[deleted]
Mozilla’s DNS over HTTPs
201–210 of 777 posts
Re: Mozilla’s DNS over HTTPs
#202Earlier quoted context omitted.
Tunneling DNS inside HTTPS effectively forms part of a VPN already (and I wonder when Mozilla will decide to also stuff the rest of the traffic through...) DNS-based blocking is not perfect, but is currently still very powerful for things like adblocking. You're basically saying that Firefox is now behaving like malware, which I agree with... Windows 10's telemetry is also another piece of software which has started…
If you don't want DoH, you are not forced to use it. Yes its enabled by default, but it doesn't mean you cannot go into the settings menu and deactivate it.
Hmm, unless you're trying to control what comes in/out your home network .. in which case you're screwed. But you can switch it off in your own browser.
I was a happy pihole user. I could choose to allow DNS lookups, and blacklist using OpenDNS. If I install Firefox at home, then I can't block problematic sites; and Cloudflare will use this to sell the idea to advertiser for TVs and such, so it looks like Google/Cloudflare just used Firefox to obviate ad blocking.
Re: Mozilla’s DNS over HTTPs
#203Earlier quoted context omitted.
I'm not sure how firefox could implement this entirely on their end. There would need to be cooperation on the OS (or dhcp client) side to expose that option somehow. We're in this mess because OSes haven't acted and Mozilla has had to take matters into their own hands. Unfortunately any solution that requires cooperation from other software is going to take a lot longer to land. I do hope it happens eventually, and…
It can get even more complicated when you have multiple connections on your machine, each with a different DNS server. You'd need to match the DNS server determination algorithm of the operating system to remain consistent, which is one hell of a task. There's also the fact that there's no DHCP option reserved for DoH/DoT/DNScrypt (yet) which requires some standardisation work. There's various APIs to read the curren…
If you have multiple connections, each of those DNS servers should return the same answers.
If they do not, they should be marked as forwarders for their respective domains. Something like `Add-DnsClientNrptRule -Namespace "domain.com" -NameServers "1.2.3.4"`
The operating system will have this information; an application, like browser, won't.
Re: Mozilla’s DNS over HTTPs
#204Earlier quoted context omitted.
So I should block outgoing TLS requests to be able to stop DoH? Seems a bad idea.... At least with DNS I could run a local DNS server and block outgoing port 53 from anything else. Now I no longer have this option and each app gets to look up what it wants, when it wants. Sure, it's great that my ISP cannot see what's in these requests but nor can I! And it also means that any application (eg. any Google product) can…
Don't put devices on your network if you don't want to give them network access. And don't block technologies and protocols that help people protect themselves just because they also help devices protect themselves from you MITMing their connections. If you want to run a device reverse-engineering lab you have more work to do to break the security of a device. Also remember that if you can break the security of a dev…
The problem is that the device (or website) also treats the owner and legitimate user as untrusted and obfuscates the content of the traffic in a way that makes everything completely opaque for them. The device/site only trusts its manufacturer which makes any device that completely obscures its traffic from its owner feel more like a Trojan horse. This is how you end up with questionable telemetry and data leaks for example.
What's a "trustworthy" device in this circumstance? If you can never verify then it's not trust it's faith and hope.
Re: Mozilla’s DNS over HTTPs
#205Earlier quoted context omitted.
This is not the full picture if we are being honest with ourselves. When DoH is default on in all browsers, the masses will be talking to 2 or 3 companies. Sure, they can change what server they talk to, but we all know that most people won't even think about it. DoT implemented on all DNS servers would keep control as distributed as it has been up until now. Until the root serves support DoT, which I doubt they ever…
DOH can also be implemented on every server.
People keep talking past each other on this because somehow DoH got conflated with Cloudflare.
DoH is a protocol. It has better security than unencrypted DNS. (So do several others, like DNSCurve, DNSCrypt, or routing your DNS queries over a VPN.)
The objection people have is not that it's encrypted, it's that Mozilla implemented it in the browser instead of the OS and thereby ignores the DNS you configured in your OS. And even that is fine as a setting you can enable, but it's problematic as the default. Both because it's administratively burdensome to change a setting in every application on every device if you want to use your own, and because of the second order effect of that, which is that hardly anybody will change it and then DNS becomes centralized to whatever is the default in the browsers.
Re: Mozilla’s DNS over HTTPs
#206Earlier quoted context omitted.
> DNS is the primary way governments control and spy on web access. And DoH will enable every device you own to continue spying on you for the benefit of corporations. DNS is the last bastion of preventing devices I can't sufficiently control from spying on me. I use DNS filtering to block their tracking domains. I use my firewall to prevent devices from accessing DNS resolvers I don't control. DoH takes those option…
So your point is that your attack model was that makers of malwareApp would try to connect to malwareapp.net instead of a random IP? If you are worried about traffic in the browser you can not enable it, it you are worried about anything else then VPNs were already a thing since some time ago.
I suppose my model is that every connected device and app, every web site someone visits, is malware. My household is full of things collecting data and passing it on to entities I don't wish to share that data with.
How do I stop that when my ability to control what happens on my own network has been been reduced to Can access the Internet over 443, or not?
Re: Mozilla’s DNS over HTTPs
#207Does anyone know when something like this might come to Brave?
Re: Mozilla’s DNS over HTTPs
#208Earlier quoted context omitted.
Don't put devices on your network if you don't want to give them network access. And don't block technologies and protocols that help people protect themselves just because they also help devices protect themselves from you MITMing their connections. If you want to run a device reverse-engineering lab you have more work to do to break the security of a device. Also remember that if you can break the security of a dev…
The problem is that the device (or website) also treats the owner and legitimate user as untrusted and obfuscates the content of the traffic in a way that makes everything completely opaque for them. The device/site only trusts its manufacturer which makes any device that completely obscures its traffic from its owner feel more like a Trojan horse. This is how you end up with questionable telemetry and data leaks for…
In what way does this argument not also suggest that the device should use plaintext HTTP so that you can intercept all its other traffic?
Re: Mozilla’s DNS over HTTPs
#209another reason to uninstall firefox
Re: Mozilla’s DNS over HTTPs
#210Earlier quoted context omitted.
A good solution would be to do DoH upgrade to their existing provider if the user already has DNS set to a non-ISP resolver (eg. Google, openDNS), only using CF as a default for ISP dns. That or racing multiple DoH providers for the first few queries to choose the fastest one for the user.
Internet gateways commonly give out the gateway's IP address as the DNS and then forward requests upstream from there. How does the application know which DNS the gateway is configured to use?
In [currently only] Chrome, it doesn't upgrade if the DNS advertised is the router. This proposed Firefox system then would default to CF [or default to the fastest one].