-over-HTTPS the Default

#134

Post by euph0ria »

nullify88 wrote: post #26
euph0ria wrote: post #13

What is the latency for DoH compared to traditional UDP DNS?

Here's a whitepaper that did some benchmarks and a detailed analysis on it. Was posted on hn a few days ago. https://arxiv.org/abs/1907.08089 They test various network conditions with some results showing DoH and DoT loading webpages faster than udp dns (due to tcp timing out faster than udp on lossy connections )

Thanks!

Re: What’s Next in Making Encrypted DNS-over-HTTPS the Default

#135

Post by bepvte »

xg15 wrote: post #95
s_tec wrote: post #78

Earlier quoted context omitted.

> Firefox decided to stop using my DNS server In an ideal world, your probably want some sort of encrypted connection to your own DNS server (unless your LAN is 100% trusted). Maybe something like HTTPS would work... oh wait. Most people don't have their own DNS server, so their DNS traffic is already who-knows-what server with who-knows-what monetization in place (plus its in plaintext, so the rest of the internet g…

> Most people don't have their own DNS server, so their DNS traffic is already who-knows-what server with who-knows-what monetization in place (plus its in plaintext, so the rest of the internet gets it too). I know perfectly well who operates my DNS server: My ISP. If they are doing shady stuff, I can sue them, raise awareness or switch providers. I can't do the same with hardwired DoH endpoints.

My ISP, at&t, sells my dns queries by default. I turned it off in the account privacy settings, but I still dont trust them and they are the only ISP that serves my house. As well, firefox lets you choose your dns over https provider in settings, its hardly "hardwired".

Re: What’s Next in Making Encrypted DNS-over-HTTPS the Default

#136

Post by vavrusa »

jedisct1 wrote: post #120
tannhaeuser wrote: post #54

Same story as always with Google "innovations": "hey, we're preventing DNS queries to go to your ISP who is selling it" (to go to our service instead so we can profit from it). It's scary that Moz sides with monopolies like Google and Cloudflare on this one.

At the end, you still need to trust the resolver. There is a proposal to improve this. Resolves won't know client IPs any more: https://github.com/DNSCrypt/dnscrypt-protocol/blob/master/AN... Reference client and server implementations should be ready in the next few days.

This is interesting as a lighter alternative to DNS over Tor. Where is the padding going to be? Basic clients won't add EDNS padding by default, but intuitively there has to be padding somewhere. It reminds me of https://odns.cs.princeton.edu (I haven't seen a working implementation of that one yet). The most difficult challenge is how to present the ultimate choice - use the relay and maybe get slower Internet, or don't use the relay and maybe get tracked. What hasn't been much explored yet is using resolvers just to obtain the delegation (nobody needs to know who the client is for that), but that itself is not without problems.

Re: What’s Next in Making Encrypted DNS-over-HTTPS the Default

#137

Post by userbinator »

josteink wrote: post #96
s_tec wrote: post #78

Earlier quoted context omitted.

> Firefox decided to stop using my DNS server In an ideal world, your probably want some sort of encrypted connection to your own DNS server (unless your LAN is 100% trusted). Maybe something like HTTPS would work... oh wait. Most people don't have their own DNS server, so their DNS traffic is already who-knows-what server with who-knows-what monetization in place (plus its in plaintext, so the rest of the internet g…

> unless your LAN is 100% trusted For 99% of the people out there, it is. Can Mozilla stop interfering with my network and get back to doing useful things with Firefox now?

No kidding. Bypassing all the ad/malware domains in my HOSTS file, which practically all other applications on the system respect, feels disturbingly shady. Where's my privacy now!?!?

If Mozilla wants to, they are more than welcome to work on encrypted DNS or VPNs or whatever else, but those should be at the OS level. Disrepecting configured OS settings borders on actively malicious behaviour.

Re: What’s Next in Making Encrypted DNS-over-HTTPS the Default

#138

Post by saurik »

Spivak wrote: post #130
StavrosK wrote: post #117

Earlier quoted context omitted.

Is this by design/intention, or just because DoH hasn't caught on yet so Mozilla is setting a sane default here? I can see how it would be a drawback if the network administrator had no way to configure the setting for all clients.

The network administrator shouldn’t be able to change any setting at all on client devices. That’s the point! If you can just direct clients to a malicious DoH server then the project has largely failed. The device administrator should be the one making the choice about what resolvers to use.

I agree: the device administrator should be in charge. Essentially, I see this conversation as having spun into an awkward regime where there is an implicit and entirely incorrect assumption here that the options are 1) the network configures the DNS setup and 2) individual apps configure their DNS setup; what happened to 3) the owner of the computer (the device administrator) configures their DNS setup?

The status quo implementation has been that the operating system handled DNS, which actually did put the power in the hands of the device administrator: I don't think I have ever seen a device that wasn't clearly owned under some crazy MDM scheme where you couldn't choose your own DNS servers. Sure: recently, it happened to have a default to trust the network... but that was just a convenience, and is a "new phenomenon" brought on by DHCP being widely deployed. All of the software wasn't designed with that as an assumption.

So, if I want DoH, why am I not just setting up a custom resolver on my computer, that all of my apps use, including Firefox? The "power struggle" alluded to up-thread is actually much deeper: it is using network operators as an excuse to take power away from users, by moving what used to be an operating system feature into individual applications in a world where DRM via code signature is being deployed to lock users into curated application domains to prevent them from modifying that software to do what they want.

(That said, I mean... the way Firefox implemented this totally still gives the network administrator control, due to the opt-out provision? So in some sense a lot of this conversation is useless... for now.)

Re: What’s Next in Making Encrypted DNS-over-HTTPS the Default

#139

Post by Faark »

orev wrote: post #112
dagenix wrote: post #110

Earlier quoted context omitted.

It's easier to switch ISPs than it is to just configure FireFox to use some other DoH provider?

So now we need to worry about making custom DNS config for every single app on a computer?! It’s absurd.

Does your OS allow you to configure global DNS-over-HTTPS settings? Then you can hardly blame apps for not importing them.

Yes, getting rid of shitty old standards means we have to live with multiple in parallel for a while and in the mean time bear additional complexity/work. Otherwise civilization will never advance.

Re: What’s Next in Making Encrypted DNS-over-HTTPS the Default

#140

Post by zzzcpan »

saurik wrote: post #138
Spivak wrote: post #130

Earlier quoted context omitted.

The network administrator shouldn’t be able to change any setting at all on client devices. That’s the point! If you can just direct clients to a malicious DoH server then the project has largely failed. The device administrator should be the one making the choice about what resolvers to use.

I agree: the device administrator should be in charge. Essentially, I see this conversation as having spun into an awkward regime where there is an implicit and entirely incorrect assumption here that the options are 1) the network configures the DNS setup and 2) individual apps configure their DNS setup; what happened to 3) the owner of the computer (the device administrator) configures their DNS setup? The status q…

Network administrators don't have power over device administrators, so the premise is a bit false. Device administrators are the network administrators on their own devices.
Post reply on HN