Mozilla’s DNS over HTTPs • Hacker News Board

Re: Mozilla’s DNS over HTTPs

#361

Post by pretty_bubbles » Tue, Feb 25, 2020, 5:55 PM UTC

Seenso wrote: post #345

nullc wrote: post #289

I'm so sad to see Mozilla move forward with this massive attack on user privacy. Firefox DoH is snake oil, plain and simple. It sends all the users DNS queries to Cloudflare, adding a new party which can surveil the user's traffic (and can be legally compelled to do so and not disclose this fact)-- providing a convenient choke point to save spies and hackers the trouble and exposure of extracting the data from tens o…

> Firefox DoH is snake oil, plain and simple... Correct me if I'm wrong, but the concern I have about browser-controlled DoH is that it seems like it could make it harder for a tech-savvy user to assert control over their own network. IIRC, most network-level ad-blocking operates at the DNS level. I've also personally blocked telemetry by setting my router's DNS proxy to resolve certain telemetry servers to 0.0.0.0.…

If you use the nextdns DoH provider in Firefox you can actually configure your own adblocking domains even when you're moving around across networks. Just FYI

Re: Mozilla’s DNS over HTTPs

#362

Post by ThePhysicist » Tue, Feb 25, 2020, 5:56 PM UTC

andyjohnson0 wrote: post #331

nullc wrote: post #320

Earlier quoted context omitted.

"You can just opt out" is the same tired line that in former times Mozilla has fought against. It's extremely hard to keep track of and manage "opt outs", especially in a household with multiple computers and multiple people. Formerly, I "opted out" of having a browser that phoned home my browsing traffic by using Firefox.

> Formerly, I "opted out" of having a browser that phoned home my browsing traffic by using Firefox. Formerly your browser still "phoned home" to your default DNS provider, using an insecure protocol. I appreciate your concerns but, unless you run your own DNS server, you have to trust someone at some point.

I trust my own DNS provider much more than I trust Cloudflare to be honest. Also, most DNS requests over that “insecure protocol” happened over a single network hop or two and never left the infrastructure of the ISP.

Cloudflare is now a public company and they need to aggressively monetize their services. Selling browsing data is a lucrative business and becoming “the” DNS provider for most users (while locking out all other players) is a great way to build a data monopoly.

Not to mention that being the number one DNS provider will give them many opportunities to break domain resolution for users that don’t use their DoH service, as they also control the DNS entries for many sites (they could e.g. make propagation via normal DNS slower or start providing only a limited set of entries over “insecure” DNS).

Re: Mozilla’s DNS over HTTPs

#363

Post by Spivak » Tue, Feb 25, 2020, 5:57 PM UTC

pbhjpbhj wrote: post #301

SAI_Peregrinus wrote: post #251

Earlier quoted context omitted.

Of note: PiHole supports DoH, so you point your DoH supporting applications at it. If your OS gets around to adding DoH support you can point your entire OS at it and disable DoH in applications, but until then you'll have to do things the hard way.

At present though devices on the network all for DNS and my network says "use pihole" but applications that implement DoH never ask the network, so I have to have access to all the applications (including those from bad actors). I block MS telemetry domains for example, where's the config for me to stop them using DoH; what about the trackers on my TV? Now I need to configure every device - that's capable of using Fi…

Not apply the same logic to a network-wide ad-blocking HTTP filter and HTTPS.

Re: Mozilla’s DNS over HTTPs

#364

Post by EvanAnderson » Tue, Feb 25, 2020, 5:58 PM UTC

silon42 wrote: post #103

userbinator wrote: post #82

Earlier quoted context omitted.

Tunneling DNS inside HTTPS effectively forms part of a VPN already (and I wonder when Mozilla will decide to also stuff the rest of the traffic through...) DNS-based blocking is not perfect, but is currently still very powerful for things like adblocking. You're basically saying that Firefox is now behaving like malware, which I agree with... Windows 10's telemetry is also another piece of software which has started…

Exactly. To control DoH we need to start to MITM all connections and block everthing else unless whitelisted.

For home network operators who value controlling the name resolution of devices they 'own' MITM won't be enough once embedded device manufacturers start using certificate pinning w/ DoH.

Re: Mozilla’s DNS over HTTPs

#365

Post by nullc » Tue, Feb 25, 2020, 5:58 PM UTC

toomuchtodo wrote: post #336

andyjohnson0 wrote: post #331

Earlier quoted context omitted.

> Formerly, I "opted out" of having a browser that phoned home my browsing traffic by using Firefox. Formerly your browser still "phoned home" to your default DNS provider, using an insecure protocol. I appreciate your concerns but, unless you run your own DNS server, you have to trust someone at some point.

> you have to trust someone at some point. Give me a non-profit infra provider than I can donate to, similar to Let's Encrypt. Let's call it "Let's Resolve", give it a non-profit charter and org style, with transparency, governance, and strong privacy protections. Mozilla could even be one of the sponsors of such an org, thereby ensuring the values it supports are adhered to. Open Street Map runs on a budget of ~$100…

I'm dubious. If someone asked me to run such a thing and offered to pay for it, I'd turn them down:

It's too easy to be compromised (via hackers, including the state funded kind) or ordered (e.g. via an administrative subpoena, NSL, or plain court order) and fail to deliver on the expected privacy. This false sense of security might even get people killed, when they think their activities are private when they really aren't.

