Can you disable this?
What are some reasons why someone would prefer to or need to disable it. Just curious.
My computer, my User agent, my rules. I want to be in 100% control over DNS queries (logging/blocking).
Mozilla’s DNS over HTTPs
271–280 of 777 posts
Re: Mozilla’s DNS over HTTPs
#272Earlier quoted context omitted.
I supposed not having a dictatorship regime in your country history book helps to see things that way. Given the way my country went from freedom to "regime de Vichy" in a few years, during my grandpa time, I don't want a state level entity having that kind of power. Since the US state level entities decided they could now ignore Habeas Corpus and legitimated torture, secret courts and declared impunity for them-self…
If a malicious power takes over your country they’ll hit you with a rubber hose until you give up your secrets much before they give a shit about your internet history, I suspect.
That is the case if they are targeting you, what you should likely worry about is if they take interest in you.
Re: Mozilla’s DNS over HTTPs
#273I may be late to this, but here [1] is some commentary on why DoH (DNS over HTTPS) may not be as affective as it is perceived. The article also talks about DoT (DNS over TLS) mechanism which is apparently less disruptive for network monitoring tools compared to DoH. Can some security minded folks from the community chime in about the claims made in the linked article? (Disclaimer: English is my second language) [1]:…
The article has several good points but also some weak ones.
For example, it points out that DoH doesn't really protect privacy from ISPs because ISPs can still see what the users are doing because the ISPs route the traffic. Then, it claims that DoH weakens security because it would let users get around malware blacklists. However, this is mostly nonsense for the same reason. Malware (and other legitimate blacklisting) can and should be blocked even when hard-coded IP addresses are used.
The point about the logistics is very true, though. I won't use DoH at home because I operate my own DNS that contains intranet addresses not accessible from the outside Internet. DoH in Firefox would break those services.
Re: Mozilla’s DNS over HTTPs
#274Seems very marginal for privacy when people in the middle can still see the IP you're connecting to, just not which DNS record you may have retrieved the IP with.
It's far easier for ISPs to scrape up your DNS queries (they run the resolver) than it is for the to make correlations based on IP addresses, especially with multiple websites hosted on the same IP.
Re: Mozilla’s DNS over HTTPs
#275Having just manually enabled DoH, it is pretty tricky to see that DoH is enabled (e.g. from padlock/shield). In the end I saw the necessary flags from: https://www.bleepingcomputer.com/news/software/mozilla-enabl...
Under about:config, it seems like network.trr.mode with values 2 or 3 are good choices, https://wiki.mozilla.org/Trusted_Recursive_Resolver#network....
UPDATE: network.trr.mode with 3 is not working for me in Australia.
Re: Mozilla’s DNS over HTTPs
#276Earlier quoted context omitted.
24h except for "sampling".
I still don't trust them. Clouldflare is simply way too big and has done a lot of shady controversial stuff. I also feel like this is breaking something fundamental about the operating system. DNS queries are now going to be different between your browser and ... the rest of your operating system. How does Firefox deal with corporate installations and internal DNS?
> How does Firefox deal with corporate installations and internal DNS?
Everything is configurable and there are canaries to override that.
Re: Mozilla’s DNS over HTTPs
#277Seems very marginal for privacy when people in the middle can still see the IP you're connecting to, just not which DNS record you may have retrieved the IP with.
It's actually quite massive. Most sites (well not most, but a lot) sit behind something like cloudflare, so your scummy intercepting ISP would only see a connection to cloudflare. Of course none of this really means too much until encrypted SNI is a thing but it's a definitely a lot more than marginal imo
You can sort of assume anybody paying any attention to traffic is sniffing the SNI information, it's pretty obvious.
Re: Mozilla’s DNS over HTTPs
#278Earlier quoted context omitted.
It's actually quite massive. Most sites (well not most, but a lot) sit behind something like cloudflare, so your scummy intercepting ISP would only see a connection to cloudflare. Of course none of this really means too much until encrypted SNI is a thing but it's a definitely a lot more than marginal imo
You can sort of assume anybody paying any attention to traffic is sniffing the SNI information, it's pretty obvious.
Not all ISPs around the world have the resources to do that. It also doesn't have to be 100%, we just have to make it difficult (or more expensive) and that helps.
Re: Mozilla’s DNS over HTTPs
#279Earlier quoted context omitted.
24h except for "sampling".
I still don't trust them. Clouldflare is simply way too big and has done a lot of shady controversial stuff. I also feel like this is breaking something fundamental about the operating system. DNS queries are now going to be different between your browser and ... the rest of your operating system. How does Firefox deal with corporate installations and internal DNS?
Firefox will detect when it has enterprise administrative policies set and disable DoH. The parental control topic though is still very much open. Mozilla's statement is that they are "working with the industry to define appropriate standards that will enable smooth functioning of opt-in parental controls" provided by ISP. No word on when or if only these ISP controls will be considered.
Re: Mozilla’s DNS over HTTPs
#280Why are people so down on DNS over HTTPS? DNS is the primary way governments control and spy on web access.
I think part of the negativity you see is network admins working in businesses. Their opinion is that it's a way for people to get around corporate firewalls. Kinda blind to the idea that if a browser can implement DNS over HTTPS then anything can. Especially since there's some of ways that Mozilla have implemented for a local area DNS server to override its settings. There's also another camp, if you remember the "i…
> I think part of the negativity you see is network admins working in businesses.
They can block the canary domain[1].
> Of course their argument was parental controls being made ineffective.
DoH is disabled on Windows and macOS if parental controls are enabled[1].
[1] https://support.mozilla.org/en-US/kb/configuring-networks-di...