Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Mozilla’s DNS over HTTPs

blog.mozilla.org

Post reply on HN
Print view View original

121–130 of 777 posts

Re: Mozilla’s DNS over HTTPs

#121

Post by Spivak »

72deluxe wrote: post #104
Spivak wrote: post #55

Earlier quoted context omitted.

This logic makes no sense to me. Can you imagine if AT&T or Spectrum made a statement like this? The “network administrator” is an untrusted 3rd party who should have basically 0 say in how my device operates. The device administrator, ie the owner of the machine, is the one who should have the final say over when DoH is used. The use-application-dns record is for businesses that want an easy way to stop DoH on machi…

So what if I run a Pihole at home as a DNS server and want to stop being able to resolve various domains? I would like to know how to stop all devices (actually worse, individual applications!) on my network deciding to DoH of their own accord (and therefore bypassing my local DNS server). This kind of centralised ability to block DoH is very useful to me.

There are a couple use-cases here.

* On devices that you own and control you don't need a network level control like this except for convenience. This is when you should be applying the override record.

* On devices that you do not own or control (family/friends/guests) disabling DoH makes you the malicious network operator. Connecting to your Wi-Fi doesn't make you trusted in any sense of the word.

* On devices that you own but do not control (Google Home/Alexa) you make a valid point that techie types have been able to take some level of control by exploiting the fact that DNS is an unencrypted "hole" in the security of the device. You would have a lot more control if the HTTP traffic they sent was unencrypted and inspectable/modifiable but that doesn't mean devices shouldn't be allowed to use HTTPS without your approval.

Re: Mozilla’s DNS over HTTPs

#122

Post by whoopdedo »

drenginian wrote: post #15
davidu wrote: post #11

Earlier quoted context omitted.

Not sure what any of your reply means. Adding OS support isn’t required. People just run a local resolver that supports these things. No different than any other application. Nothing arcane. Certainly no more than HTTP and SSL. I think you have some reading to do.

>> People just run a local resolver that’s support’s these things. Nowhere do “people just run a local resolver”. Grandma and aunty Beryl certainly don’t, nor does any other ordinary person. If you want secure DNS you have to build it in to the browser. Only systems people think that this is the sort of thing that ordinary people do.

Does Grandma have a small WiFi router that her cable modem is plugged into? Well that device provides local DNS for her.

Re: Mozilla’s DNS over HTTPs

#123

Post by kibwen »

sumanthvepa wrote: post #119

I run my own DNS server. So I trust my own DNS way more than I trust Cloudflare. Is there a way to stop Firefox from using DNS over HTTP?

Yes, it supports custom resolvers, see the section "Switching Providers": https://support.mozilla.org/en-US/kb/firefox-dns-over-https

Re: Mozilla’s DNS over HTTPs

#124

Post by mike-cardwell »

Anybody have any stats on what percentage of websites and or percentage of global web-traffic hits websites that are hosted on their own personal unshared IP, vs those that are hosted on shared IPs?

Because if 90% of websites are hosted on unshared IPs, then this whole thing about DoH and/or ESNI providing some sort of privacy is complete bunk. An ISP can still see exactly what website you're visiting when connecting to an unshared IP by virtue of which IP you're connecting to. The methods for mapping a raw IP to a website when that IP is unshared, are numerous and effective.

DoH/ESNI only provide privacy if the vast majority of websites are on shared IPs.

DoH/ESNI only provides privacy if we have already (or are planning to) centralise web traffic behind a handful of gatekeepers.

Re: Mozilla’s DNS over HTTPs

#125

Post by zeveb »

jedieaston wrote: post #78
ComputerGuru wrote: post #31

Can someone please explain why there can’t be a DHCP or RA option for which DoH server to use? Why are we going out of our way to make sure the sysadmin has to configure each and every piece of software on each and every single PC rather than just set it one in a centralized location, like every other networking option? DoH will leave my machines unable to resolve all my internal domain names, right?

Firefox is still falling back to local DNS settings if it can't resolve stuff using the currently set DoH provider, as I can access resources in Firefox on my university's network that cannot be resolved outside it.

Does it submit every FQDN via DoH? So does Cloudflare see myspookybox.zeveb? Because if so then even that is an information leak.

Re: Mozilla’s DNS over HTTPs

#126

Post by throw0101a »

tialaramex wrote: post #97
close04 wrote: post #61

Earlier quoted context omitted.

