Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Mozilla’s DNS over HTTPs

blog.mozilla.org

Post reply on HN
Print view View original

191–200 of 777 posts

Re: Mozilla’s DNS over HTTPs

#191

Post by ck2 »

So basically instead of hundreds of different DNS systems, all an unsupervised person in government or law enforcement has to do is search one or two distinct DNS services for all your queries over the past years.

They can claim all they want it's not logged or anonymized but that's like believing the same claims by your VPN service, you have no idea if they are operating under a silent security order from some agency.

And unless I am missing something, unless you are tunneling though VPN, proxy, etc. your ISP is well aware of every IP connection you do, they simply just rDNS if they want to know.

Re: Mozilla’s DNS over HTTPs

#192

Post by zrm »

judge2020 wrote: post #151
jfindley wrote: post #92

Earlier quoted context omitted.

For 1, you're spot on. For 2, the one thing that's missing from here is that we _know_ many ISPs are selling your data. I'm really uncertain why people are so determined to villify Cloudflare - who don't really stand to gain that much more useful info about you from this than they already have - and give a totally clear pass to their ISP despite years of proven bad behaviour. Yeah this (by default) uses CF's DoH serv…

A good solution would be to do DoH upgrade to their existing provider if the user already has DNS set to a non-ISP resolver (eg. Google, openDNS), only using CF as a default for ISP dns. That or racing multiple DoH providers for the first few queries to choose the fastest one for the user.

Internet gateways commonly give out the gateway's IP address as the DNS and then forward requests upstream from there. How does the application know which DNS the gateway is configured to use?

Re: Mozilla’s DNS over HTTPs

#194

Post by pbhjpbhj »

bepvte wrote: post #46
davidu wrote: post #5

Doth protest too much. People don’t take issue with DoH, they take issue with an advertising supported browser like Mozilla’s unicast (and now bicast) centralization of DNS traffic that was previously distributed. We invented DNSCrypt. There’s also DNS over TLS. Lots of ways to encrypt DNS without centralization. They make this about DoH when really the primary issues are with how they went about it.

DNS over TLS and DNSCrypt both depend on servers... exactly as centralized as DoH. They are just different wire protocols that in the end do the exact same thing with a centralized DNS server.

This service is available from 2 companies; this services is available from 200,000 .. See they're exactly as centralised!!!one

Explain that to me?

Re: Mozilla’s DNS over HTTPs

#195

Post by stjohnswarts »

lovelearning wrote: post #84

As a resident of a country whose government and ISPs heavily and habitually censor the Internet for political reasons, I for one truly appreciate Firefox's DoH. They should also enable 'network.security.esni.enabled' by default because the censors here have upgraded from DNS to SNI-based blocking. I get it that better solutions are possible, but got to teach people to first walk before teaching them to run. AFAIK, Ch…

I'm surprised that they wouldn't block the DNS providers in your country though?

Re: Mozilla’s DNS over HTTPs

#196

Post by ryukafalz »

72deluxe wrote: post #184
JoshTriplett wrote: post #171

Earlier quoted context omitted.

Don't put devices on your network if you don't want to give them network access. And don't block technologies and protocols that help people protect themselves just because they also help devices protect themselves from you MITMing their connections. If you want to run a device reverse-engineering lab you have more work to do to break the security of a device. Also remember that if you can break the security of a dev…

"The correct behavior for devices is to treat the intermediate network between them and the servers they talk to as hostile." Thanks for this - I had not thought of that. Looks like I'll be keeping my "smart" TV off the network forever then (my old LG used to send a network request whenever I pressed any button on the remote)! And all my Android devices, Windows 10 devices and my Apple TV and MacBook too. (This is on…

This is precisely why many of us use Linux and put up with some of the inconveniences or doing so - it’s more trustworthy. (And it gets more convenient as more people start using it.)

Re: Mozilla’s DNS over HTTPs

#197

Post by mox1 »

I recently upgraded my home router to DNS over HTTP (pfSense now supports it pretty easily).

I started with Quad9 (9.9.9.9) and Cloudflare as a backup (1.1.1.1).

One thing I noticed right away was that my ping times to Cloudflare ended up being way faster (15ms) compared to Quad9 (50ms). Cloudflare seems to have a presence in my local area.

Now both are good, but adding a 50ms delay (+TCP handshake + TLS setup and teardown) seemed like a non-trivial amount. I ended up putting Cloudflare first.

There was a noticeable difference, something to think about if you decide to set this up.

Re: Mozilla’s DNS over HTTPs

#198

Post by LinuxBender »

wbl wrote: post #178
LinuxBender wrote: post #157

Earlier quoted context omitted.

This is not the full picture if we are being honest with ourselves. When DoH is default on in all browsers, the masses will be talking to 2 or 3 companies. Sure, they can change what server they talk to, but we all know that most people won't even think about it. DoT implemented on all DNS servers would keep control as distributed as it has been up until now. Until the root serves support DoT, which I doubt they ever…

DOH can also be implemented on every server.

While that is true, it would be much easier to get DoT deployed at scale. During DNS Flag Day of 2019 [1] a significant number of recursive DNS servers around the world started properly supporting EDNS0 and several other modern features of DNS. In most cases, it was just application version updates or configuration changes. Most of the popular and widely deployed recursive DNS servers already support DoT, which means that a similar effort could be made to enable DoT. AFAIK none or few of the popular recursive DNS servers support DoH today natively. It would be significantly easier to get DoT enabled en-mass. People are much more open to making a configuration change if that is the least path of resistance.

[1] - https://dnsflagday.net/2019/

Re: Mozilla’s DNS over HTTPs

#199

Post by stjohnswarts »

gsich wrote: post #175
larrysalibra wrote: post #44

Questions I couldn’t find answers to in the post or linked info about the Trusted Resolver Program: What’s in it for the Cloudflare & NextDNS? Are they getting paid to handle this traffic or paying to have the opportunity to access this data? Can users outside the US opt-in? The comment about having “no plans” to enable this outside the USA seems a bit disingenuous. Hard to believe they built this program / feature a…

Collect data of course. Mozilla is very naive to trust that they won't collect data (be it personal or otherwise). Neither they nor the enduser can ensure that.

Who is more likely to abuse it though, those guys or your ISP? Security is never 100%, it's whack-a-mole

Re: Mozilla’s DNS over HTTPs

#200

Post by Avamander »

cm2187 wrote: post #38
ComputerGuru wrote: post #31

Can someone please explain why there can’t be a DHCP or RA option for which DoH server to use? Why are we going out of our way to make sure the sysadmin has to configure each and every piece of software on each and every single PC rather than just set it one in a centralized location, like every other networking option? DoH will leave my machines unable to resolve all my internal domain names, right?

Is it a big deal to have your internal domain names accessible externally? Many (though not all) DNS server allow private IPs in DNS.

This can cause DNS rebind attacks.
Post reply on HN