Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

What’s Next in Making Encrypted DNS-over-HTTPS the Default

blog.mozilla.org

Post reply on HN
Print view View original

181–190 of 191 posts

Re: What’s Next in Making Encrypted DNS-over-HTTPS the Default

#181

Post by throw0101a »

nicolaslem wrote: post #6

The article is not clear about one issue: are all applications expected to disregard the OS DNS? Is there an option to tell all applications that they should not bypass it? I will be pretty pissed if I wake up one day and find that Firefox decided to stop using my DNS server and instead started sending my requests to a third-party.

> Is there an option to tell all applications that they should not bypass it?

Yes there is. If your internal recursive DNS servers return an NXDOMAIN for "use-application-dns.net", then Firefox will stick with gethostbyname(3) (or whatever). See:

* https://support.mozilla.org/en-US/kb/configuring-networks-di...

If you’re using NLnet’s unbound(8) as a recursive DNS server, it’s possible to use the “local-zone” directive to force an NXDOMAIN:

* https://serverfault.com/questions/625170/

For ISC’s BIND, the response policy zone (RPZ) mechanism does something similar on BIND 9.8+ (it’s more flexible, so more complicated to configure):

* https://jpmens.net/2011/04/26/how-to-configure-your-bind-res...

* https://downloads.isc.org/isc/bind9/9.9.5/doc/arm/Bv9ARM.ch0...

* https://dnsrpz.info

* https://tools.ietf.org/html/draft-vixie-dnsop-dns-rpz

* http://www.zytrax.com/books/dns/ch7/rpz.html

* https://serverfault.com/questions/618106/set-up-bind9-as-dns...

Re: What’s Next in Making Encrypted DNS-over-HTTPS the Default

#182

Post by throw0101a »

Ayesh wrote: post #164
josteink wrote: post #72

Earlier quoted context omitted.

Yeah. Sounds like another do-not-track then. I’ll keep my firewall-rules banning all DoH-traffic to Cloudflare, just in case.

I suppose you can block the IP 1.1.1.1, but Google serves THEIR DNS at `google.com` on HTTPS port. One of the design choices of DoH to make it look like HTTPS traffic. It's gonna be difficult to block DoH traffic.

> One of the design choices of DoH to make it look like HTTPS traffic.

Wait until encrypted SNI gets implemented everywhere was well.

Re: What’s Next in Making Encrypted DNS-over-HTTPS the Default

#183

Post by BubRoss »

Ajedi32 wrote: post #163
BubRoss wrote: post #152

Earlier quoted context omitted.

How are you so certain that this doesn't happen in general?

Is there any evidence suggesting that it does? Personally I have no idea whether or not this is a common practice, though I have to agree with xorcist that it's certainly not a given.

It is common for AT&T

Re: What’s Next in Making Encrypted DNS-over-HTTPS the Default

#184

Post by Jonnax »

throw0101a wrote: post #171
Jonnax wrote: post #19

There's a lot of negativity here. But this is a win overall for privacy. DNS is used by ISPs to sell user's data and is one way that oppressive regimes track what their users do. If you're technical enough to understand DNS then you are smart enough to change what the default is. If you're a system administrator for a company. You should be able to push a profile down to the user's computer to configure DNS how you w…

> DNS is used by ISPs to sell user's data and is one way that oppressive regimes track what their users do. Your ISP may do this, but mine does not, so why should Mozilla get to dictate IT policy of my machine (i.e., ignoring resolve.conf)? Or policy of the company where I help run IT?

DNS is a plaintext protocol. It's a new technology. Technically this is better.

It reminds me of this silliness I sometimes hear:

"I need to use NAT with IPv6 to protect my network"

Firefox will allow you to set up a DNS rule locally that forces the client to use local dns, if you need it.

You can also configure a DNS over HTTPs server as your DNS.

If you help run IT and care about security. Then you should be blocking direct access to the internet anyway.

All your traffic should be going through a proxy server.

Also defaults should help those that are in weaker security positions. Just because you're lucky to have a good ISP doesn't mean that other people shouldn't be protected by default.

You're knowledgeable enough to configure your DNS, you just gotta learn something different.

