Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

What’s Next in Making Encrypted DNS-over-HTTPS the Default

blog.mozilla.org

Post reply on HN
Print view View original

141–150 of 191 posts

Re: What’s Next in Making Encrypted DNS-over-HTTPS the Default

#141

Post by Faark »

josteink wrote: post #122
LUmBULtERA wrote: post #90

Earlier quoted context omitted.

In my Firefox settings I can choose any DoH provider I want, not just Cloudflare. Naturally something has to be set up as a default so it works. Why is adding DoH in the browser a bad thing?

Because if we’re replacing classic DNS with something new, it needs to be part of the OS. Not reimplemented (and configured) per application. The user and OS should control the application, not the other way around.

Is any OS vendor working on something like that? Or do you expect Moz to jump into OS dev as well? I'd expect them to import settings from OS as soon as a major OS provides this for DoH.

Re: What’s Next in Making Encrypted DNS-over-HTTPS the Default

#142

Post by MauranKilom »

userbinator wrote: post #137
josteink wrote: post #96

Earlier quoted context omitted.

> unless your LAN is 100% trusted For 99% of the people out there, it is. Can Mozilla stop interfering with my network and get back to doing useful things with Firefox now?

No kidding. Bypassing all the ad/malware domains in my HOSTS file, which practically all other applications on the system respect, feels disturbingly shady. Where's my privacy now!?!? If Mozilla wants to, they are more than welcome to work on encrypted DNS or VPNs or whatever else, but those should be at the OS level. Disrepecting configured OS settings borders on actively malicious behaviour.

How exactly do you expect Mozilla to "work on encrypted DNS at the OS level"? How does Mozilla make Microsoft/Apple/Google implement it?

Re: What’s Next in Making Encrypted DNS-over-HTTPS the Default

#143

Post by testis321 »

josteink wrote: post #123
jamescun wrote: post #60

I'd personally prefer to be greeted with a screen providing me with the option of multiple DNS-over-HTTPS providers, and the option of not using one at all, than being silently forced into handing CloudFlare even more of my data.

How about to save time, we could have this choice only once, and that would apply to every application on the machine. Say it could even be handled by the OS itself! And to save users even more time, not having to configure this per machine, we could have such assignment be an automatic part of the network infrastructure... We could call it DHCP and DNS! How about it?

And DNSSEC all the way to the user!

Re: What’s Next in Making Encrypted DNS-over-HTTPS the Default

#144

Post by meowface »

zajio1am wrote: post #39
Jonnax wrote: post #19

There's a lot of negativity here. But this is a win overall for privacy. DNS is used by ISPs to sell user's data and is one way that oppressive regimes track what their users do. If you're technical enough to understand DNS then you are smart enough to change what the default is. If you're a system administrator for a company. You should be able to push a profile down to the user's computer to configure DNS how you w…

Not if one trusts more his/her ISP more than Cloudflare. At least, an ISP is a contractual partner and under the same jurisdiction, in Europe including GDPR.

For what it's worth, I trust Cloudflare an order of magnitude more than I trust my ISP (Comcast).

Re: What’s Next in Making Encrypted DNS-over-HTTPS the Default

#145

Post by Dylan16807 »

josteink wrote: post #98
Dylan16807 wrote: post #35

Earlier quoted context omitted.

Pihole is great because it can do all your non-browser activity. But for a browser, an ad-blocking extension works better and is less than a minute to set up. Why force it to use the same DNS blocking?

Most mobile-browsers don’t support ad-blocking, especially on iOS.

They're not threatening to use DNS-over-HTTPS either.

But didn't iOS get browser adblocking capability in the last couple years?

Re: What’s Next in Making Encrypted DNS-over-HTTPS the Default

#146

Post by tannhaeuser »

LUmBULtERA wrote: post #90
tannhaeuser wrote: post #54

Same story as always with Google "innovations": "hey, we're preventing DNS queries to go to your ISP who is selling it" (to go to our service instead so we can profit from it). It's scary that Moz sides with monopolies like Google and Cloudflare on this one.

