Mozilla’s DNS over HTTPs

Post by jotm » Tue, Feb 25, 2020, 5:59 PM UTC

mtberatwork wrote: post #300

nullc wrote: post #289

I'm so sad to see Mozilla move forward with this massive attack on user privacy. Firefox DoH is snake oil, plain and simple. It sends all the users DNS queries to Cloudflare, adding a new party which can surveil the user's traffic (and can be legally compelled to do so and not disclose this fact)-- providing a convenient choke point to save spies and hackers the trouble and exposure of extracting the data from tens o…

> We continue to explore enabling DoH in other regions, and are working to add more providers as trusted resolvers to our program. DoH is just one of the many privacy protections you can expect to see from us in 2020. Cloudflare is just one of the initial providers and they indicate that they are adding more. Also, I'm assuming you can add your own custom provider based on the screenshot in the article. You can just…

Post by toomuchtodo » Tue, Feb 25, 2020, 6:00 PM UTC

nullc wrote: post #365

toomuchtodo wrote: post #336

Earlier quoted context omitted.

> you have to trust someone at some point. Give me a non-profit infra provider than I can donate to, similar to Let's Encrypt. Let's call it "Let's Resolve", give it a non-profit charter and org style, with transparency, governance, and strong privacy protections. Mozilla could even be one of the sponsors of such an org, thereby ensuring the values it supports are adhered to. Open Street Map runs on a budget of ~$100…

I'm dubious. If someone asked me to run such a thing and offered to pay for it, I'd turn them down: It's too easy to be compromised (via hackers, including the state funded kind) or ordered (e.g. via an administrative subpoena, NSL, or plain court order) and fail to deliver on the expected privacy. This false sense of security might even get people killed, when they think their activities are private when they really…

Post by simcop2387 » Tue, Feb 25, 2020, 6:02 PM UTC

RL_Quine wrote: post #296

organsnyder wrote: post #281

Earlier quoted context omitted.

Good point. Sniffing traffic is orders of magnitude more expensive than simply logging DNS queries.

tcpdump -i any -s 1500 '(tcp[((tcp[12:1] & 0xf0) >> 2)+5:1] = 0x01) and (tcp[((tcp[12:1] & 0xf0) >> 2):1] = 0x16)' -nnXSs0 -ttt Is it though? This one liner works just fine for me on my gateway and is capturing quite a huge number of raw SNI names. 0x0110: c008 0016 0013 0010 000d c00d c003 000a ................ 0x0120: 00ff 0100 0113 0000 001d 001b 0000 186c ...............l 0x0130: 6f67 7369 6e6b 2e64 6576 6963 657…

Post by qmarchi » Tue, Feb 25, 2020, 6:03 PM UTC

dmd wrote: post #360

How does this work with hosts that are not resolvable outside your own network? If I tell firefox to go to internalsite.mycompany.com - which resolves internally, but not outside our network - how is firefox going to resolve it, if it's not using our DNS servers?

Post by JohnFen » Tue, Feb 25, 2020, 6:04 PM UTC

JoshTriplett wrote: post #374

JohnFen wrote: post #354

Earlier quoted context omitted.

Marketers using hardcoded private servers are the easiest thing to defend against: just block those servers. That fact is one of the big reasons why marketers and other spies don't do that -- they use DNS lookups to find the mother ship. However, now marketers can use DoH, combined with public servers that would cause disruption to block, to be able to engage in lookups without a means of detecting or blocking them s…

Safer protocols don't care who or what they protect. Even if browsers didn't use DoH, other devices could. And any protocol Mozilla can use to protect their users will also work for other devices. I don't think it makes sense to bemoan the newfound existence of safer infrastructure for everyone just because devices you don't like can also use that infrastructure.