Turn off DoH, Firefox • Hacker News Board

Re: Turn off DoH, Firefox

#21

Post by bennyp101 » Wed, Sep 11, 2019, 12:08 PM UTC

The only thing that annoys me slightly about this, is that I currently have a couple of pi-holes running at home (one for us, and one for the kids) and I have the Mikrotik setup to redirect any request for DNS to the correct pi (So even if they change the DNS on the device it still hits the pi)

This is going to make that a pain - especially if they introduce it in the mobile version?

Re: Turn off DoH, Firefox

#22

Post by jfindley » Wed, Sep 11, 2019, 12:08 PM UTC

This is painful to read. Masses off unfounded FUD - the article deliberately buries that it's trivial to change your DoH provider if you're silly enough to believe that CF is actively logging DoH requests and selling them (CF is involved with serving vast swathes of the internet anyway - if they wanted to go down this route they have far more lucrative avenues open than selling DNS requests by IP).

If instead what you worry about is the government spying on your traffic then complaining about DoH is even more silly - DNS requests are routinely intercepted and monitored by ISPs in many countries, with the information available to the security services, who have very few restrictions on what they are allowed to do with this data. This is especially true in the country the author appears to be based (Germany).

DoH is vital to protect users around the world from censorship and worse. Enabling it by default is a good thing - protecting users from abuse shouldn't only be opt-in. There has to be SOME default chosen, and the default needs to be a site large and well run enough to a) handle the load, and b) be in the firefox HSTS preload list. There aren't a lot of good DoH providers that fit these criteria - CF is one of the few.

Re: Turn off DoH, Firefox

#23

Post by mantap » Wed, Sep 11, 2019, 12:09 PM UTC

This misses the forest for the trees. In the UK ISPs are already legally mandated to log your web requests and provide them to the government. Those who live under free regimes should not deny those of us who live under oppressive governments the right to privacy of our communications. The fact that cloudflare is a US entity and thus not subject to UK law is the whole point.

Re: Turn off DoH, Firefox

#24

Post by Johnnynator » Wed, Sep 11, 2019, 12:09 PM UTC

Chirael wrote: post #16

It seems like this change by Firefox would bypass a pi-hole. Am I understanding it correctly?

Yes, a DoH request would never hit your Pi Hole

Re: Turn off DoH, Firefox

#25

Post by m-p-3 » Wed, Sep 11, 2019, 12:09 PM UTC

netfl0 wrote: post #8

Firefox, wth. Cloudflare is not the internet.

It's currently proxying 10.2% of all known websites (by the surveyor) on the entire Internet.

https://w3techs.com/technologies/details/cn-cloudflare/all/a...

Not big, but not insignificant.

Re: Turn off DoH, Firefox

#26

Post by paulcarroty » Wed, Sep 11, 2019, 12:09 PM UTC

DoH and DoT are very interested technologies, disabling them 'cause Cloudflare is ... strange.

From another side, DoH/DoT prevents ISPs/government from DNS modifying/rerouting.

Re: Turn off DoH, Firefox

#27

Post by w8rbt » Wed, Sep 11, 2019, 12:09 PM UTC

akerro wrote: post #3

Of course, I'd rather trust unecncrypted plaintext DNS queries that go to my ISP and government! If you don't like CF just switch to different provider https://github.com/curl/curl/wiki/DNS-over-HTTPS

Absolutely. This warning seems disingenuous and will confuse many normal people. DNS over HTTPs and DNS over TLS are good things and increase our privacy. People should switch to them.

Re: Turn off DoH, Firefox

#28

Post by coleifer » Wed, Sep 11, 2019, 12:09 PM UTC

There are two points:

1. centralization of all dns lookups is worrisome

2. Dns should not be handled by applications. It should be handled by the operating system.

I see a lot of people conflating the two in the comments.

Re: Turn off DoH, Firefox

#29

Post by lima » Wed, Sep 11, 2019, 12:10 PM UTC

roblabla wrote: post #18

Aaargh20318 wrote: post #14

Earlier quoted context omitted.

> I'd rather trust unecncrypted plaintext DNS queries that go to my ISP and government! I trust my ISP and government more than a US company I have no formal contract with and the US government. Also, there's the whole 'applications should not override system level settings' thing. My DHCP pushes a local (caching) DNS server that also does name resolution for internal services. This change would break that for all Fi…

> I trust my ISP and government more than a US company I have no formal contract with and the US government. And every single intermediary and whoever else might be listening in? This is an unencrypted plaintext connection. Which is the main point here. The whole "we trust ISP more" thing is completely beside the point. The point is DNS is horribly insecure nowadays, and it is about damn time we switch to something b…

There aren't many intermediaries if you use your ISP's internal resolvers.

Re: Turn off DoH, Firefox

#30

Post by aazaa » Wed, Sep 11, 2019, 12:10 PM UTC

> DoH means that Firefox will concentrate all DNS traffic on Cloudflare, and they send traffic from all their users to one entity.

Why does DoH necessarily mean that Cloudflare will be handling the traffic? The article barrels right to that conclusion without explaining why.