Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Mozilla’s DNS over HTTPs

blog.mozilla.org

Post reply on HN
Print view View original

501–510 of 777 posts

Re: Mozilla’s DNS over HTTPs

#501

Post by nullc »

bawolff wrote: post #462
dijit wrote: post #347

Earlier quoted context omitted.

>Formerly your browser still "phoned home" to your default DNS provider, using an insecure protocol. This is kinda painful to read, to the point where I'm not sure if it's intentionally misleading; DHCP will give you a DNS config, that DNS server can be local, remote, it can support DNSSEC or DNS over TLS (yes, that's a thing[0]). I even have configurations where a local DNS resolver on my machine (DNSMasq/unbound) w…

I think this is an unfair response. > DHCP will give you a DNS config So in other words "your default dns provider" > that DNS server can be local, remote Maybe a nitpick but i doubt dhcp is going to hive you a local dns server > it can support DNSSEC Which is irrelevent to the original complaint about "phoning home". DNSSec provides security against certain types of attacks like poisioning. Privacy & evesdropping ar…

> Maybe a nitpick but i doubt dhcp is going to hive you a local dns server

0_o Weird doubt,-- thats why DHCP can give you a DNS server. Otherwise, DNS discovery might as well work by just defining some /32s that always get routed to a nearby DNS server. :)

My DHCP servers at home give me a local DNS server... any corporate network that also has internal private naming will necessarily be handing out a resolver internal to that network.

Re: Mozilla’s DNS over HTTPs

#502

Post by mattlutze »

In order for Cloudflare (or anyone) to be a part of this program they have to comply with a particular set of rules.

Limiting data. Your DNS data can reveal a lot of sensitive information about you, and currently DNS providers aren’t subject to any limits on what they can do with that data; we want to change that. Our policy requires that your data will only be used for the purpose of operating the service, must not be retained for longer than 24 hours, and cannot be sold, shared, or licensed to other parties.

Yes, governments can secret around this with intelligence orders, just like they can do with any of the ISPs that will keep all of the data indefinitely instead of for 24 hours.

Re: Mozilla’s DNS over HTTPs

#503

Post by corford »

mattlutze wrote: post #502

In order for Cloudflare (or anyone) to be a part of this program they have to comply with a particular set of rules. Limiting data. Your DNS data can reveal a lot of sensitive information about you, and currently DNS providers aren’t subject to any limits on what they can do with that data; we want to change that. Our policy requires that your data will only be used for the purpose of operating the service, must not…

Kind of sad when you need a private company to give your citizens the basic privacy they want (doubly so when you have to simply trust said company that the partners they are working with are honest). Maybe the US's privacy laws need a 21st Century make over?

Re: Mozilla’s DNS over HTTPs

#504

Post by the8472 »

mattlutze wrote: post #502

In order for Cloudflare (or anyone) to be a part of this program they have to comply with a particular set of rules. Limiting data. Your DNS data can reveal a lot of sensitive information about you, and currently DNS providers aren’t subject to any limits on what they can do with that data; we want to change that. Our policy requires that your data will only be used for the purpose of operating the service, must not…

> just like they can do with any of the ISPs

There is a 3rd option: Operating your own recursive resolver.

Re: Mozilla’s DNS over HTTPs

#505

Post by windexh8er »

floatingatoll wrote: post #479
_8j50 wrote: post #449

Earlier quoted context omitted.

Your ISP is literally selling this information right now in the US. What are you even talking about? Use google if you don't like CF, or just disable it! Do a little threat modeling here please. Let's say CF sells this data, what do they know about you other than your IP and the sites you visit? While your ISP,employer,school,etc... Can tie that activity to you as a person. Being compelled legally? I did not know pri…

Note that US ISP "Comcast/Xfinity" does not, so at the very least, that's one safe harbor amidst the rest. https://corporate.comcast.com/stories/privacy-with-comcasts-...

Cloudflare states the same thing. In fact, Cloudflare provides much more detail than Comcast/Xfinity [0]. And, personally, I actually believe Cloudflare.

If I have to choose between the two companies it's a no brainer. This is Cloudflare's business, and their business relies on them upholding their privacy promise. Comcast/Xfinity has, in the past, engaged in DNS hijacking [1]. Comcast has had the worst ACSI score over all other businesses in the US more than once and consistently ranks very low [2]. Comcast won the worst company in America in 2014 by the Consumerist [3]. Comcast has intentionally deceived it's customers as we understand due to lawsuits [4].

I'm not sure what sort of jaded world we live in if one can say Comcast/Xfinity is a "safe harbor amidst the rest" with mountains of public information stating the complete opposite.

