I wonder what the implications of DoH will be for TCP-over-DNS ...
Mozilla’s DNS over HTTPs
441–450 of 777 posts
Re: Mozilla’s DNS over HTTPs
#442Earlier quoted context omitted.
If you use the nextdns DoH provider in Firefox you can actually configure your own adblocking domains even when you're moving around across networks. Just FYI
> If you use the nextdns DoH provider in Firefox you can actually configure your own adblocking domains even when you're moving around across networks. Uh. Doesn't this prove that Firefox's DOH implementation is sending strong per-user identifying information to the server?
If you configure a personal NextDNS URL as the DoH provider then unsurprisingly NextDNS will know that URL was used, and personalise things accordingly.
If you use Firefox's defaults but pick NextDNS from the list, you don't get personalisation as NextDNS has no idea who you are.
A nice thing about DoH here: For DNS over TLS NextDNS has to hide the configuration ID in the hostname, which as a result is revealed in SNI, but for DoH they can put it in the path and so it is encrypted like everything else.
Re: Mozilla’s DNS over HTTPs
#443As a resident of a country whose government and ISPs heavily and habitually censor the Internet for political reasons, I for one truly appreciate Firefox's DoH. They should also enable 'network.security.esni.enabled' by default because the censors here have upgraded from DNS to SNI-based blocking. I get it that better solutions are possible, but got to teach people to first walk before teaching them to run. AFAIK, Ch…
I wonder what the implications will be for TCP-over-DNS, which besides bypassing firewalls, can also provide anonymity in a different way.
Re: Mozilla’s DNS over HTTPs
#444Earlier quoted context omitted.
Is there an indication they are moving in that direction already? (Genuine non-sarcastic question) They've built up a considerable amount of good-will in developer communities. Is there some historical indicator with cloudfare that suggests they are going to blow it all on their path to monetization, or are we extrapolating from other VC backed companies (which may be an understandable position to take, but why?)
Yes I think they will. Their positioning in the VPN, DNS, CDN and (soon) enterprise networking space will give them enormous visibility into a large fraction of what is happening on the Internet, and I simply cannot believe that a profit-oriented company will turn away from such a market opportunity. Cloudflare isn’t really known as a privacy champion, they always put more emphasis on security, speed and reliability.…
Mozilla has previously noted that Cloudfare is contractually obligated to keep the traffic private and not monetize or share it. That's not perfect, but without a law requiring it that's about the best you can get in the U.S. (assuming the contract has teeth in the penalties it imposes).
Re: Mozilla’s DNS over HTTPs
#445Earlier quoted context omitted.
>Formerly your browser still "phoned home" to your default DNS provider, using an insecure protocol. This is kinda painful to read, to the point where I'm not sure if it's intentionally misleading; DHCP will give you a DNS config, that DNS server can be local, remote, it can support DNSSEC or DNS over TLS (yes, that's a thing[0]). I even have configurations where a local DNS resolver on my machine (DNSMasq/unbound) w…
Ok. Would you accept "_potentially_ insecure protocol" then? DNSSEC for example provides no encryption. fwiw I agree with you about a central body getting all out DNS requests.
The problem is this language spreads FUD around DNS and then offers a “solution” with additional problems.
Re: Mozilla’s DNS over HTTPs
#446My feeling on this is that it's a pretty imperfect solution but unsurprising that the browser manufacturers are pushing it forward given ISPs dragging their heels on DoT. We saw the same problem with TLS. Until the browser makers started pushing it and Let's encrypt made it simple/free the take up of TLS was patchy at best. This will have negative effects on tools that use DNS for blocking/monitoring, but then those…
> ISPs dragging their heels on DoT WTH does DoT adoption by ISPs have to do with that?! One can run their own DNS recursive resolver-cache perfectly fine on their own hosts, or at the network edge, without relying on ISPs. Better yet: Since the Root zone and TLD zone DNS servers change only seldomly, you can prefetch and cache them locally just fine, and upon resolving a DNS skip two recursion steps. Apart from doing…
Most end users don't just "run their own recursive resolver-cache" They take whatever DNS server is provided by their ISP
I'd guess that 99+% of Internet users have no idea how to run their own DNS server, let alone set up DoT.
