Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Mozilla’s DNS over HTTPs

blog.mozilla.org

Post reply on HN
Print view View original

171–180 of 777 posts

Re: Mozilla’s DNS over HTTPs

#171

Post by JoshTriplett »

72deluxe wrote: post #112
tialaramex wrote: post #97

Earlier quoted context omitted.

> DoH just enables any piece of software or hardware on my network to bypass any security controls I have in place. I think this is an error in how you've thought about the problem. If your "security controls" depend upon other people volunteering to use some protocol then those weren't "security controls" they were more like "guidelines". [ My local airport has a sign and a telephone so that if you've arrived with g…

So I should block outgoing TLS requests to be able to stop DoH? Seems a bad idea.... At least with DNS I could run a local DNS server and block outgoing port 53 from anything else. Now I no longer have this option and each app gets to look up what it wants, when it wants. Sure, it's great that my ISP cannot see what's in these requests but nor can I! And it also means that any application (eg. any Google product) can…

Don't put devices on your network if you don't want to give them network access. And don't block technologies and protocols that help people protect themselves just because they also help devices protect themselves from you MITMing their connections. If you want to run a device reverse-engineering lab you have more work to do to break the security of a device.

Also remember that if you can break the security of a device, so could an ISP router. The correct behavior for devices is to treat the intermediate network between them and the servers they talk to as hostile.

How many people are using custom local plaintext DNS as a measure to analyze local devices on their network? How many more people are having their whole network's DNS usage analyzed by their ISP and anyone their ISP sells data to? The defaults are designed to be the right choice for people who don't change the defaults.

Re: Mozilla’s DNS over HTTPs

#172

Post by mavrc »

drenginian wrote: post #3

Why are people so down on DNS over HTTPS? DNS is the primary way governments control and spy on web access.

> Why are people so down on DNS over HTTPS?

It added yet another thing I have to implement, test and maintain through whatever changes they decide to make.

Nothing like adding extra work for every enterprise IT team to make new friends.

There are also some massive security issues with making all https traffic blind that making only the data blind didn't create - like the ability to blackhole known unsafe domains as they appear.

Re: Mozilla’s DNS over HTTPs

#173

Post by wolco »

zzzcpan wrote: post #138
hunter2_ wrote: post #94

Earlier quoted context omitted.

For some (large, especially) sites, the IP address maps to the entity you're trying to contact. For others (small, especially) sites, the IP address is shared among many entities... not just shared origin hosts but also the massive reverse proxies of the world (Cloudflare, etc.).

There is an actual research on this. More than 90% of alexa's top 1 million websites (more like 95% or so) are uniquely identifiable just by IP addresses you connect to when you visit them. This is not a single IP address per website, but multiple, because websites include subresources with other IP addresses to connect to. On top of that, there is a pressure on CDNs and clouds to make websites stick to specific IP a…

How would they force cloud providers customers to host on an ip? Do you envision restrictig new instances with manual approvals required?

Re: Mozilla’s DNS over HTTPs

#174

Post by supernovae »

rciorba wrote: post #27
andridk wrote: post #20

Why isn't this being solved on an operating system level instead?

It could be. Since Mozilla makes a browser it was natural they'd try to solve it at the application level and not wait until M$ and other privacy loving OS vendors solve the problem.

Microsoft has already said they're moving to encrypted DNS. Windows Core team announced this to insiders last year.

Re: Mozilla’s DNS over HTTPs

#175

Post by gsich »

larrysalibra wrote: post #44

Questions I couldn’t find answers to in the post or linked info about the Trusted Resolver Program: What’s in it for the Cloudflare & NextDNS? Are they getting paid to handle this traffic or paying to have the opportunity to access this data? Can users outside the US opt-in? The comment about having “no plans” to enable this outside the USA seems a bit disingenuous. Hard to believe they built this program / feature a…

Collect data of course. Mozilla is very naive to trust that they won't collect data (be it personal or otherwise). Neither they nor the enduser can ensure that.

