Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Mozilla’s DNS over HTTPs

blog.mozilla.org

Post reply on HN
Print view View original

531–540 of 777 posts

Re: Mozilla’s DNS over HTTPs

#531

Post by the8472 »

ThePhysicist wrote: post #528
WorldMaker wrote: post #506

Earlier quoted context omitted.

It asks the user if they want to allow an extension to "Access Browsing History" [1]. That seems pretty explicit and self-explanatory to me. [1] https://support.mozilla.org/en-US/kb/permission-request-mess...

No, it would be straightforward if they asked the user something like this: "Is it ok that this extension sends every single URL you open to an untrusted third party for processing? Please note that URLs might contain sensitive data like access tokens or session information." Even so, I don't think such an API should exist. And if you absolutely need to have something like this you should restrict it to domain inform…

> Even so, I don't even think such an API should exist.

There is no "exfiltrate all my history" in the webextension APIs. What exists are two distinct and reasonable components.

A) accessing browsing history/current tabs/network requests¹. all things required for extensions to work B) ability to make generic network requets

Combining these two can be used to exfiltrate data. But that does not mean that any particular extension that has access to both will also exfiltrate private data. Thus a blanket warning would be overly broad and anything more targeted would require manual sourcecode inspection.

¹ Those require separate permissions, but for the purpose of the discussion they can all be used to harvest data

Re: Mozilla’s DNS over HTTPs

#532

Post by deg4uss3r »

nullc wrote: post #289

I'm so sad to see Mozilla move forward with this massive attack on user privacy. Firefox DoH is snake oil, plain and simple. It sends all the users DNS queries to Cloudflare, adding a new party which can surveil the user's traffic (and can be legally compelled to do so and not disclose this fact)-- providing a convenient choke point to save spies and hackers the trouble and exposure of extracting the data from tens o…

I use cloud nine because I dont' like CF: https://dns9.quad9.net/dns-query

Re: Mozilla’s DNS over HTTPs

#533

Post by the8472 »

ethagnawl wrote: post #510
the8472 wrote: post #492

Earlier quoted context omitted.

You can operate one on your home router, which can be negative-cost if you're also saving the rent on the ISP hardware.

Well, sure. However, my comment was within the context of the parent's, which was talking about how this feature is beneficial to non-technical users; some of which may not be able to afford to pay for a VPN that (probably doesn't ...) MITM or log traffic.

Ideally this would be a standard component of home routers, especially some easy wireguard QR-code setup. But yes, until this happens it's something for more tech-savy users.

Re: Mozilla’s DNS over HTTPs

#534

Post by JohnFen »

shawnz wrote: post #473
JohnFen wrote: post #384

Earlier quoted context omitted.

That is an ineffective approach for a number of reasons. This is essentially a blacklist approach, and blacklist approaches are very weak. The number of such servers is in the several thousands, at least. They also move and new ones spin up, requiring constant updating of the blacklist. It's much more effective to take a whitelist approach or, what I do, just block the DNS lookups for them all. (That said, I do keep…

Don't those disadvantages apply just the same to your blacklisting of marketers' DNS servers?

Indeed they do, which is why that's not a sufficient defense all by itself.

The next level up is to block the DNS lookups that happen when the spies are trying to find their servers. That's what DoH prevents.

Re: Mozilla’s DNS over HTTPs

#535

Post by datenwolf »

raesene9 wrote: post #446
datenwolf wrote: post #416

Earlier quoted context omitted.

> ISPs dragging their heels on DoT WTH does DoT adoption by ISPs have to do with that?! One can run their own DNS recursive resolver-cache perfectly fine on their own hosts, or at the network edge, without relying on ISPs. Better yet: Since the Root zone and TLD zone DNS servers change only seldomly, you can prefetch and cache them locally just fine, and upon resolving a DNS skip two recursion steps. Apart from doing…

Most end users don't just "run their own recursive resolver-cache" They take whatever DNS server is provided by their ISP I'd guess that 99+% of Internet users have no idea how to run their own DNS server, let alone set up DoT.

That's not a good counterargument. Why you ask? Because that's something that OS vendors could easily and trivially deploy with only minimal effort.

For example on Linux you could do this with running a localhost instance of unbound, and having a DHCP client hook script updating unbound's configuration for domain specific authorative DNS servers based on the DHCP options for nameserver and domain name.

Just put that as out-of-the-box setup into default Linux distributions' installation: Not only does this greatly enhance privacy. It also prevents enterprise information leakage, and every program on the system is going to benefit from it. Not just the browser.

DoH is a clusterfuck of stupid. There's not one single redeeming quality about it. Everything positive it promises to do has been already solved in a far better manner by earlier developments. And it comes with the penality of concentration of failure points.

In the best case scenario it doesn't impair your privacy.

In the worst case scenario, all the DoH resolver operators in the U.S. will get FISA court orders – including a gag order – to install boxes helpfully provided by some three-letter-agency that monitor all incoming and outgoing traffic of their resolvers; getting the DNS queries/responses in the clear would be nice, but they don't really need it, for the resolvers provide some nicely observable traffic hub on where it's super easy to time correlate outgoing DNS resolver queries to incoming DoH requests.

And don't even believe that DoH requests would be indistinguishable from "regular" HTTPS traffic! Unless you're running into an DNS record that's been overloaded with everything DNSSEC offers the bandwidth requirements of DNS are fairly balanced in both directions. Plus, the amount of data transferred via DoH is more or less the net size of the final DNS query and request combined. So either you pad DoH for the worst case scenario size, or you have a pretty well readable side channel.

