Mozilla’s DNS over HTTPs

It's very frustrating to be constantly downvoted for saying that Firefox's DoH implementation leaks information without any of the downvoters saying why.

Seriously, do you disagree that it leaks information? Do you agree that it does, but believe it is less problematic for two companies to have this information than having it sharded across all ISPs? Do you agree that it's more problematic but you don't care for some other reason? Do you agree that it's problematic and care but don't like how I express my point? Do you agree, care and like my expression but think it adds no value to HN?

I can't learn if we don't discuss the issue.

The underlying issue is that a DoH provider can craft the DNS answers individual users get if it wants to.

Think about it: a Firefox DoH user could get different DNS answers than other apps get on the same machine using standard DNS on port 53, if Google or Cloudflare wanted to, because they’re essentially talking to different versions of the internet.

Remember, all of the properties that allows HTTPS to be trackable—cookies, fingerprinting and the rest—is in play for DNS over HTTPS as well. DoT doesn’t allow for that.

If all these providers wanted was encrypted DNS, they’d be pushing DNS over TLS, which is just standard DNS using TLS as the transport. Sure, it uses port 853, but given time, enterprises and other security-conscious organizations would have adjusted, especially if the entire DNS ecosystem got behind it.

But because Google, Cloudflare and NextDNS see an opportunity of some kind, they are pushing for DoH.

The DNS is an open, global, distributed hierarchical database; DoH starts to break this because apps can bypass most of this and that’s not how the internet was designed to work.

The same way Gmail broke the model of federated SMTP servers to a large extent, there’s the potential for the major DoH providers to do the same to DNS.

Imagine if Cloudflare decided to block certain DNS records from their users. Certain services that worked fine pre-DoH would break.

Take a look at the article DNS Wars; it’s eye opening: https://blog.apnic.net/2019/11/04/dns-wars/

In order to be included in Firefox, they needed to agree to the DOH-resolver policy[1]. That states that:

> We intend to publicly document violations of this Policy and take additional actions if necessary.

I believe that those "additional actions" will prevent providers from violating the policy. If not, they will be removed from Firefox.

[1] https://wiki.mozilla.org/Security/DOH-resolver-policy

I still don't trust them. Clouldflare is simply way too big and has done a lot of shady controversial stuff. I also feel like this is breaking something fundamental about the operating system. DNS queries are now going to be different between your browser and ... the rest of your operating system.

How does Firefox deal with corporate installations and internal DNS?

Some folks have a dnscrypt server for their LAN already, and/or use Split-Horizon DNS on their networks. Systems are already configured to use those setups at the system level, and having to have per-app dns settings now is madness.

I'm in the "this should be done by the system resolver" camp, and I hope they figure out how to push that for all the major platforms ...