Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Mozilla’s DNS over HTTPs

blog.mozilla.org

Post reply on HN
Print view View original

151–160 of 777 posts

Re: Mozilla’s DNS over HTTPs

#151

Post by judge2020 »

jfindley wrote: post #92
Vinnl wrote: post #2

I think this is generally a good thing. Two questions I've often seen surface on HN though weren't answered: 1. Isn't this better implemented at the OS level? 2. Isn't centralisation to two DoH providers more centralised than five large ISPs? Others are probably better suited to answer, but the answers I can think of: 1. Yes, but it is not, so this solution is second-best. If Operating Systems decide to tackle this p…

For 1, you're spot on. For 2, the one thing that's missing from here is that we _know_ many ISPs are selling your data. I'm really uncertain why people are so determined to villify Cloudflare - who don't really stand to gain that much more useful info about you from this than they already have - and give a totally clear pass to their ISP despite years of proven bad behaviour. Yeah this (by default) uses CF's DoH serv…

A good solution would be to do DoH upgrade to their existing provider if the user already has DNS set to a non-ISP resolver (eg. Google, openDNS), only using CF as a default for ISP dns. That or racing multiple DoH providers for the first few queries to choose the fastest one for the user.

Re: Mozilla’s DNS over HTTPs

#152

Post by tbyehl »

nicolaslem wrote: post #17
drenginian wrote: post #3

Why are people so down on DNS over HTTPS? DNS is the primary way governments control and spy on web access.

My main gripe is that before DoH, setting a custom DNS via DHCP was enough to get all devices on a network and all applications on these devices to use a custom DNS. Now we are headed to a future where each software vendor decides how to make DNS queries. I can predict that all of them will apply their own custom heuristics to detect things like split-horizon.

> before DoH, setting a custom DNS via DHCP was enough

That ship had already sailed. You also have to run your own DNS, allow DNS egress only from your own DNS, and DNAT the rest back to yours in order to un-break all the things with hard-coded resolvers.

Re: Mozilla’s DNS over HTTPs

#153

Post by falcolas »

bsdubernerd wrote: post #91
andridk wrote: post #20

Why isn't this being solved on an operating system level instead?

This question should be upvoted more. Under unix in general (linux, bsd and, I assume, OSX) you can change your system resolver as you please. DoH is supported by several implementations to a various degree already. You can switch right now, for everything running on your system if you wanted to! But browsers nowdays basically live under the following assumptions: - the users are dumb, and "we know what's best for yo…

Well, in the context of DNS resolvers and general computer security the vast majority users are dumb. Mozilla has does know what’s better for them. You, I, all of the readers of Hacker News - we’re the minority.

And for better or worse, the average user’s OS is hostile to a user’s privacy and security, with a few niche exceptions.

Re: Mozilla’s DNS over HTTPs

#154

Post by afiori »

tbyehl wrote: post #143
drenginian wrote: post #3

Why are people so down on DNS over HTTPS? DNS is the primary way governments control and spy on web access.

> DNS is the primary way governments control and spy on web access. And DoH will enable every device you own to continue spying on you for the benefit of corporations. DNS is the last bastion of preventing devices I can't sufficiently control from spying on me. I use DNS filtering to block their tracking domains. I use my firewall to prevent devices from accessing DNS resolvers I don't control. DoH takes those option…

So your point is that your attack model was that makers of malwareApp would try to connect to malwareapp.net instead of a random IP?

If you are worried about traffic in the browser you can not enable it, it you are worried about anything else then VPNs were already a thing since some time ago.

Re: Mozilla’s DNS over HTTPs

#155

Post by fanf2 »

teekert wrote: post #139
larrysalibra wrote: post #44

Questions I couldn’t find answers to in the post or linked info about the Trusted Resolver Program: What’s in it for the Cloudflare & NextDNS? Are they getting paid to handle this traffic or paying to have the opportunity to access this data? Can users outside the US opt-in? The comment about having “no plans” to enable this outside the USA seems a bit disingenuous. Hard to believe they built this program / feature a…

Huh? It works for me in the Netherlands, at least, it is in the settings. How to confirm if I'm using it?

Go to about:networking and look at the DNS tab

Re: Mozilla’s DNS over HTTPs

#156

Post by tssva »

ComputerGuru wrote: post #31

Can someone please explain why there can’t be a DHCP or RA option for which DoH server to use? Why are we going out of our way to make sure the sysadmin has to configure each and every piece of software on each and every single PC rather than just set it one in a centralized location, like every other networking option? DoH will leave my machines unable to resolve all my internal domain names, right?

In prefer the approach Google is taking with Chrome and Microsoft is taking with Windows 10 which is to use the system defined DNS servers and if they support DoH to use it and if not to fallback to using them with normal DNS.

There is no need to configure individual applications and no need to develop a new means of distributing DoH server information.

Re: Mozilla’s DNS over HTTPs

#157

Post by LinuxBender »

bepvte wrote: post #46
davidu wrote: post #5

Doth protest too much. People don’t take issue with DoH, they take issue with an advertising supported browser like Mozilla’s unicast (and now bicast) centralization of DNS traffic that was previously distributed. We invented DNSCrypt. There’s also DNS over TLS. Lots of ways to encrypt DNS without centralization. They make this about DoH when really the primary issues are with how they went about it.

DNS over TLS and DNSCrypt both depend on servers... exactly as centralized as DoH. They are just different wire protocols that in the end do the exact same thing with a centralized DNS server.

This is not the full picture if we are being honest with ourselves. When DoH is default on in all browsers, the masses will be talking to 2 or 3 companies. Sure, they can change what server they talk to, but we all know that most people won't even think about it. DoT implemented on all DNS servers would keep control as distributed as it has been up until now. Until the root serves support DoT, which I doubt they ever will, there will always be weak links. This includes from Cloudflare, Mozilla and others talking to the root servers. I am not trying to convince anyone of anything. This is a very polarizing topic and has been every time it is discussed here and other news aggregators. The best I can do is educate people that I care about so they can make an informed decision.

Re: Mozilla’s DNS over HTTPs

#158

Post by zzzcpan »

luizfzs wrote: post #145

Is there a way to ensure the ISP opt-in parent control is not going to be abused, effectively turning it into a way to bypass DoH at all?

No, well, maybe, depending on your country. I know some countries have laws preventing ISPs from interfering with content, but even those laws do not apply to technical measures, like DoH, they are still completely free to block it.

Re: Mozilla’s DNS over HTTPs

#160

Post by judge2020 »

hunter2_ wrote: post #94
im3w1l wrote: post #26

Earlier quoted context omitted.

The ISP can just check which IP you contact, so I don't see this increasing privacy.

For some (large, especially) sites, the IP address maps to the entity you're trying to contact. For others (small, especially) sites, the IP address is shared among many entities... not just shared origin hosts but also the massive reverse proxies of the world (Cloudflare, etc.).

Also, Cloudflare does give Business and Enterprise customers their own IP addresses (although often rotated) so that these sites work with old non-SNI browsers.
Post reply on HN