You might get a strong selection effect for parties who are less principled, thoughtful, knowledgeable, or even outright less honest. Why should someone trust them more than cloudflare (who is already seeing a substantial portion of user traffic, because if you don't use them-- you get DDOS attacks and then mysteriously cloudflare sales contacting you).

The situation with Let's Encrypt is different-- the SSL CA process is already fairly insecure and bogus certs are already easily issued to any party that can MITM traffic to the target server. Even ignoring that ... Any one rogue CA which is trusted by browsers is enough. So there is little to no incentive to compromise Let's Encrypt.

Re: Mozilla’s DNS over HTTPs

#366

Post by shawnz » Tue, Feb 25, 2020, 5:59 PM UTC

JohnFen wrote: post #354

shawnz wrote: post #333

Earlier quoted context omitted.

How does DoH allow marketers to do anything they couldn't have done before by just hardcoding their own DNS server? It might make it harder to block queries by deep packet inspection, but do you actually do that on your network right now?

Marketers using hardcoded private servers are the easiest thing to defend against: just block those servers. That fact is one of the big reasons why marketers and other spies don't do that -- they use DNS lookups to find the mother ship. However, now marketers can use DoH, combined with public servers that would cause disruption to block, to be able to engage in lookups without a means of detecting or blocking them s…

If you are going to that level of effort then why not just block the IPs of the marketing servers themselves?

Re: Mozilla’s DNS over HTTPs

#367

Post by Spivak » Tue, Feb 25, 2020, 5:59 PM UTC

zeveb wrote: post #137

Spivak wrote: post #128

Earlier quoted context omitted.

You are a client on AT&T and Spectrum's network. Just because you turn on a router and set up NAT doesn't make this fact any less true. At some point your internet traffic is going to flow AT&T's network where they are the administrators and are free to apply whatever network policy they see fit. DoH and DoT is a solution to the problem of sending your DNS requests unencrypted, leaking them to everyone in the process…

I agree with you: your local network is free to set up a resolver using DoH (or DoT, which is far more sane than an entire HTTPS connexion). That's the correct place for it to live, or possibly at the individual device level. It is 100% not the place of an application to meddle with network services, particularly not by default.

How dare an application use a socket to make a network request using an application layer protocol for its own use.

Re: Mozilla’s DNS over HTTPs

#368

Post by ryukafalz » Tue, Feb 25, 2020, 5:59 PM UTC

bakul wrote: post #252

ryukafalz wrote: post #196

Earlier quoted context omitted.

This is precisely why many of us use Linux and put up with some of the inconveniences or doing so - it’s more trustworthy. (And it gets more convenient as more people start using it.)

the irony is that almost all of the smart devices use linux....

They sure do, but it’s a Linux instance that the manufacturer has control over rather than the user. (Which is the real problem, more than just what tech is being used.)

Re: Mozilla’s DNS over HTTPs

#369

Post by ryanisnan » Tue, Feb 25, 2020, 5:59 PM UTC

dmix wrote: post #294

fanf2 wrote: post #155

Earlier quoted context omitted.

Go to about:networking and look at the DNS tab

I'm in Canada and TRR is indeed marked false for every domain.

Strange. I'm also in Canada, but TRR is marked true for every domain.

Re: Mozilla’s DNS over HTTPs

#370

Post by qmarchi » Tue, Feb 25, 2020, 5:59 PM UTC

Seenso wrote: post #345

nullc wrote: post #289

I'm so sad to see Mozilla move forward with this massive attack on user privacy. Firefox DoH is snake oil, plain and simple. It sends all the users DNS queries to Cloudflare, adding a new party which can surveil the user's traffic (and can be legally compelled to do so and not disclose this fact)-- providing a convenient choke point to save spies and hackers the trouble and exposure of extracting the data from tens o…

> Firefox DoH is snake oil, plain and simple... Correct me if I'm wrong, but the concern I have about browser-controlled DoH is that it seems like it could make it harder for a tech-savvy user to assert control over their own network. IIRC, most network-level ad-blocking operates at the DNS level. I've also personally blocked telemetry by setting my router's DNS proxy to resolve certain telemetry servers to 0.0.0.0.…

For existing configurations, it makes it a bit trickier to implement. If you ad the aforementioned rules to your DNS and/or IP block list, then Firefox will default back to using the system configured DNS.

But DoH is not targeting ad-blocking specifically, but rather intermediaries that are outside of the local network. There is evidence of ISPs injecting traffic (Comcast/Xfinity) or selling user traffic (AT&T) and this was designed to close one of the last gaps for a fully encrypted flow.

It's possible to setup a DoH server for your local network's DNS resolver, so that all of your traffic leaves your network encrypted, even if not encrypted on your local network.