Re: Mozilla’s DNS over HTTPs

#176

Post by zrm »

tialaramex wrote: post #97
close04 wrote: post #61

Earlier quoted context omitted.

> The comment about having “no plans” to enable this outside the USA seems a bit disingenuous The comment actually very clearly says "we do not have plans to roll out the feature in Europe or other regions at this time ". Also I have mixed feelings about this. On one hand yeah, encryption is great and someone sitting between me and my ISP will no longer be able to monitor my DNS queries. On the other hand I don't fee…

> DoH just enables any piece of software or hardware on my network to bypass any security controls I have in place. I think this is an error in how you've thought about the problem. If your "security controls" depend upon other people volunteering to use some protocol then those weren't "security controls" they were more like "guidelines". [ My local airport has a sign and a telephone so that if you've arrived with g…

> If your "security controls" depend upon other people volunteering to use some protocol then those weren't "security controls" they were more like "guidelines".

It isn't really a matter of security controls. Anything has always been able to create an encrypted tunnel on TCP/443 and send whatever over it.

The issue is administrative cost for cooperative applications. You have a local DNS that e.g. blocks known malicious domains and has the local names for other devices on your LAN. The user of each device doesn't want to prevent this, the application developer doesn't want to prevent it, but making that happen when applications default to using a third party DNS goes from setting the DNS via DHCP to changing a separate setting in every application on every device.

The suggested solution to this is to have the local DNS resolve a canary domain in a particular way which Firefox takes as a request not to use DoH by default. That basically works, but I still don't know what they intend to do when adversarial upstream DNS servers start resolving the canary domain that way. It would also work a lot better if there was a standard canary domain instead of every application making up their own.

Re: Mozilla’s DNS over HTTPs

#177

Post by rasengan »

larrysalibra wrote: post #44

Questions I couldn’t find answers to in the post or linked info about the Trusted Resolver Program: What’s in it for the Cloudflare & NextDNS? Are they getting paid to handle this traffic or paying to have the opportunity to access this data? Can users outside the US opt-in? The comment about having “no plans” to enable this outside the USA seems a bit disingenuous. Hard to believe they built this program / feature a…

> having “no plans” to enable this outside the USA seems a bit disingenuous.

Other countries have censorship (China, UK, New Zealand, etc) whereas there is none in the US.

I wonder if that’s why?

Re: Mozilla’s DNS over HTTPs

#178

Post by wbl »

LinuxBender wrote: post #157
bepvte wrote: post #46

Earlier quoted context omitted.

DNS over TLS and DNSCrypt both depend on servers... exactly as centralized as DoH. They are just different wire protocols that in the end do the exact same thing with a centralized DNS server.

This is not the full picture if we are being honest with ourselves. When DoH is default on in all browsers, the masses will be talking to 2 or 3 companies. Sure, they can change what server they talk to, but we all know that most people won't even think about it. DoT implemented on all DNS servers would keep control as distributed as it has been up until now. Until the root serves support DoT, which I doubt they ever…

DOH can also be implemented on every server.

Re: Mozilla’s DNS over HTTPs

#179

Post by strunz »

jaas wrote: post #32
andridk wrote: post #20

Why isn't this being solved on an operating system level instead?

If operating systems had taken care of the problem already then Mozilla might not have to. I'm glad Mozilla isn't waiting around for them to protect my privacy.

Isn't this gonna cause a bunch of headaches though? What about people who connect to VPN and rely on the local DNS server to resolve non-public hosts? It'll work in everything but Firefox? Seems confusing.

Re: Mozilla’s DNS over HTTPs

#180

Post by vetinari »

bepvte wrote: post #49
Legogris wrote: post #25

Earlier quoted context omitted.

Which is great from a local sysadmin perspective. With DoH I have no control of what various apps on devices on my devices are querying.

https://support.mozilla.org/en-US/kb/canary-domain-use-appli... , also if you can block it this easily so can the government. The difference with a canary domain is that mozilla can disable it if its misused.

1) other applications or malware won't respect canary domain

2) to implement this canary, you have to break DNSSEC on entire .net root domain. Great.

Post reply on HN