Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Mozilla’s DNS over HTTPs

blog.mozilla.org

Post reply on HN
Print view View original

411–420 of 777 posts

Re: Mozilla’s DNS over HTTPs

#411

Post by simias »

nullc wrote: post #289

I'm so sad to see Mozilla move forward with this massive attack on user privacy. Firefox DoH is snake oil, plain and simple. It sends all the users DNS queries to Cloudflare, adding a new party which can surveil the user's traffic (and can be legally compelled to do so and not disclose this fact)-- providing a convenient choke point to save spies and hackers the trouble and exposure of extracting the data from tens o…

It's also yet an other instance of the web browser taking over something that (IMO) ought to belong to the OS. Now with DoH if I have DNS issues I have to figure out if it's related to the browser's DNS or the system DNS. I can't use command line tools like dig or ping to troubleshoot the issue because it's not what the browser is doing. If DoH is so great I want to enable it for all my applications, not just my web browser.

People, let's just rip off the bandaid and make Chrome and Firefox bootable already, who needs the kernel overhead when the browser is going to reimplement the entire stack itself anyway. Also let's just make TCP only work on ports 80 and 443 because clearly the rest doesn't really serve any purpose anymore.

Re: Mozilla’s DNS over HTTPs

#412

Post by alerighi »

qmarchi wrote: post #391
ThePhysicist wrote: post #372

I predict that DoH will break many enterprise infrastructures that rely on custom DNS servers. Unwary sysadmins that update Firefox will be in a lot of trouble when they switch this on by default. We ourselves have a custom DNS setup with an only internally resolvable TLD as a security measure, so this change will break our infra for all Firefox users (thankfully we’re in the EU so we’re spared, for now). Good thing…

Firefox by default is configured with a fallback option, where if resolution would fail, it will fallback to the system-provided DNS servers. So your internal TLDs are safe. Additionally, if you've setup Firefox to be installed with Firefox for Enterprise, DoH is disabled by default and you've got nothing to worry about. DOH is able to be configured through GPO as well, allowing the use of a custom server.

And that is even more dangerous, it would mean that if for some reason an identical domain extists on the internet (or somebody registers it to do an attack) then all the hosts will connect to the malicious external domain and not the correct host in the internal network. Local hosts should be resolved FIRST.

Also cloudfare this way gets the DNS names of your internal hosts, you are leaking information that otherwise would be private, and system administrator will probably not think about that!

Also with that option is not really secure at all, if somebody wants to intercept your DNS requests he can simply block the IPs of Cloudfare DNS over HTTPS server and then read the DNS requests unencrypted.

Re: Mozilla’s DNS over HTTPs

#413

Post by qmarchi »

godshatter wrote: post #260
leeoniya wrote: post #236

how long does Cloudflare or NextDNS retain dns query logs?

Also, why limit the choices to just those two? If you're going to provide an app-based service for this, why not allow the user to use any DoH server they want to use? Did Mozilla make some kind of deal with Cloudflare and NextDNS?

They have contracts with Cloudflare and NextDNS to limit what information can be collected, retention policies, and explicitly saying that it can't be sold.

Re: Mozilla’s DNS over HTTPs

#414

Post by bzbarsky »

hedora wrote: post #295
jimmaswell wrote: post #247

Seems very marginal for privacy when people in the middle can still see the IP you're connecting to, just not which DNS record you may have retrieved the IP with.

Run wireshark on an ssl connection. The server certificate is sent in plaintext. It includes the DNS name of the server you connected to. DoH would make sense in a world where that was fixed. (Though DNS over TLS is also a thing, and makes strictly more sense than DoH from what I can tell...)

This is why people are also working on shipping ESNI, which will stop sending the DNS name in plaintext in the cert.

Re: Mozilla’s DNS over HTTPs

#415

Post by cesarb »

hedora wrote: post #295
jimmaswell wrote: post #247

Seems very marginal for privacy when people in the middle can still see the IP you're connecting to, just not which DNS record you may have retrieved the IP with.

