Mozilla’s DNS over HTTPs • Hacker News Board

Re: Mozilla’s DNS over HTTPs

#351

Post by ryanisnan » Tue, Feb 25, 2020, 5:53 PM UTC

alwillis wrote: post #263

The underlying issue is that a DoH provider can craft the DNS answers individual users get if it wants to. Think about it: a Firefox DoH user could get different DNS answers than other apps get on the same machine using standard DNS on port 53, if Google or Cloudflare wanted to, because they’re essentially talking to different versions of the internet. Remember, all of the properties that allows HTTPS to be trackable…

> Think about it: a Firefox DoH user could get different DNS answers than other apps get on the same machine using standard DNS on port 53, if Google or Cloudflare wanted to, because they’re essentially talking to different versions of the internet.

How is that different than existing DNS servers?

Re: Mozilla’s DNS over HTTPs

#352

Post by noja » Tue, Feb 25, 2020, 5:53 PM UTC

nullc wrote: post #289

I'm so sad to see Mozilla move forward with this massive attack on user privacy. Firefox DoH is snake oil, plain and simple. It sends all the users DNS queries to Cloudflare, adding a new party which can surveil the user's traffic (and can be legally compelled to do so and not disclose this fact)-- providing a convenient choke point to save spies and hackers the trouble and exposure of extracting the data from tens o…

It's a balance. Do you want your plaintext DNS request sent to starbucks or your local unsecured public wifi, or do you want it sent encrypted to your DoH server of choice?

Re: Mozilla’s DNS over HTTPs

#353

Post by Spivak » Tue, Feb 25, 2020, 5:53 PM UTC

72deluxe wrote: post #147

Spivak wrote: post #121

Earlier quoted context omitted.

There are a couple use-cases here. * On devices that you own and control you don't need a network level control like this except for convenience. This is when you should be applying the override record. * On devices that you do not own or control (family/friends/guests) disabling DoH makes you the malicious network operator. Connecting to your Wi-Fi doesn't make you trusted in any sense of the word. * On devices that…

Thanks. Not to be argumentative, but I find it odd/interesting that guests connecting to my WiFi and using my DNS set up makes me a "malicious network operator" in your eyes. That's a very odd view of the world in my opinion, as it is my WiFi and DNS set up. That's like saying that me stopping guests taking photos of my daily activities (showering, using the toilet) whilst in my house is a malicious behaviour too. I…

> I cannot control what domains are being looked up by devices and applications on my network.

This is kinda the point. For devices you own you have that control by the virtue of being the device admin. Other people's devices are a different story. You are free to have an acceptable use policy on your own network and require traffic to flow through a proxy or whatever but if you do it without their knowledge or consent you're the bad guy.

How pissed would you be if Xfinity just up and blocked random sites like this?

(sibebar: Just from a politeness perspective why would you give your guests anything other than a clean path to the public internet ?)

> That's like saying that me stopping guests taking photos of my daily activities

Having a rule that applies to your guests -- totally cool. Silently disabling their camera without their consent once they come through your door -- not cool.

> Am I a malicious network operator for stopping that garbage being sent off?

I mean you're modifying the traffic coming off of someone else's device without their knowledge or consent. I would be pissed if by husband did something like this without asking -- leaving me to debug why some sites are mysteriously broken.

Re: Mozilla’s DNS over HTTPs

#354

Post by JohnFen » Tue, Feb 25, 2020, 5:53 PM UTC

shawnz wrote: post #333

JohnFen wrote: post #324

Earlier quoted context omitted.

My concern about DoH is that it gives marketers and other spies the ability to do DNS lookups while evading my defenses -- regardless of whether or not I'm allowing my browser or other software to use DoH. The only solution to the problem that I could come up with was to install a MITM proxy in my LAN so that I can detect and filter any sneaky DNS lookups. I'm still very peeved that Mozilla has forced me to take such…

How does DoH allow marketers to do anything they couldn't have done before by just hardcoding their own DNS server? It might make it harder to block queries by deep packet inspection, but do you actually do that on your network right now?

Marketers using hardcoded private servers are the easiest thing to defend against: just block those servers. That fact is one of the big reasons why marketers and other spies don't do that -- they use DNS lookups to find the mother ship.

However, now marketers can use DoH, combined with public servers that would cause disruption to block, to be able to engage in lookups without a means of detecting or blocking them short of doing a MITM setup.

> do you actually do that on your network right now?

Yes, I installed it months ago to defend myself against DoH. I MITM all HTTPS connections, detect DoH lookups, and block them.

Re: Mozilla’s DNS over HTTPs

#355

Post by tptacek » Tue, Feb 25, 2020, 5:53 PM UTC

vetinari wrote: post #237

tptacek wrote: post #162

Earlier quoted context omitted.

Virtually every router on the Internet has the built-in capability to block DoT with a single configuration change, but you can attempt to create a blacklist of DoH resolvers to try to stop that, so they're totally equivalent. That's the argument you've got.

