Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Mozilla’s DNS over HTTPs

blog.mozilla.org

Post reply on HN
Print view View original

291–300 of 777 posts

Re: Mozilla’s DNS over HTTPs

#291

Post by pbhjpbhj »

rndgermandude wrote: post #136
aduitsis wrote: post #130

Earlier quoted context omitted.

The elephant in the room is that many networks need to have content filtering, and you are proposing nothing useful. DoH torpedoes content filtering to its very core and, fortunately, the knob Mozilla provides can (hopefully) be utilized. That's all there's to it.

>The elephant in the room is that many networks need to have content filtering First of all, we're talking about domain filtering, not content filtering. And no, they want domain filtering, hardly anybody needs it, and there are better solutions than NXDOMAIN, such as actual content filters. >and you are proposing nothing useful. Why would I need to provide "something useful"? mozilla already described the many ways…

I need domain filtering: if the domain serves malware I want to block it, not just the known malware coming from it. If a domain serves porn, I want to block it on my kids computers (and mine) not just the content that is recognisable as porn. If a domain is used by malware I want to block it, and probably use the domain to determine the server, and block that too (too because the domain can move IP).

Re: Mozilla’s DNS over HTTPs

#292

Post by pbhjpbhj »

damnyou wrote: post #244
aduitsis wrote: post #130

Earlier quoted context omitted.

The elephant in the room is that many networks need to have content filtering, and you are proposing nothing useful. DoH torpedoes content filtering to its very core and, fortunately, the knob Mozilla provides can (hopefully) be utilized. That's all there's to it.

This is quite a radical position, but there are no legitimate use cases for content filtering. What use cases do people have in mind? * State censorship. Totalitarian. * "Parental controls". Child abuse. Learn how to build trust in your children instead. * Corporate filtering. Find other ways to motivate your employees than blocking Facebook. The problem with this implementation is that it doesn't go far enough. I wa…

How about wanting to filter advertising, or filter content for myself - I block imgur via DNS for example, or block domains used by trackers and malware creators?

Re: Mozilla’s DNS over HTTPs

#293

Post by gsich »

stjohnswarts wrote: post #199
gsich wrote: post #175

Earlier quoted context omitted.

Collect data of course. Mozilla is very naive to trust that they won't collect data (be it personal or otherwise). Neither they nor the enduser can ensure that.

Who is more likely to abuse it though, those guys or your ISP? Security is never 100%, it's whack-a-mole

I don't know, that wasn't the point though. At least with the ISP I am a customer, not a product.

Re: Mozilla’s DNS over HTTPs

#294

Post by dmix »

fanf2 wrote: post #155
teekert wrote: post #139

Earlier quoted context omitted.

Huh? It works for me in the Netherlands, at least, it is in the settings. How to confirm if I'm using it?

Go to about:networking and look at the DNS tab

I'm in Canada and TRR is indeed marked false for every domain.

Re: Mozilla’s DNS over HTTPs

#295

Post by hedora »

jimmaswell wrote: post #247

Seems very marginal for privacy when people in the middle can still see the IP you're connecting to, just not which DNS record you may have retrieved the IP with.

Run wireshark on an ssl connection. The server certificate is sent in plaintext. It includes the DNS name of the server you connected to.

DoH would make sense in a world where that was fixed. (Though DNS over TLS is also a thing, and makes strictly more sense than DoH from what I can tell...)

Re: Mozilla’s DNS over HTTPs

#296

Post by RL_Quine »

organsnyder wrote: post #281
middleclick wrote: post #278

Earlier quoted context omitted.

Not all ISPs around the world have the resources to do that. It also doesn't have to be 100%, we just have to make it difficult (or more expensive) and that helps.

Good point. Sniffing traffic is orders of magnitude more expensive than simply logging DNS queries.

    tcpdump -i any -s 1500 '(tcp[((tcp[12:1] & 0xf0) >> 2)+5:1] = 0x01) and (tcp[((tcp[12:1] & 0xf0) >> 2):1] = 0x16)' -nnXSs0 -ttt
Is it though? This one liner works just fine for me on my gateway and is capturing quite a huge number of raw SNI names.

     0x0110:  c008 0016 0013 0010 000d c00d c003 000a  ................
     0x0120:  00ff 0100 0113 0000 001d 001b 0000 186c  ...............l
     0x0130:  6f67 7369 6e6b 2e64 6576 6963 6573 2e6e  ogsink.devices.n
     0x0140:  6573 742e 636f 6d00 0b00 0403 0001 0200  est.com.........

Re: Mozilla’s DNS over HTTPs

#297

Post by dmix »

gsich wrote: post #293
stjohnswarts wrote: post #199

Earlier quoted context omitted.

Who is more likely to abuse it though, those guys or your ISP? Security is never 100%, it's whack-a-mole

I don't know, that wasn't the point though. At least with the ISP I am a customer, not a product.

And we all know what the ISP business model is. We have a right to ask what Cloudflare is getting out of this.

We've seen the "don't be evil" free stuff thing turn sideways before.

Re: Mozilla’s DNS over HTTPs

#298

Post by cpeterso »

godshatter wrote: post #260
leeoniya wrote: post #236

how long does Cloudflare or NextDNS retain dns query logs?

Also, why limit the choices to just those two? If you're going to provide an app-based service for this, why not allow the user to use any DoH server they want to use? Did Mozilla make some kind of deal with Cloudflare and NextDNS?

The Firefox settings UI allows the user to set a custom DoH server. For example, Quad9 is yet another DNS provider that hosts DoH servers:

https://www.quad9.net/doh-quad9-dns-servers/

Re: Mozilla’s DNS over HTTPs

#300

Post by mtberatwork »

nullc wrote: post #289

I'm so sad to see Mozilla move forward with this massive attack on user privacy. Firefox DoH is snake oil, plain and simple. It sends all the users DNS queries to Cloudflare, adding a new party which can surveil the user's traffic (and can be legally compelled to do so and not disclose this fact)-- providing a convenient choke point to save spies and hackers the trouble and exposure of extracting the data from tens o…

> We continue to explore enabling DoH in other regions, and are working to add more providers as trusted resolvers to our program. DoH is just one of the many privacy protections you can expect to see from us in 2020.

Cloudflare is just one of the initial providers and they indicate that they are adding more. Also, I'm assuming you can add your own custom provider based on the screenshot in the article. You can just disable the feature as well.

Post reply on HN