What difference does it make? Even if the DNS queries are completely encrypted, subsequent HTTPS requests made after domain resolution will contain the destination domain (but not the path or request body) in the clear. What makes you assume that ISPs aren't already collecting this information?
Mozilla’s DNS over HTTPs
321–330 of 777 posts
Re: Mozilla’s DNS over HTTPs
#322I may be late to this, but here [1] is some commentary on why DoH (DNS over HTTPS) may not be as affective as it is perceived. The article also talks about DoT (DNS over TLS) mechanism which is apparently less disruptive for network monitoring tools compared to DoH. Can some security minded folks from the community chime in about the claims made in the linked article? (Disclaimer: English is my second language) [1]:…
When end-user privacy is your goal, disrupting network monitoring tools is a feature, not a bug.
Re: Mozilla’s DNS over HTTPs
#323I'm so sad to see Mozilla move forward with this massive attack on user privacy. Firefox DoH is snake oil, plain and simple. It sends all the users DNS queries to Cloudflare, adding a new party which can surveil the user's traffic (and can be legally compelled to do so and not disclose this fact)-- providing a convenient choke point to save spies and hackers the trouble and exposure of extracting the data from tens o…
> But there is no guarantee that these mitigations will continue to work.
This is the biggest problem. It used to be that Firefox was on your side, but now it's turning into the we-know-better-than-our-users Chrome, where they don't even feel like guaranteeing that disabling this malicious and unwarranted service today will continue to leave it disabled tomorrow.
Re: Mozilla’s DNS over HTTPs
#324I'm so sad to see Mozilla move forward with this massive attack on user privacy. Firefox DoH is snake oil, plain and simple. It sends all the users DNS queries to Cloudflare, adding a new party which can surveil the user's traffic (and can be legally compelled to do so and not disclose this fact)-- providing a convenient choke point to save spies and hackers the trouble and exposure of extracting the data from tens o…
My concern about DoH is that it gives marketers and other spies the ability to do DNS lookups while evading my defenses -- regardless of whether or not I'm allowing my browser or other software to use DoH.
The only solution to the problem that I could come up with was to install a MITM proxy in my LAN so that I can detect and filter any sneaky DNS lookups.
I'm still very peeved that Mozilla has forced me to take such measures.
Re: Mozilla’s DNS over HTTPs
#325Can someone at Mozilla explain why they present what is purely textual content as a PNG? I mean, this is ridiculous: https://ffp4g1ylyit3jdyti1hqcvtb-wpengine.netdna-ssl.com/net...
It even seems to break inline links, like in the "split-horizon" section: > System administrators can find relevant documentation here. I'm pretty sure "here" should be a link, but of course that doesn't work when the marketing department uses a PNG instead of HTML. I'm also surprised that Mozilla / the CDN don't optimize the PNG. `zopflipng` reduces the size from 285K to 153K. And of course it's named "Final-DNS-ove…
I clicked.
They could've used an image map. /s
Re: Mozilla’s DNS over HTTPs
#326I'm so sad to see Mozilla move forward with this massive attack on user privacy. Firefox DoH is snake oil, plain and simple. It sends all the users DNS queries to Cloudflare, adding a new party which can surveil the user's traffic (and can be legally compelled to do so and not disclose this fact)-- providing a convenient choke point to save spies and hackers the trouble and exposure of extracting the data from tens o…
> It sends all the users DNS queries to Cloudflare I wonder how much Cloudflare paid for this 'privilege' of being the default DNS provider.
Mozilla claims that Cloudflare is not paying them, and claims that they have a contract with cloudflare which prohibits them from selling the data.
I don't think that this improves the situation substantially. The history of internet privacy failures is full of empty and unrealized promises, and no amount of contracts or promises can trump a court order or a NSL. "Has no ability to collect" is the gold standard, and the only level of protection that guards against compromise and blanket state surveillance activities.
AFAIK they also have never published the contract itself, though doing so wouldn't address the above points.
Edit: After carefully reading the cloudflare privacy statement ( https://developers.cloudflare.com/1.1.1.1/commitment-to-priv... ) I believe it unambiguously states they will collect "aggregate data" such as how much traffic each specific domain is receiving and use it for their own 'development' purposes. To me this seems extraordinarily valuable by itself, quite a windfall.
Re: Mozilla’s DNS over HTTPs
#327Earlier quoted context omitted.
Which is great from a local sysadmin perspective. With DoH I have no control of what various apps on devices on my devices are querying.
Or in other words, DoH works better on hostile networks because it looks like just one more HTTPS connection. That's an intentional design feature. You're attempting to intercept traffic, and any mechanism you could use to do so "transparently" could be used by any hostile network to do so. You can still intercept traffic from cooperating devices if you want, just not transparently. That's a feature, not a bug, and t…
Right, but I do think this is better handled at the OS layer. Hardcoding everyone to route through Cloudflare is a hardly a net win, and might be better or worse than your ISP depending on who and where you are.
Re: Mozilla’s DNS over HTTPs
#328Glad I don’t use it.
Re: Mozilla’s DNS over HTTPs
#329I want it to do something when stuff doesn't work. Replacing one thing with another might improve the situation (or not) but the real problem is failure imho.
To needlessly ramble on a bit: A simple header or html tag could "ok" all or specific alternative ways of distributing and provide conditions. Say, if my blog is unavailable for > 3 months you can p2p distribute it by [for example] fast, medium or supper slow means. Currently I look at articles I wrote long ago. I've carefully selected 10-30 links of which 20% still work(!?) I've picked them specifically because they are probably unfamiliar to those interested in the topic.
Re: Mozilla’s DNS over HTTPs
#330I wish they wouldn't do this. I trust my ISP more than I trust Firefox and whatever company they chose for DNS over HTTP. This "We know better than you" attitude is why I stopped using Firefox so many years ago. I switched back recently, to stop using Chromium, but I have a growing list of annoyances, and it might be time to give NeXt Browser a chance again, or see what else is out there.
"Firefox defaults to Cloudflare, though you can change this." So it's whichever company you choose for DNS, rather than the company chosen by your ISP. Many of us were already choosing not to use the ISP's DNS, for reliability, but with this feature the ISP can't eavesdrop on that.
Most of us chose a company already, our ISP (or in my case a mixture of first + third party). Firefox are defaulting to their choice, no?
Presumably they give an option page on which to choose it - even they wouldn't be so egregious as to hide such a massive change without positive user consent, surely?