Re: Mozilla’s DNS over HTTPs
#447Earlier quoted context omitted.
The problem is that the device (or website) also treats the owner and legitimate user as untrusted and obfuscates the content of the traffic in a way that makes everything completely opaque for them. The device/site only trusts its manufacturer which makes any device that completely obscures its traffic from its owner feel more like a Trojan horse. This is how you end up with questionable telemetry and data leaks for…
In what way does this argument not also suggest that the device should use plaintext HTTP so that you can intercept all its other traffic?
What I want is a key to my own house, not an open door. Right now using a lot of software and IoT devices feels like buying a house but the builders keep the only key.
Re: Mozilla’s DNS over HTTPs
#448Earlier quoted context omitted.
"You can just opt out" is the same tired line that in former times Mozilla has fought against. It's extremely hard to keep track of and manage "opt outs", especially in a household with multiple computers and multiple people. Formerly, I "opted out" of having a browser that phoned home my browsing traffic by using Firefox.
> Formerly, I "opted out" of having a browser that phoned home my browsing traffic by using Firefox. Formerly your browser still "phoned home" to your default DNS provider, using an insecure protocol. I appreciate your concerns but, unless you run your own DNS server, you have to trust someone at some point.
Even if you run your own DNS server, it's still making queries to other DNS servers. With regular DNS, this is not encrypted, of course. Almost nobody uses DNSSEC. So there's a lot of "trust" going on.
Re: Mozilla’s DNS over HTTPs
#449I'm so sad to see Mozilla move forward with this massive attack on user privacy. Firefox DoH is snake oil, plain and simple. It sends all the users DNS queries to Cloudflare, adding a new party which can surveil the user's traffic (and can be legally compelled to do so and not disclose this fact)-- providing a convenient choke point to save spies and hackers the trouble and exposure of extracting the data from tens o…
Your ISP is literally selling this information right now in the US. What are you even talking about? Use google if you don't like CF, or just disable it!
Do a little threat modeling here please. Let's say CF sells this data, what do they know about you other than your IP and the sites you visit? While your ISP,employer,school,etc... Can tie that activity to you as a person. Being compelled legally? I did not know privacy meant breaking laws, suddenly law enforcement can't do the same thing with your ISP dns?
This is not adding a new party that can surveil you, this is reducing risk by separating who can see your DNS from who can see your traffic. The idea is to have eSNI ubiquity to where TLS traffic will conceal the sites you visit while DoH will conceal the traffic metadata. Oh, and beauty of DoH: you can run it through a web proxy, and if you have alot of users behind a NAT it becomes very hard to pin point which actual machine generated the DNS lookup.
Re: Mozilla’s DNS over HTTPs
#450I'm so sad to see Mozilla move forward with this massive attack on user privacy. Firefox DoH is snake oil, plain and simple. It sends all the users DNS queries to Cloudflare, adding a new party which can surveil the user's traffic (and can be legally compelled to do so and not disclose this fact)-- providing a convenient choke point to save spies and hackers the trouble and exposure of extracting the data from tens o…
> We continue to explore enabling DoH in other regions, and are working to add more providers as trusted resolvers to our program. DoH is just one of the many privacy protections you can expect to see from us in 2020. Cloudflare is just one of the initial providers and they indicate that they are adding more. Also, I'm assuming you can add your own custom provider based on the screenshot in the article. You can just…
> Cloudflare is just one of the initial providers and they indicate that they are adding more. Also, I'm assuming you can add your own custom provider based on the screenshot in the article. You can just disable the feature as well.
Or go for https://firejaildns.wordpress.com/ - Linux workstation DoH proxy, more than 60 DoH providers. When you start, the proxy chooses one at random. You can also set the servers in Firefox.