Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

What’s Next in Making Encrypted DNS-over-HTTPS the Default

blog.mozilla.org

Post reply on HN
Print view View original

151–160 of 191 posts

Re: What’s Next in Making Encrypted DNS-over-HTTPS the Default

#151

Post by vavrusa »

jedisct1 wrote: post #149
vavrusa wrote: post #136

Earlier quoted context omitted.

This is interesting as a lighter alternative to DNS over Tor. Where is the padding going to be? Basic clients won't add EDNS padding by default, but intuitively there has to be padding somewhere. It reminds me of https://odns.cs.princeton.edu (I haven't seen a working implementation of that one yet). The most difficult challenge is how to present the ultimate choice - use the relay and maybe get slower Internet, or d…

The underlying DNSCrypt protocol does the padding already: https://dnscrypt.info/protocol DNS queries and responses are wrapped, they are never modified. EDNS padding is a horrible hack.

That's good, I missed that. Thanks for highlighting the project, I'll keep an eye on it!

Re: What’s Next in Making Encrypted DNS-over-HTTPS the Default

#152

Post by BubRoss »

xorcist wrote: post #76
Jonnax wrote: post #19

There's a lot of negativity here. But this is a win overall for privacy. DNS is used by ISPs to sell user's data and is one way that oppressive regimes track what their users do. If you're technical enough to understand DNS then you are smart enough to change what the default is. If you're a system administrator for a company. You should be able to push a profile down to the user's computer to configure DNS how you w…

> DNS is used by ISPs to sell user's data Claims like these keep surfacing in every discussion. While it is good to contemplate what your ISP spying on you would look like and what you can do to minimize that risk, it is not good to present this as normal behaviour. From my perspective I am absolutely certain that this is not something that is routinely done, not in established ISPs in democratic countries. The risks…

How are you so certain that this doesn't happen in general?

Re: What’s Next in Making Encrypted DNS-over-HTTPS the Default

#153

Post by tptacek »

testis321 wrote: post #143
josteink wrote: post #123

Earlier quoted context omitted.

How about to save time, we could have this choice only once, and that would apply to every application on the machine. Say it could even be handled by the OS itself! And to save users even more time, not having to configure this per machine, we could have such assignment be an automatic part of the network infrastructure... We could call it DHCP and DNS! How about it?

And DNSSEC all the way to the user!

I'd be pretty pissed if my network connection opted me into a DNSSEC-verifying resolver, since that is pretty much pure downside for users.

Re: What’s Next in Making Encrypted DNS-over-HTTPS the Default

#154

Post by xg15 »

TazeTSchnitzel wrote: post #79

I wonder if this will break TP-Link's tplinklogin.net and tplinkrepeater.net for logging into their routers/repeaters? At least the latter is supposed to be intercepted by the device, and if it isn't, you get a message saying things are misconfigured.

Seems to me they should be able to keep this sort of working by resolving tplinklogin.net to 192.168.0.1 or such on their public DNS and ensuring the router always serves the web page from that IP.

Of course things will break down if a router is ever configured to use a different IP - but then again, the public DNS with local IP might trigger Firefox' heuristics and cause it to fall back to traditional DNS - so thinks may still work.

But the whole concept of using an on-device web page as config UI seems to become problematic, thanks to HTTPS-everywhere, as there appears to be no way to serve HTTPS from a local, unsupervised device that is frictionless and does not open a security vulnerability.

Re: What’s Next in Making Encrypted DNS-over-HTTPS the Default

#155

Post by darkhorn »

xg15 wrote: post #61
floatboth wrote: post #47

Earlier quoted context omitted.

Being in the same jurisdiction is bad: your ISP is THE place for your local law enforcement to get info on your browsing.

Yes. However with Cloudflare, now everyone would effectively be under the jurisdiction of the US which is not necessarily better.

You can change your DoH provider under the settings in Firefox.

Re: What’s Next in Making Encrypted DNS-over-HTTPS the Default

#156

Post by darkhorn »

nicolaslem wrote: post #6

The article is not clear about one issue: are all applications expected to disregard the OS DNS? Is there an option to tell all applications that they should not bypass it? I will be pretty pissed if I wake up one day and find that Firefox decided to stop using my DNS server and instead started sending my requests to a third-party.

>Are all applications expected to disregard the OS DNS?

I hope so if OS continues to use plaintext (none secure) DNS queries.

Re: What’s Next in Making Encrypted DNS-over-HTTPS the Default

#158

Post by bzbarsky »

josteink wrote: post #96
s_tec wrote: post #78

Earlier quoted context omitted.

> Firefox decided to stop using my DNS server In an ideal world, your probably want some sort of encrypted connection to your own DNS server (unless your LAN is 100% trusted). Maybe something like HTTPS would work... oh wait. Most people don't have their own DNS server, so their DNS traffic is already who-knows-what server with who-knows-what monetization in place (plus its in plaintext, so the rest of the internet g…

> unless your LAN is 100% trusted For 99% of the people out there, it is. Can Mozilla stop interfering with my network and get back to doing useful things with Firefox now?

> For 99% of the people out there, it is.

99% of the people out there never connect to wifi in coffeeshops?

I'm not even sure you hit the 99% mark if you measure by time spent connected, though I would love to see some data.

(Disclaimer: I work for Mozilla, but have not really been involved with DoH.)

Re: What’s Next in Making Encrypted DNS-over-HTTPS the Default

#159

Post by bzbarsky »

EvanAnderson wrote: post #51

Can somebody point me to the place in the Firefox code where the "use-application-dns.net" canary domain is actually checked? I've tried searching the mozilla-central Mercurial repository and I'm not finding it. I'm clearly inept here. I'm looking at what my Windows DNS servers return when I put in an empty zone for "use-application-dns.net" and I'd like to see exactly what Firefox is testing for. Windows 2012 R2, at…

The canary is not implemented yet, as far as I can tell.

Re: What’s Next in Making Encrypted DNS-over-HTTPS the Default

#160

Post by bzbarsky »

zzzcpan wrote: post #66
throawayeu45556 wrote: post #58

I am wondering, does DNS-over-HTTPS really helps since the way I understand it, after the domain name is resolved to an IP address, the client contacts the IP address so the ISP could still know the website visited especially since many if not most websites have dedicated IP addresses. So ISP could simply crawl the web and map domain names to IP addresses. Is there anything in DoH mitigating this? Or maybe is this at…

Yes, ISPs can know IP addresses and map domains to IP addresses, they can also know exact SNI names, all kinds of passive TCP-level information about your communications, can do active probing for all kinds of information on behalf of you, can use all that together to build a much more detailed profile of you, than available through DNS queries. There is an entire industry of commercial DPI solutions to do that. On t…

> they can also know exact SNI names

This is why ESNI is being rolled out, yes?

Post reply on HN