Mozilla’s DNS over HTTPs • Hacker News Board

Re: Mozilla’s DNS over HTTPs

#511

Post by nullc » Tue, Feb 25, 2020, 8:02 PM UTC

demarq wrote: post #478

nullc wrote: post #289

I'm so sad to see Mozilla move forward with this massive attack on user privacy. Firefox DoH is snake oil, plain and simple. It sends all the users DNS queries to Cloudflare, adding a new party which can surveil the user's traffic (and can be legally compelled to do so and not disclose this fact)-- providing a convenient choke point to save spies and hackers the trouble and exposure of extracting the data from tens o…

> It sends all the users DNS queries to Cloudflare, adding a new party it removes many parties (some unknown) who have no legal oversight, and adds a select parties who are legally bound to respect your privacy. > because the user's destination IPs remain unencrypted This makes no sense. your ISP cannot see that you are visiting facebook because the IP shows up us cloudflare urrrghhh! > At the moment you can disable…

> who are legally bound to respect your privacy.

Come on, this is an overstatement. They have a non-public contract with mozilla. What happens if they break it and get caught? Probably the only consequence is that firefox stops using cloudflare ... eventually.

Look at what has happened with misbehaving CAs. The responses have ranged between nothing and removing them 5 years later.

> your ISP cannot see that you are visiting facebook because the IP shows up us cloudflare

Yes they can, it's visible directly in the https requests as SNI. (not to mention in the sizes of traffic that go through).

> now that is a "massive attack on user privacy"

How so? If anything it's just another example at how this DoH approach does not actively protect users from ISPs.

Re: Mozilla’s DNS over HTTPs

#512

Post by Trezoid » Tue, Feb 25, 2020, 8:03 PM UTC

toomuchtodo wrote: post #336

andyjohnson0 wrote: post #331

Earlier quoted context omitted.

> Formerly, I "opted out" of having a browser that phoned home my browsing traffic by using Firefox. Formerly your browser still "phoned home" to your default DNS provider, using an insecure protocol. I appreciate your concerns but, unless you run your own DNS server, you have to trust someone at some point.

> you have to trust someone at some point. Give me a non-profit infra provider than I can donate to, similar to Let's Encrypt. Let's call it "Let's Resolve", give it a non-profit charter and org style, with transparency, governance, and strong privacy protections. Mozilla could even be one of the sponsors of such an org, thereby ensuring the values it supports are adhered to. Open Street Map runs on a budget of ~$100…

Quad9 (https://www.quad9.net/) exists and is a 501(c)(3) DNS provider with a relatively reasonable privacy policy. It supports direct DNS resolving and has DOH servers available.

The problem is not so much the lack of available infrastructure but the lack of awareness of alternatives existing, so everyone ends up just using the known defaults (google or cloudflare mostly)

Re: Mozilla’s DNS over HTTPs

#513

Post by the8472 » Tue, Feb 25, 2020, 8:03 PM UTC

pbhjpbhj wrote: post #291

rndgermandude wrote: post #136

Earlier quoted context omitted.

>The elephant in the room is that many networks need to have content filtering First of all, we're talking about domain filtering, not content filtering. And no, they want domain filtering, hardly anybody needs it, and there are better solutions than NXDOMAIN, such as actual content filters. >and you are proposing nothing useful. Why would I need to provide "something useful"? mozilla already described the many ways…

I need domain filtering: if the domain serves malware I want to block it, not just the known malware coming from it. If a domain serves porn, I want to block it on my kids computers (and mine) not just the content that is recognisable as porn. If a domain is used by malware I want to block it, and probably use the domain to determine the server, and block that too (too because the domain can move IP).

> If a domain serves porn, I want to block it on my kids computers (and mine)

FWIW, my entire peergroup grew up without anyone installing content filters on their computers, and porn was already widely available back then.

Re: Mozilla’s DNS over HTTPs

#514

Post by nullc » Tue, Feb 25, 2020, 8:04 PM UTC

the8472 wrote: post #489

raesene9 wrote: post #395

Earlier quoted context omitted.