Re: What’s Next in Making Encrypted DNS-over-HTTPS the Default

#185

Post by bzbarsky »

krupan wrote: post #99
throawayeu45556 wrote: post #58

I am wondering, does DNS-over-HTTPS really helps since the way I understand it, after the domain name is resolved to an IP address, the client contacts the IP address so the ISP could still know the website visited especially since many if not most websites have dedicated IP addresses. So ISP could simply crawl the web and map domain names to IP addresses. Is there anything in DoH mitigating this? Or maybe is this at…

This! Just like https encrypting website that anyone can visit is not about privacy, DoH is also not about privacy. Anyone can visit the same https website you visit and see what you are reading. Anyone can resolve the same hostnames that you are resolving (or reverse IPs you are visiting to determine hostnames). The benefit they do provide is authentication (ensure that google.com is really google.com) and protectio…

> Anyone can resolve the same hostnames that you are resolving

Yes, but your ISP (including "that coffee shop whose wifi you're using" in ISP here) can't necessarily tell which hostnames you are resolving, if you use DoH (subject to some limitations about what happens after you've resolved the hostname). This is in fact a privacy feature

Re: What’s Next in Making Encrypted DNS-over-HTTPS the Default

#186

Post by krupan »

bzbarsky wrote: post #185
krupan wrote: post #99

Earlier quoted context omitted.

This! Just like https encrypting website that anyone can visit is not about privacy, DoH is also not about privacy. Anyone can visit the same https website you visit and see what you are reading. Anyone can resolve the same hostnames that you are resolving (or reverse IPs you are visiting to determine hostnames). The benefit they do provide is authentication (ensure that google.com is really google.com) and protectio…

> Anyone can resolve the same hostnames that you are resolving Yes, but your ISP (including "that coffee shop whose wifi you're using" in ISP here) can't necessarily tell which hostnames you are resolving, if you use DoH (subject to some limitations about what happens after you've resolved the hostname). This is in fact a privacy feature

They can see which IP addresses you go to and do a reverse lookup.

Re: What’s Next in Making Encrypted DNS-over-HTTPS the Default

#187

Post by bzbarsky »

krupan wrote: post #186
bzbarsky wrote: post #185

Earlier quoted context omitted.

> Anyone can resolve the same hostnames that you are resolving Yes, but your ISP (including "that coffee shop whose wifi you're using" in ISP here) can't necessarily tell which hostnames you are resolving, if you use DoH (subject to some limitations about what happens after you've resolved the hostname). This is in fact a privacy feature

They can see which IP addresses you go to and do a reverse lookup.

They can, but of course the mapping is not always 1-1.

Re: What’s Next in Making Encrypted DNS-over-HTTPS the Default

#188

Post by z3t4 »

z3t4 wrote: post #100
wipseabusbus wrote: post #62

Earlier quoted context omitted.

>...sell user data to cloudflare... Cloudflare claims they "will never sell your data or use it to target ads." You can read their 1.1.1.1 privacy policies here: https://developers.cloudflare.com/1.1.1.1/commitment-to-priv... https://developers.cloudflare.com/1.1.1.1/commitment-to-priv...

Mozilla have a special deal with Cloudflare. According to Mozilla it will give even more privacy. It also seem that there is no money involved? So hopefully Mozilla is not selling DNS like they sell search. But I still think its a bad idea to centralize DNS and send all dns request to one actor, then it becomes very easy for anyone like the US gov to collect the data.

Then there is also performance. While Cloudflare has great coverage, using your ISP DNS will be much faster, due to it being physically closer in the network and using a more simple protocol.

Re: What’s Next in Making Encrypted DNS-over-HTTPS the Default

#189

Post by yencabulator »

lordlimecat wrote: post #102
throw0101a wrote: post #89

Earlier quoted context omitted.

And how the hell is split-horizon DNS supposed to work if resolve.conf is ignored? This may be "fine" for (some) home users, but most organizations have a whole bunch of internal-only records. And even a lot of residences have things like printers and such that live under .local: how is the browser supposed to connect to those? Who the fsck is Mozilla that they get to dictate policy in my IT organization about how DN…

It's amazing that you have such strong opinions about an article you didn't even bother to read. First, they detect split horizon situations and explain how. Second, if you as an admin want to force disable DoH across the network, they've provided a DNS-based way to do so. Third, if this really bothers you, Mozilla provides GPO templates (and JSON based methods for other OSes) to configure all of these settings at an…

The silly assumption being made here is that "DoH" = "talk HTTPS to Cloudflare". I want DoH, but I need private domains. I would like to talk DoH to a thing I control.

Re: What’s Next in Making Encrypted DNS-over-HTTPS the Default

#190

Post by mtsr »

Spivak wrote: post #131
mtsr wrote: post #55

Earlier quoted context omitted.

This. And I already have to deal with smart appliances that try to contact their own DNS (I’m looking at you, Samsung) and that break if I force their requests through my own resolver. This will just allow all applications and appliances to bypass my privacy measures.

I mean this is pretty much the end goal. It’s a Samsung owned, controlled, and managed device. You as the local network operator are their adversary and it’s in Samsung’s every interest to bypass. They want and expect a clean connection to the internet. Giving it anything else is a problem to them. If you’re installing one of these spyware devices in your network and relying on DNS to keep your information private th…

I paid for the TV, why do we accept this practice?
Post reply on HN