Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Mozilla’s DNS over HTTPs

blog.mozilla.org

Post reply on HN
Print view View original

331–340 of 777 posts

Re: Mozilla’s DNS over HTTPs

#331

Post by andyjohnson0 »

nullc wrote: post #320
mtberatwork wrote: post #300

Earlier quoted context omitted.

> We continue to explore enabling DoH in other regions, and are working to add more providers as trusted resolvers to our program. DoH is just one of the many privacy protections you can expect to see from us in 2020. Cloudflare is just one of the initial providers and they indicate that they are adding more. Also, I'm assuming you can add your own custom provider based on the screenshot in the article. You can just…

"You can just opt out" is the same tired line that in former times Mozilla has fought against. It's extremely hard to keep track of and manage "opt outs", especially in a household with multiple computers and multiple people. Formerly, I "opted out" of having a browser that phoned home my browsing traffic by using Firefox.

> Formerly, I "opted out" of having a browser that phoned home my browsing traffic by using Firefox.

Formerly your browser still "phoned home" to your default DNS provider, using an insecure protocol.

I appreciate your concerns but, unless you run your own DNS server, you have to trust someone at some point.

Re: Mozilla’s DNS over HTTPs

#332

Post by Arkanosis »

noident wrote: post #321

What difference does it make? Even if the DNS queries are completely encrypted, subsequent HTTPS requests made after domain resolution will contain the destination domain (but not the path or request body) in the clear. What makes you assume that ISPs aren't already collecting this information?

The Host header is encrypted when using HTTPS and the SNI is encrypted when using ESNI. In the best scenario (DoH + HTTPS + ESNI), ISPs only get the destination IP, not the destination domain.

Re: Mozilla’s DNS over HTTPs

#333

Post by shawnz »

JohnFen wrote: post #324
nullc wrote: post #289

I'm so sad to see Mozilla move forward with this massive attack on user privacy. Firefox DoH is snake oil, plain and simple. It sends all the users DNS queries to Cloudflare, adding a new party which can surveil the user's traffic (and can be legally compelled to do so and not disclose this fact)-- providing a convenient choke point to save spies and hackers the trouble and exposure of extracting the data from tens o…

My concern about DoH is that it gives marketers and other spies the ability to do DNS lookups while evading my defenses -- regardless of whether or not I'm allowing my browser or other software to use DoH. The only solution to the problem that I could come up with was to install a MITM proxy in my LAN so that I can detect and filter any sneaky DNS lookups. I'm still very peeved that Mozilla has forced me to take such…

How does DoH allow marketers to do anything they couldn't have done before by just hardcoding their own DNS server?

It might make it harder to block queries by deep packet inspection, but do you actually do that on your network right now?

Re: Mozilla’s DNS over HTTPs

#334

Post by gsich »

mantap wrote: post #116
im3w1l wrote: post #26

Earlier quoted context omitted.

The ISP can just check which IP you contact, so I don't see this increasing privacy.

That doesn't work anymore. ISPs are not going to block AWS IP ranges or Azure IP ranges, etc. The cloud killed IP blocking. The pirate bay is supposed to be blocked in UK by court order , but because they use cloudflare it's still accessible and only DNS blocked.

Blocking wasn't the point in the post above.

Re: Mozilla’s DNS over HTTPs

#335

Post by kyleee »

jlarocco wrote: post #286

I wish they wouldn't do this. I trust my ISP more than I trust Firefox and whatever company they chose for DNS over HTTP. This "We know better than you" attitude is why I stopped using Firefox so many years ago. I switched back recently, to stop using Chromium, but I have a growing list of annoyances, and it might be time to give NeXt Browser a chance again, or see what else is out there.

Agreed, I dislike the paternalism and wish competition in the browser space was much more robust. I'm Google averse and hooked on Tree Style Tabs so Firefox it is for the time being

Re: Mozilla’s DNS over HTTPs

#336

Post by toomuchtodo »

andyjohnson0 wrote: post #331
nullc wrote: post #320

Earlier quoted context omitted.

"You can just opt out" is the same tired line that in former times Mozilla has fought against. It's extremely hard to keep track of and manage "opt outs", especially in a household with multiple computers and multiple people. Formerly, I "opted out" of having a browser that phoned home my browsing traffic by using Firefox.

> Formerly, I "opted out" of having a browser that phoned home my browsing traffic by using Firefox. Formerly your browser still "phoned home" to your default DNS provider, using an insecure protocol. I appreciate your concerns but, unless you run your own DNS server, you have to trust someone at some point.

> you have to trust someone at some point.

Give me a non-profit infra provider than I can donate to, similar to Let's Encrypt. Let's call it "Let's Resolve", give it a non-profit charter and org style, with transparency, governance, and strong privacy protections. Mozilla could even be one of the sponsors of such an org, thereby ensuring the values it supports are adhered to.