That's fine for more technical users who are aware of how to mitigate this kind of issue, but then those same more technical users will also likely know how to disable DoH. For the majority of users who may not understand the risks around plain text DNS, there are advantages to it being encrypted.

> will also likely know how to disable DoH. Not once DoH-in-the-browser becomes a default, percolates down to electron and then gets baked into a dozen mobile and desktop applications with little control or insight for the user or admin.

I've already had a lot of issues with embedded devices that have hardcoded resolution against 1.1.1.1 not working correctly against my local names.

Re: Mozilla’s DNS over HTTPs

#515

Post by ThePhysicist » Tue, Feb 25, 2020, 8:06 PM UTC

the8472 wrote: post #498

ThePhysicist wrote: post #466

Earlier quoted context omitted.

There simply should not be an API that allows exfiltrating the URL history of a user and then send it to a remote backend, at least not without making this very, very explicit to the user (which they currently do not). You don't need to be a "gatekeeper to a walled garden", it's just necessary to have sensible APIs that respect users privacy. I think a browser that puts privacy as its primary feature should be able t…

This has nothing to do with an API. Any kind of extension that acts automatically (i.e. doesn't exclusively spring to life when clicking on an extension-specific button) will have to inspect the currently open tabs, page contents or network requests to decide whether it has to do its thing, which means it has access to this kind of information anyway and could exfiltrate it through standard web APIs (fetch/XHR). This…

Well, I was part of a team that proved that one of the most popular Firefox extensions (Web of Trust) stole and monetized user data, archiving every single URL a user opened and selling it to anyone who was willing to pay (the journalists I worked with even got a free sample containing the data of 3 million people). The extension was then banned for a few weeks before being reinstated, and happily continues to exfiltrate data from millions of users today. So pardon me if I have a slightly different view on this.

It is simply not true that building systems with privacy in mind is not possible. I can think of several ways to drastically improve the privacy of web extensions by providing audit logging or more fine-grained control over permissions.

Comparing end-user software like Firefox with developer tools like Git is also misleading, I find. There are countless studies that show most non-expert users don't know what is happening with their data and are not able to judge the risks they're taking when installing software like browser extensions.

Again, it's perfectly fine to build a product and not care much about user privacy, but if your main selling point is privacy this is different. It's just pointless to have the most advanced content blocking mechanisms when you allow browser extensions to circumvent them all.

Re: Mozilla’s DNS over HTTPs

#516

Post by basscomm » Tue, Feb 25, 2020, 8:07 PM UTC

bawolff wrote: post #462

dijit wrote: post #347

Earlier quoted context omitted.

>Formerly your browser still "phoned home" to your default DNS provider, using an insecure protocol. This is kinda painful to read, to the point where I'm not sure if it's intentionally misleading; DHCP will give you a DNS config, that DNS server can be local, remote, it can support DNSSEC or DNS over TLS (yes, that's a thing[0]). I even have configurations where a local DNS resolver on my machine (DNSMasq/unbound) w…

I think this is an unfair response. > DHCP will give you a DNS config So in other words "your default dns provider" > that DNS server can be local, remote Maybe a nitpick but i doubt dhcp is going to hive you a local dns server > it can support DNSSEC Which is irrelevent to the original complaint about "phoning home". DNSSec provides security against certain types of attacks like poisioning. Privacy & evesdropping ar…

> Maybe a nitpick but i doubt dhcp is going to hive you a local dns server

Nearly every consumer-grade router on the market hands out IP configurations where said router is configured as a DNS server (the router then usually is configured to forward requests to the DNS provider of your choice, which is usually the ISP's DNS servers, depending on the technical ability of the person that set the router up). This is useful for things like accessing devices on your local network that have a GUI accessible via a web browser by hostname rather than IP address or, in the case of Netgear, intercepting requests to routerlogin.net and redirecting them to the router's configuration page instead of some page on the Internet.

If FireFox starts to ignore the OS-level DNS configuration, then these things are going to break and consumers who don't follow these things closely aren't going to know why or how to fix it.