Run wireshark on an ssl connection. The server certificate is sent in plaintext. It includes the DNS name of the server you connected to. DoH would make sense in a world where that was fixed. (Though DNS over TLS is also a thing, and makes strictly more sense than DoH from what I can tell...)

> The server certificate is sent in plaintext.

Not with TLS 1.3, which moves the server certificate to the encrypted part of the handshake.

Re: Mozilla’s DNS over HTTPs

#416

Post by datenwolf »

raesene9 wrote: post #406

My feeling on this is that it's a pretty imperfect solution but unsurprising that the browser manufacturers are pushing it forward given ISPs dragging their heels on DoT. We saw the same problem with TLS. Until the browser makers started pushing it and Let's encrypt made it simple/free the take up of TLS was patchy at best. This will have negative effects on tools that use DNS for blocking/monitoring, but then those…

> ISPs dragging their heels on DoT

WTH does DoT adoption by ISPs have to do with that?!

One can run their own DNS recursive resolver-cache perfectly fine on their own hosts, or at the network edge, without relying on ISPs.

Better yet: Since the Root zone and TLD zone DNS servers change only seldomly, you can prefetch and cache them locally just fine, and upon resolving a DNS skip two recursion steps.

Apart from doing DPS, then ISPs will not "see" DNS queries, thus bypassing the privacy concerns of that.

Re: Mozilla’s DNS over HTTPs

#417

Post by nullc »

pretty_bubbles wrote: post #361
Seenso wrote: post #345

Earlier quoted context omitted.

> Firefox DoH is snake oil, plain and simple... Correct me if I'm wrong, but the concern I have about browser-controlled DoH is that it seems like it could make it harder for a tech-savvy user to assert control over their own network. IIRC, most network-level ad-blocking operates at the DNS level. I've also personally blocked telemetry by setting my router's DNS proxy to resolve certain telemetry servers to 0.0.0.0.…

If you use the nextdns DoH provider in Firefox you can actually configure your own adblocking domains even when you're moving around across networks. Just FYI

> If you use the nextdns DoH provider in Firefox you can actually configure your own adblocking domains even when you're moving around across networks.

Uh. Doesn't this prove that Firefox's DOH implementation is sending strong per-user identifying information to the server?

Re: Mozilla’s DNS over HTTPs

#418

Post by Jonnax »

asymptotically2 wrote: post #389
Avamander wrote: post #276

Earlier quoted context omitted.

> How does Firefox deal with corporate installations and internal DNS? Everything is configurable and there are canaries to override that.

> Everything is configurable But how many people are going to change it from the default?

A corporate environment or internal DNS is already changing the defaults.

Re: Mozilla’s DNS over HTTPs

#420

Post by ThePhysicist »

debaserab2 wrote: post #393
ThePhysicist wrote: post #362

Earlier quoted context omitted.

I trust my own DNS provider much more than I trust Cloudflare to be honest. Also, most DNS requests over that “insecure protocol” happened over a single network hop or two and never left the infrastructure of the ISP. Cloudflare is now a public company and they need to aggressively monetize their services. Selling browsing data is a lucrative business and becoming “the” DNS provider for most users (while locking out…

Is there an indication they are moving in that direction already? (Genuine non-sarcastic question) They've built up a considerable amount of good-will in developer communities. Is there some historical indicator with cloudfare that suggests they are going to blow it all on their path to monetization, or are we extrapolating from other VC backed companies (which may be an understandable position to take, but why?)

Yes I think they will. Their positioning in the VPN, DNS, CDN and (soon) enterprise networking space will give them enormous visibility into a large fraction of what is happening on the Internet, and I simply cannot believe that a profit-oriented company will turn away from such a market opportunity.

Cloudflare isn’t really known as a privacy champion, they always put more emphasis on security, speed and reliability.

From a privacy perspective it’s pretty horrible what they do as well, because they decrypt and inspect all traffic between their customers and those customers users. Security-wise it might be great, but don’t confuse security with privacy.

I really hope that I’m wrong but I’m skeptical that Cloudflare will turn down such a big opportunity, and this move with DoH really seems to confirm this.

Post reply on HN