Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Mozilla’s DNS over HTTPs

blog.mozilla.org

Post reply on HN
Print view View original

391–400 of 777 posts

Re: Mozilla’s DNS over HTTPs

#391

Post by qmarchi »

ThePhysicist wrote: post #372

I predict that DoH will break many enterprise infrastructures that rely on custom DNS servers. Unwary sysadmins that update Firefox will be in a lot of trouble when they switch this on by default. We ourselves have a custom DNS setup with an only internally resolvable TLD as a security measure, so this change will break our infra for all Firefox users (thankfully we’re in the EU so we’re spared, for now). Good thing…

Firefox by default is configured with a fallback option, where if resolution would fail, it will fallback to the system-provided DNS servers. So your internal TLDs are safe.

Additionally, if you've setup Firefox to be installed with Firefox for Enterprise, DoH is disabled by default and you've got nothing to worry about. DOH is able to be configured through GPO as well, allowing the use of a custom server.

Re: Mozilla’s DNS over HTTPs

#392

Post by snek »

gsich wrote: post #386
snek wrote: post #376

If you're about to comment on how dumb this is because SNI isn't encrypted please halt and search "ESNI"

Draft only. OpenSSL doesn't support it - because it's still a draft. So as of now, ESNI does not provide anything.

It is moving forward, albeit slowly. With or without DoH/DoT, non encrypted SNI is a problem, and DoH/DoT have privacy improvements in their own right.

Re: Mozilla’s DNS over HTTPs

#393

Post by debaserab2 »

ThePhysicist wrote: post #362
andyjohnson0 wrote: post #331

Earlier quoted context omitted.

> Formerly, I "opted out" of having a browser that phoned home my browsing traffic by using Firefox. Formerly your browser still "phoned home" to your default DNS provider, using an insecure protocol. I appreciate your concerns but, unless you run your own DNS server, you have to trust someone at some point.

I trust my own DNS provider much more than I trust Cloudflare to be honest. Also, most DNS requests over that “insecure protocol” happened over a single network hop or two and never left the infrastructure of the ISP. Cloudflare is now a public company and they need to aggressively monetize their services. Selling browsing data is a lucrative business and becoming “the” DNS provider for most users (while locking out…

Is there an indication they are moving in that direction already? (Genuine non-sarcastic question)

They've built up a considerable amount of good-will in developer communities. Is there some historical indicator with cloudfare that suggests they are going to blow it all on their path to monetization, or are we extrapolating from other VC backed companies (which may be an understandable position to take, but why?)

Re: Mozilla’s DNS over HTTPs

#394

Post by alerighi »

mysterypie wrote: post #250
StreamBright wrote: post #215

Can you disable this?

What are some reasons why someone would prefer to or need to disable it. Just curious.

Why do you want to not disable it I would say. Having DNS over HTTPS not only completely breaks local name resolution (e.g. http://fileserver) and you must manually specify IP addresses in the browser to connect to local hosts, but also if you already have (like I have on my LAN) a local DNS server that does DNS over TLS is useless and also you don't benefit from for example query filtration (I filter out ad servers and trackers from DNS requests)

Re: Mozilla’s DNS over HTTPs

#395

Post by raesene9 »

jp_sc wrote: post #382
noja wrote: post #352

Earlier quoted context omitted.

It's a balance. Do you want your plaintext DNS request sent to starbucks or your local unsecured public wifi, or do you want it sent encrypted to your DoH server of choice?

I can use a VPN when browsing on those kind of networks.

That's fine for more technical users who are aware of how to mitigate this kind of issue, but then those same more technical users will also likely know how to disable DoH.

For the majority of users who may not understand the risks around plain text DNS, there are advantages to it being encrypted.

Re: Mozilla’s DNS over HTTPs

#396

Post by nybble41 »

throw0101a wrote: post #126
tialaramex wrote: post #97

Earlier quoted context omitted.