Not quite. Nothing prevents Google or Cloudflare to run DoH on the same IPs as their user-facing services. Unless you are willing to block Search, for example, you might be SOL without TLS-terminating proxy.

Yes, sorry if I wasn't clear, I think the idea that DoH is just as filterable as DoT is silly.

Re: Mozilla’s DNS over HTTPs

#356

Post by JoshTriplett » Tue, Feb 25, 2020, 5:54 PM UTC

nullc wrote: post #326

Jerry2 wrote: post #319

Earlier quoted context omitted.

> It sends all the users DNS queries to Cloudflare I wonder how much Cloudflare paid for this 'privilege' of being the default DNS provider.

Mozilla claims that Cloudflare is not paying them, and claims that they have a contract with cloudflare which prohibits them from selling the data. I don't think that this improves the situation substantially. The history of internet privacy failures is full of empty and unrealized promises, and no amount of contracts or promises can trump a court order or a NSL. "Has no ability to collect" is the gold standard, and…

ISPs can and do sell your information, and can also be served a warrant or NSL. Cloudflare, by contract, is prohibited from doing the former, which is a net improvement even if they're still subject to the latter.

It's an incremental improvement, but a positive one.

I would certainly love to see an even better protocol for Internet name resolution that prevents anyone from having name-lookup information, but in the meantime, DoH seems like a huge step forward in ensuring that no unencrypted traffic is visible to the ISP or local network.

Re: Mozilla’s DNS over HTTPs

#357

Post by Seenso » Tue, Feb 25, 2020, 5:54 PM UTC

gyrgtyn wrote: post #349

How likely is it that the other browsers will eventually do this?

Very likely. IIRC, it's working its way into Chromium, and once it's there it will be everywhere.

https://www.chromium.org/developers/dns-over-https

Re: Mozilla’s DNS over HTTPs

#358

Post by jiveturkey » Tue, Feb 25, 2020, 5:54 PM UTC

dimensi0nal wrote: post #229

pbhjpbhj wrote: post #186

Earlier quoted context omitted.

How? Surely the only way that's possible is if they derive data about users, which they can then sell .. which is what Mozilla claim to be preventing.

Cloudflare's resolver does not send the client subnet, which hurts performance when users connect to anything that doesn't use Cloudflare.

That's one thing, sure, but that doesn't affect the majority of sites. CF's DNS POPs are likely more dense than the great majority of service providers POPs. So using the subnet of the resolver is about as good (if not better) than having ECS info for practical purposes. (Because the client is normally going to hit the closest DNS POP to them in BGP network distance.)

I'm not a CF fanboi, in fact I think they are evil. But let's not make weak arguments. That said, yeah suppression of ECS info is a deliberate anti-competitive choice by CF. They probably have convinced themselves its about privacy, but it isn't.

The real benefit to them is, as the CDN, they get the benefit of even lower latency and even better control. With a penalty to everyone else.

It's a disgusting arrangement, and a net loss in privacy. Your ISP already knows what websites you visit, they don't need the DNS because they see the actual traffic.

I'd find it more palatable if these so-called TRR providers were required to be DNS-only. Maybe DNS + registrar.

Re: Mozilla’s DNS over HTTPs

#359

Post by munchbunny » Tue, Feb 25, 2020, 5:54 PM UTC

cnst wrote: post #337

ThePhysicist wrote: post #317

Earlier quoted context omitted.

99 % of users won’t touch default values, so it’s not a valid excuse. I really have come to the conclusion that privacy is just a marketing feature for Mozilla. They e.g. also do nothing against data exfiltration by popular extensions although they have known that issue for years. If they’re really serious about privacy they should have waited to implement DoH as an open standard and allow more DNS providers to suppo…

> I really have come to the conclusion that privacy is just a marketing feature for Mozilla. They e.gg. also do nothing against data exfiltration by popular extensions although they have known that issue for years. I thought about this recently, and the move to HTTPS-Everywhere is the biggest issue here. In the old days, you could have something like the @guard firewall on Windows, which could examine all outgoing HT…

Intercepting HTTPS is possible, but not easy. It just requires configuring your browser to use a known key pair for client authentication so that you can MITM yourself from a local or network proxy.

On the consideration of trade-offs, I think HTTPS-Everywhere is completely worth it. It may be more complex to intercept your own traffic, but since you are in control of one of the endpoints and the ISPs (which in the US are openly trying to market your browsing data) are not, I still consider it an overall win for privacy.

Re: Mozilla’s DNS over HTTPs

#360

Post by dmd » Tue, Feb 25, 2020, 5:54 PM UTC

How does this work with hosts that are not resolvable outside your own network? If I tell firefox to go to internalsite.mycompany.com - which resolves internally, but not outside our network - how is firefox going to resolve it, if it's not using our DNS servers?