[0] https://developers.cloudflare.com/1.1.1.1/commitment-to-priv... [1] https://arstechnica.com/tech-policy/2009/08/comcasts-dns-red... [2] https://www.theacsi.org/news-and-resources/press-releases/pr... [3] https://consumerist.com/2014/04/08/congratulations-to-comcas... [4] https://www.atg.wa.gov/news/news-releases/ag-announces-lawsu...

Re: Mozilla’s DNS over HTTPs

#506

Post by WorldMaker »

ThePhysicist wrote: post #466
the8472 wrote: post #460

Earlier quoted context omitted.

> They e.g. also do nothing against data exfiltration by popular extensions although they have known that issue for years. This kind of sentiment compels mozilla into becoming an apple-like gatekeeper to a walled garden because people conflate the trustworthiness of extension authors with mozilla's trustworthiness, which leads to less software freedom, a single point of failure and a less diverse ecosystem.

There simply should not be an API that allows exfiltrating the URL history of a user and then send it to a remote backend, at least not without making this very, very explicit to the user (which they currently do not). You don't need to be a "gatekeeper to a walled garden", it's just necessary to have sensible APIs that respect users privacy. I think a browser that puts privacy as its primary feature should be able t…

It asks the user if they want to allow an extension to "Access Browsing History" [1]. That seems pretty explicit and self-explanatory to me.

[1] https://support.mozilla.org/en-US/kb/permission-request-mess...

Re: Mozilla’s DNS over HTTPs

#507

Post by kadoban »

the8472 wrote: post #504
mattlutze wrote: post #502

In order for Cloudflare (or anyone) to be a part of this program they have to comply with a particular set of rules. Limiting data. Your DNS data can reveal a lot of sensitive information about you, and currently DNS providers aren’t subject to any limits on what they can do with that data; we want to change that. Our policy requires that your data will only be used for the purpose of operating the service, must not…

> just like they can do with any of the ISPs There is a 3rd option: Operating your own recursive resolver.

Doesn't that just move the problem one step away?

Re: Mozilla’s DNS over HTTPs

#508

Post by zamalek »

syshum wrote: post #468
djsumdog wrote: post #407

Earlier quoted context omitted.

American ISPs can and do sell your data legally. I don't really trust my ISP (I run my own DNS server at home and tunnel its requests over to a cloud VM), but I trust Cloudflare even less.

I dont use my ISP as my DNS provider, I have a custom setup using PiHole and other methods to provide secure DNS Resolution Firefox should not be forcing this shit on me, time to search for yet another browser that will respect users. Mozilla is clearly more interested in commercial viability via their partnerships with large corporations (like CloudFlare) then in protecting Users

The only way to solve the ISP DNS inspection problem is by one of:

* Using DoH. For this to work with PiHole, you need to have a DoH resolver on the device, and then instruct the PiHole to recurse to that resolver instead - possibly your own in a VM somewhere?

* Using a permanent encrypted VPN to your own machine in the cloud and routing all DNS through that, then recursing to some DNS that you trust.

* Write your own encrypted protocol that communicates with some machine in the cloud.

Anything else and your ISP/evil-state-actor is able to to see your DNS traffic in plain-text. PiHole and DoH approach the problem at different OSI layers, you ideally need both.

Re: Mozilla’s DNS over HTTPs

#509

Post by EvanAnderson »

jfk13 wrote: post #451
EvanAnderson wrote: post #383

Earlier quoted context omitted.

Everyone who uses DNS-based content filtering (OpenDNS, a "Pi Hole", etc) to do filtering on a home network is a "network administrator".

Care to guess what percentage of Mozilla's users are included in that group? The HN crowd is far from being a typical sample.

My point is that the definition of "network administrator" is wider than the corporate network administrator vision the phrase evokes.

A quick search shows me a number of parental control features in routers that use OpenDNS. All of the parents using those features would be "network administrators", too.

I think more people are "network administrators" than the average HN reader realizes.

Re: Mozilla’s DNS over HTTPs

#510

Post by ethagnawl »

the8472 wrote: post #492
ethagnawl wrote: post #476

Earlier quoted context omitted.

"Good" VPNs also aren't usually/ever? free.

You can operate one on your home router, which can be negative-cost if you're also saving the rent on the ISP hardware.

Well, sure.

However, my comment was within the context of the parent's, which was talking about how this feature is beneficial to non-technical users; some of which may not be able to afford to pay for a VPN that (probably doesn't ...) MITM or log traffic.

Post reply on HN