Open Street Map runs on a budget of ~$100k a year. The costs for such an org would be similar; DNS->DoH VMs, orchestration, labor, admin. I've warmed to Cloudflare, but you know how things usually go with for profit benevolence. The love always runs out. Always. And that's okay! Nothing lasts forever, but we need to start putting effort into orgs that are designed to last while protecting user citizens. Build trust, not companies.

Re: Mozilla’s DNS over HTTPs

#337

Post by cnst »

ThePhysicist wrote: post #317
mtberatwork wrote: post #300

Earlier quoted context omitted.

> We continue to explore enabling DoH in other regions, and are working to add more providers as trusted resolvers to our program. DoH is just one of the many privacy protections you can expect to see from us in 2020. Cloudflare is just one of the initial providers and they indicate that they are adding more. Also, I'm assuming you can add your own custom provider based on the screenshot in the article. You can just…

99 % of users won’t touch default values, so it’s not a valid excuse. I really have come to the conclusion that privacy is just a marketing feature for Mozilla. They e.g. also do nothing against data exfiltration by popular extensions although they have known that issue for years. If they’re really serious about privacy they should have waited to implement DoH as an open standard and allow more DNS providers to suppo…

> I really have come to the conclusion that privacy is just a marketing feature for Mozilla. They e.gg. also do nothing against data exfiltration by popular extensions although they have known that issue for years.

I thought about this recently, and the move to HTTPS-Everywhere is the biggest issue here. In the old days, you could have something like the @guard firewall on Windows, which could examine all outgoing HTTP connections, and block ads and malware by examining not just the hostname, but also the URI of each request. This meant it was separate from the browser, worked with all browsers, and didn't break every time your browser is updated. It's pretty easy to write a similar tool on UNIX to act as a proxy, too, and make it network-wide through your OSS router.

Nowdays, because it's all encrypted with certificate authorities and all, it's much more problematic to block ads and malware, because then you'd also have to intercept HTTPS, and manage certificate authorities and such. I guess it's still doable in principle, just more involved, with a considerably worse UI? Has anyone tried anything like that in the HTTPS world, do any solutions exist as FLOSS at all?

Re: Mozilla’s DNS over HTTPs

#338

Post by Karunamon »

nullc wrote: post #326
Jerry2 wrote: post #319

Earlier quoted context omitted.

> It sends all the users DNS queries to Cloudflare I wonder how much Cloudflare paid for this 'privilege' of being the default DNS provider.

Mozilla claims that Cloudflare is not paying them, and claims that they have a contract with cloudflare which prohibits them from selling the data. I don't think that this improves the situation substantially. The history of internet privacy failures is full of empty and unrealized promises, and no amount of contracts or promises can trump a court order or a NSL. "Has no ability to collect" is the gold standard, and…

Agreed. Unless that contract includes heavy penalties for selling and/or losing that data, its toothless nonsense. The fact that the contract hasn't been published is also problematic. If everything is above board, why hide?

Re: Mozilla’s DNS over HTTPs

#339

Post by ajross »

nullc wrote: post #289

I'm so sad to see Mozilla move forward with this massive attack on user privacy. Firefox DoH is snake oil, plain and simple. It sends all the users DNS queries to Cloudflare, adding a new party which can surveil the user's traffic (and can be legally compelled to do so and not disclose this fact)-- providing a convenient choke point to save spies and hackers the trouble and exposure of extracting the data from tens o…

This seems unnecessarily alarmist. DNS over HTTP doesn't protect against state-level legally-mandated surveillance because it's not designed to protect against state-level legally-mandated surveillance. There are no solutions to the problem you posit that don't involve SOME kind of trusted name authority somewhere that is, effectively by argumentative fiat (i.e. not really) "out of the reach" of whatever government it is that you don't trust. That's not something you're going to find a technical solution for.

The real problem addressed by DoH is the routine surveillance and hijacking of "presumptively public" names by local network operators. And it works comparatively well for that.

Re: Mozilla’s DNS over HTTPs

#340

Post by nothrabannosir »

andyjohnson0 wrote: post #331
nullc wrote: post #320

Earlier quoted context omitted.

"You can just opt out" is the same tired line that in former times Mozilla has fought against. It's extremely hard to keep track of and manage "opt outs", especially in a household with multiple computers and multiple people. Formerly, I "opted out" of having a browser that phoned home my browsing traffic by using Firefox.

> Formerly, I "opted out" of having a browser that phoned home my browsing traffic by using Firefox. Formerly your browser still "phoned home" to your default DNS provider, using an insecure protocol. I appreciate your concerns but, unless you run your own DNS server, you have to trust someone at some point.

Parent post already covered this in the original comment: the ISP can already see all IPs and often SNI. Basically they still see the host names. DoH is just adding an extra party to that chain.

I’m not taking sides here but the argument was made, and valid.

Post reply on HN