In my Firefox settings I can choose any DoH provider I want, not just Cloudflare. Naturally something has to be set up as a default so it works. Why is adding DoH in the browser a bad thing?

The DNS has grown into a regulated service, with TLD authorities and protocols to follow for registrators, transparency for domain holders, many registrators to choose, etc. Do you want to replace it by a centralized system run by very few monopolies that track resolution queries by IP?

Re: What’s Next in Making Encrypted DNS-over-HTTPS the Default

#147

Post by userbinator »

MauranKilom wrote: post #142
userbinator wrote: post #137

Earlier quoted context omitted.

No kidding. Bypassing all the ad/malware domains in my HOSTS file, which practically all other applications on the system respect, feels disturbingly shady. Where's my privacy now!?!? If Mozilla wants to, they are more than welcome to work on encrypted DNS or VPNs or whatever else, but those should be at the OS level. Disrepecting configured OS settings borders on actively malicious behaviour.

How exactly do you expect Mozilla to "work on encrypted DNS at the OS level"? How does Mozilla make Microsoft/Apple/Google implement it?

How do you think people write VPN clients? Encrypted DNS is very much within that category of software.

How does Mozilla make Microsoft/Apple/Google implement it?

It doesn't need to, the same way it doesn't need to (nor should it) make Microsoft/Apple/Google ship Firefox as the default browser.

Re: What’s Next in Making Encrypted DNS-over-HTTPS the Default

#148

Post by josteink »

Dylan16807 wrote: post #145
josteink wrote: post #98

Earlier quoted context omitted.

Most mobile-browsers don’t support ad-blocking, especially on iOS.

They're not threatening to use DNS-over-HTTPS either. But didn't iOS get browser adblocking capability in the last couple years?

Not for third-party browsers like Chrome or Firefox. In a classic Apple-move, it’s for Safari only.

Re: What’s Next in Making Encrypted DNS-over-HTTPS the Default

#149

Post by jedisct1 »

vavrusa wrote: post #136
jedisct1 wrote: post #120

Earlier quoted context omitted.

At the end, you still need to trust the resolver. There is a proposal to improve this. Resolves won't know client IPs any more: https://github.com/DNSCrypt/dnscrypt-protocol/blob/master/AN... Reference client and server implementations should be ready in the next few days.

This is interesting as a lighter alternative to DNS over Tor. Where is the padding going to be? Basic clients won't add EDNS padding by default, but intuitively there has to be padding somewhere. It reminds me of https://odns.cs.princeton.edu (I haven't seen a working implementation of that one yet). The most difficult challenge is how to present the ultimate choice - use the relay and maybe get slower Internet, or d…

The underlying DNSCrypt protocol does the padding already: https://dnscrypt.info/protocol

DNS queries and responses are wrapped, they are never modified. EDNS padding is a horrible hack.

Re: What’s Next in Making Encrypted DNS-over-HTTPS the Default

#150

Post by jedisct1 »

vavrusa wrote: post #136
jedisct1 wrote: post #120

Earlier quoted context omitted.

At the end, you still need to trust the resolver. There is a proposal to improve this. Resolves won't know client IPs any more: https://github.com/DNSCrypt/dnscrypt-protocol/blob/master/AN... Reference client and server implementations should be ready in the next few days.

This is interesting as a lighter alternative to DNS over Tor. Where is the padding going to be? Basic clients won't add EDNS padding by default, but intuitively there has to be padding somewhere. It reminds me of https://odns.cs.princeton.edu (I haven't seen a working implementation of that one yet). The most difficult challenge is how to present the ultimate choice - use the relay and maybe get slower Internet, or d…

Indeed, we will need to make a choice between minimizing latency or using a relay.

But a lot of people use DNS over Tor already. For people concerned about privacy, a bit of extra latency is totally acceptable.

Anonymized DNSCrypt is lighter than Tor, has a very clear security model, and relays are less vulnerable to abuse than Tor exit nodes.

The server/relay part is going to be implemented in https://github.com/jedisct1/rust-dnscrypt-server

Post reply on HN