Re: Mozilla’s DNS over HTTPs

#517

Post by the8472 » Tue, Feb 25, 2020, 8:08 PM UTC

kadoban wrote: post #507

the8472 wrote: post #504

Earlier quoted context omitted.

> just like they can do with any of the ISPs There is a 3rd option: Operating your own recursive resolver.

Doesn't that just move the problem one step away?

It removes a 3rd party that is a juicy target for TLAs. There is only you and the remote hosts that you're talking to.

But yes, it would be really nice if we also had encryption between recursive resolvers and authoritative servers to remove the last place where they could harvest data.

Re: Mozilla’s DNS over HTTPs

#518

Post by WorldMaker » Tue, Feb 25, 2020, 8:09 PM UTC

Seenso wrote: post #345

nullc wrote: post #289

I'm so sad to see Mozilla move forward with this massive attack on user privacy. Firefox DoH is snake oil, plain and simple. It sends all the users DNS queries to Cloudflare, adding a new party which can surveil the user's traffic (and can be legally compelled to do so and not disclose this fact)-- providing a convenient choke point to save spies and hackers the trouble and exposure of extracting the data from tens o…

> Firefox DoH is snake oil, plain and simple... Correct me if I'm wrong, but the concern I have about browser-controlled DoH is that it seems like it could make it harder for a tech-savvy user to assert control over their own network. IIRC, most network-level ad-blocking operates at the DNS level. I've also personally blocked telemetry by setting my router's DNS proxy to resolve certain telemetry servers to 0.0.0.0.…

Firefox tries to recognize some personalized DNS servers and prefer them to DoH in cases where it finds them. The FAQ here suggests that work is ongoing and they are hoping tech-savvy DNS alternatives used for things like parental controls and ad blocking meet them somewhere in the middle in terms of making it easier to Firefox to auto-disable DoH when a user has explicitly opted in to more power user configurations.

Similarly related is the general idea is that if you have the tech savvyness to setup a PiHole in the first place, you should be able to find the Firefox settings on your devices to disable DoH, and Firefox isn't hiding those settings, they are just trying to make a default that is better for more people (the folks that aren't tech savvy and have a different threat model than the power user with a PiHole or similar).

Re: Mozilla’s DNS over HTTPs

#519

Post by datenwolf » Tue, Feb 25, 2020, 8:11 PM UTC

ignoramous wrote: post #424

datenwolf wrote: post #416

Earlier quoted context omitted.

> ISPs dragging their heels on DoT WTH does DoT adoption by ISPs have to do with that?! One can run their own DNS recursive resolver-cache perfectly fine on their own hosts, or at the network edge, without relying on ISPs. Better yet: Since the Root zone and TLD zone DNS servers change only seldomly, you can prefetch and cache them locally just fine, and upon resolving a DNS skip two recursion steps. Apart from doing…

> WTH does DoT adoption by ISPs have to do with that?! The ISPs need to support DoT server-side, at their end?

> The ISPs need to support DoT server-side, at their end?

That's not how DNS works.

Just put DoT capable cachine-resolvers onto each host, and you're golden. Those to even play nicely with enterprise infrastructure, like a local DNS.

Re: Mozilla’s DNS over HTTPs

#520

Post by MoronInAHurry » Tue, Feb 25, 2020, 8:12 PM UTC

windexh8er wrote: post #505

floatingatoll wrote: post #479

Earlier quoted context omitted.

Note that US ISP "Comcast/Xfinity" does not, so at the very least, that's one safe harbor amidst the rest. https://corporate.comcast.com/stories/privacy-with-comcasts-...

Cloudflare states the same thing. In fact, Cloudflare provides much more detail than Comcast/Xfinity [0]. And, personally, I actually believe Cloudflare. If I have to choose between the two companies it's a no brainer. This is Cloudflare's business, and their business relies on them upholding their privacy promise. Comcast/Xfinity has, in the past, engaged in DNS hijacking [1]. Comcast has had the worst ACSI score ov…

Cloudflare's business lost them over $100 million last year alone. The way they operate right now is not a viable business, and we have no idea what they will change when they need to become one.