> The comment about having “no plans” to enable this outside the USA seems a bit disingenuous The comment actually very clearly says "we do not have plans to roll out the feature in Europe or other regions at this time ". Also I have mixed feelings about this. On one hand yeah, encryption is great and someone sitting between me and my ISP will no longer be able to monitor my DNS queries. On the other hand I don't fee…

> DoH just enables any piece of software or hardware on my network to bypass any security controls I have in place. I think this is an error in how you've thought about the problem. If your "security controls" depend upon other people volunteering to use some protocol then those weren't "security controls" they were more like "guidelines". [ My local airport has a sign and a telephone so that if you've arrived with g…

> If your "security controls" depend upon other people volunteering to use some protocol then those weren't "security controls" they were more like "guidelines".

It's not about volunteering. Previously I could block udp/53 and tcp/53 and be confident of the fact that no DNS look ups would happen. (DNS queries over other ports could be caught doing packet sniffing.)

Now I have to worry about DNS queries going out via HTTPS. So if I want to monitor my network for malware contacting a C&C server I have to snoop HTTPS. Which means I now have to install a web proxy and perhaps do MITM.

Previously I could 'simply' monitor DNS look ups to see if anything was trying to connect to nefarious domains.

DoH has reduced visibility into my own network.

Re: Mozilla’s DNS over HTTPs

#128

Post by Spivak »

zeveb wrote: post #117
Spivak wrote: post #55

Earlier quoted context omitted.

This logic makes no sense to me. Can you imagine if AT&T or Spectrum made a statement like this? The “network administrator” is an untrusted 3rd party who should have basically 0 say in how my device operates. The device administrator, ie the owner of the machine, is the one who should have the final say over when DoH is used. The use-application-dns record is for businesses that want an easy way to stop DoH on machi…

AT&T and Spectrum do not administer your home network, you do. You have the freedom to configure whatever DNS settings you want; if you wish to use their DNS servers you may; if you wish not to, then you may not. DoH is a non-solution to a non-problem which makes privacy strictly worse by leaking information to Cloudflare in addition to one's ISP.

You are a client on AT&T and Spectrum's network. Just because you turn on a router and set up NAT doesn't make this fact any less true. At some point your internet traffic is going to flow AT&T's network where they are the administrators and are free to apply whatever network policy they see fit.

DoH and DoT is a solution to the problem of sending your DNS requests unencrypted, leaking them to everyone in the process, and then opening the door to any malicious network operator in between you and your DNS server the ability to modify the response in-flight.

Your ISP can and should provide DoH servers. Your local network is free to do the same.

Re: Mozilla’s DNS over HTTPs

#129

Post by throw0101a »

mantap wrote: post #116
im3w1l wrote: post #26

Earlier quoted context omitted.

The ISP can just check which IP you contact, so I don't see this increasing privacy.

That doesn't work anymore. ISPs are not going to block AWS IP ranges or Azure IP ranges, etc. The cloud killed IP blocking. The pirate bay is supposed to be blocked in UK by court order , but because they use cloudflare it's still accessible and only DNS blocked.

> ISPs are not going to block AWS IP ranges or Azure IP ranges, etc.

Tell that to China, Iran, Turkey (?), etc.

Re: Mozilla’s DNS over HTTPs

#130

Post by aduitsis »

rndgermandude wrote: post #66
aduitsis wrote: post #43

If you are a network administrator and want none of this, look at that: https://support.mozilla.org/en-US/kb/canary-domain-use-appli... Basically, make use-application-dns.net. return an error (any kind will do). Filter it in your recursor for example. Having the browser change a fundamental behaviour that used to stand for decades is highly problematic. If nothing else, it is the network administrator who should hav…

>Having the browser change a fundamental behaviour that used to stand for decades is highly problematic. No, this is far too broad of a statement. Browsers pushing for TLS, deprecating the old SSL versions and now the old TLS versions, deprecating SHA1 use in certificates, going from quirksmode to a living html standard (not without problems such as Google's over-influence), etc all have been a net positive, but ther…

The elephant in the room is that many networks need to have content filtering, and you are proposing nothing useful. DoH torpedoes content filtering to its very core and, fortunately, the knob Mozilla provides can (hopefully) be utilized. That's all there's to it.
Post reply on HN