> DoH just enables any piece of software or hardware on my network to bypass any security controls I have in place. I think this is an error in how you've thought about the problem. If your "security controls" depend upon other people volunteering to use some protocol then those weren't "security controls" they were more like "guidelines". [ My local airport has a sign and a telephone so that if you've arrived with g…

> If your "security controls" depend upon other people volunteering to use some protocol then those weren't "security controls" they were more like "guidelines". It's not about volunteering. Previously I could block udp/53 and tcp/53 and be confident of the fact that no DNS look ups would happen. (DNS queries over other ports could be caught doing packet sniffing.) Now I have to worry about DNS queries going out via…

> Previously I could block udp/53 and tcp/53 and be confident of the fact that no DNS look ups would happen. ... Now I have to worry about DNS queries going out via HTTPS.

That confidence would have been misplaced. DoH offers a standardized protocol, but it's not exactly difficult to put together a one-off interface for performing occasional remote DNS lookups over HTTPS. One could even use existing HTTPS sites for the purpose (e.g. https://ping.eu/nslookup/).

Re: Mozilla’s DNS over HTTPs

#397

Post by qmarchi »

Mister_Snuggles wrote: post #348

I have some unusual, from the normal browser user perspective, DNS stuff and this just leads to a bunch of questions. My gateway has a bunch of static DNS entries for internal hosts, which are all in a fake top-level domain. How will resolving these work if the request goes to CloudFlare? CloudFlare obviously doesn't know about my internal domain. Currently my gateway resolves what it knows about and uses my ISP's DN…

Your setup will still work. Firefox is configured with a "fallback" situation, where anything that doesn't resolve on the public resolver will be queried again using your system-configured DNS options.

As for Pi-hole, my recommendation is to block NATed traffic to Cloudflare's DoH traffic (forcing it into Fallback mode) and then setting up Pi-Hole to use for it's recursive resolution.

Alternatively, you can setup your own DoH server based off BIND: https://terminaladdict.com/networking/linux/2019/09/13/DoH.h...

Re: Mozilla’s DNS over HTTPs

#398

Post by Jonahgay »

nullc wrote: post #289

I'm so sad to see Mozilla move forward with this massive attack on user privacy. Firefox DoH is snake oil, plain and simple. It sends all the users DNS queries to Cloudflare, adding a new party which can surveil the user's traffic (and can be legally compelled to do so and not disclose this fact)-- providing a convenient choke point to save spies and hackers the trouble and exposure of extracting the data from tens o…

You know you can put your own doh server into the browser.

Re: Mozilla’s DNS over HTTPs

#399

Post by geophertz »

nullc wrote: post #289

I'm so sad to see Mozilla move forward with this massive attack on user privacy. Firefox DoH is snake oil, plain and simple. It sends all the users DNS queries to Cloudflare, adding a new party which can surveil the user's traffic (and can be legally compelled to do so and not disclose this fact)-- providing a convenient choke point to save spies and hackers the trouble and exposure of extracting the data from tens o…

Unfortunately it's not so easy to black hole `use-application-dns.net` for parental control. (people don't run their own DNS server).

Re: Mozilla’s DNS over HTTPs

#400

Post by andyjohnson0 »

dijit wrote: post #347
andyjohnson0 wrote: post #331

Earlier quoted context omitted.

> Formerly, I "opted out" of having a browser that phoned home my browsing traffic by using Firefox. Formerly your browser still "phoned home" to your default DNS provider, using an insecure protocol. I appreciate your concerns but, unless you run your own DNS server, you have to trust someone at some point.

>Formerly your browser still "phoned home" to your default DNS provider, using an insecure protocol. This is kinda painful to read, to the point where I'm not sure if it's intentionally misleading; DHCP will give you a DNS config, that DNS server can be local, remote, it can support DNSSEC or DNS over TLS (yes, that's a thing[0]). I even have configurations where a local DNS resolver on my machine (DNSMasq/unbound) w…

Ok. Would you accept "_potentially_ insecure protocol" then? DNSSEC for example provides no encryption.

fwiw I agree with you about a central body getting all out DNS requests.

Post reply on HN