No matter from which angle you look at it, DoH makes no fucking sense whatsoever. It's just stupid, if not malicious.

Re: Mozilla’s DNS over HTTPs

#536

Post by EvanAnderson »

JoshTriplett wrote: post #239
throw0101a wrote: post #231

Earlier quoted context omitted.

> Don't run devices on your network you don't trust. Oh, is that all? How about I trust the devices until a secretary clicks on a (spear)phishing link that runs a zero-day. Then what? The host is compromised so I can no longer trust any end-device monitoring software on it, and now the network traffic is opaque. And that doesn't even get into things like academia where students and visiting researchers bring devices…

So you're counting on malware's continued use of plaintext DNS as part of your network's security strategy?

Given that Cisco has a major product, Umbrella, that is sold as a part of enterprise security strategy I'd say that more than the OP is considering DNS filtering / monitoring as part of a network security strategy.

Re: Mozilla’s DNS over HTTPs

#537

Post by e12e »

OrgNet wrote: post #522
_8j50 wrote: post #449

Earlier quoted context omitted.

Your ISP is literally selling this information right now in the US. What are you even talking about? Use google if you don't like CF, or just disable it! Do a little threat modeling here please. Let's say CF sells this data, what do they know about you other than your IP and the sites you visit? While your ISP,employer,school,etc... Can tie that activity to you as a person. Being compelled legally? I did not know pri…

Your ISP can still see the IPs that you are talking to... What are you talking about? They can even see the url even if you dont use them as your DNS

> They can even see the url

Only for plaintext http. For ssl/https - the hostname/ip can leak with SNI, but should be safe with ESNI (encrypted SNI). The URL should be in the request, which comes after the TLS handshake (hence SNI, so that the server can pick a certificate before knowing the HTTP HOST header).

SNI is a problem - but not much worse than the fact that a mitm can see who talks to who (IP) - IMNHO.

Re: Mozilla’s DNS over HTTPs

#538

Post by ThePhysicist »

the8472 wrote: post #525
ThePhysicist wrote: post #515

Earlier quoted context omitted.

Well, I was part of a team that proved that one of the most popular Firefox extensions (Web of Trust) stole and monetized user data, archiving every single URL a user opened and selling it to anyone who was willing to pay (the journalists I worked with even got a free sample containing the data of 3 million people). The extension was then banned for a few weeks before being reinstated, and happily continues to exfilt…

> I can think of several ways to drastically improve the privacy of web extensions by providing audit logging or more fine-grained control over permissions. You were talking about API surface though. Neither of these things are API surface in itself. They are after the fact, informing the user what it can do and what it did with those APIs. > It's just pointless to have the most advanced content blocking mechanisms w…

Reducing the API surface is also a way to improve privacy, and I also see many ways in which you could do this, e.g. by not revealing the path (or at least the query part) of the URL to extensions. It's entirely doable and most extensions can work fine without knowing every single URL you open. Apple, Google & FB have all shown that this approach works to improve privacy (not that I want to endorse them here as privacy champions), so why should that not work in the browser?

You can also have an officially sanctioned distribution channel like an app store and still retain the ability to install any software you want. The problem as I see it is that Mozilla provides a free distribution and marketing platform for malicious actors via their extension store, and I think this is in violation of their principles (especially principle 4) because it nullifies most of the security features that their browser offers. It's like putting up a 10-feet reinforced concrete wall to protect your house from intruders and then leaving the backdoor wide open.

I really don't want to argue about this here, I just find they're not doing the right thing and I find it sad, because I care a lot about privacy and I think recently Mozilla just took some bad decisions regarding that.

Re: Mozilla’s DNS over HTTPs

#539

Post by alwillis »

ryanisnan wrote: post #351
alwillis wrote: post #263

The underlying issue is that a DoH provider can craft the DNS answers individual users get if it wants to. Think about it: a Firefox DoH user could get different DNS answers than other apps get on the same machine using standard DNS on port 53, if Google or Cloudflare wanted to, because they’re essentially talking to different versions of the internet. Remember, all of the properties that allows HTTPS to be trackable…

> Think about it: a Firefox DoH user could get different DNS answers than other apps get on the same machine using standard DNS on port 53, if Google or Cloudflare wanted to, because they’re essentially talking to different versions of the internet. How is that different than existing DNS servers?

How is that different than existing DNS servers?

Because standard DNS servers using mostly UDP can’t track you the way a DoH server can.

The more centralized DoH becomes, the more tempting it’ll be to monetize that traffic.

Re: Mozilla’s DNS over HTTPs

#540

Post by sneak »

nullc wrote: post #289

I'm so sad to see Mozilla move forward with this massive attack on user privacy. Firefox DoH is snake oil, plain and simple. It sends all the users DNS queries to Cloudflare, adding a new party which can surveil the user's traffic (and can be legally compelled to do so and not disclose this fact)-- providing a convenient choke point to save spies and hackers the trouble and exposure of extracting the data from tens o…

> Firefox DoH is snake oil, plain and simple.

This is not an accurate statement, for the commonly accepted definition of "snake oil".

Your privacy concerns are, from an angle, legitimate (although encrypted protocols, as a general rule, are more private than plaintext protocols), but this is a bit over the top.

TFA also mentions that they are partnering with NextDNS, so your claims about centralization are on shaky ground, too. I personally use NextDNS on my whole LAN. They're great!

Post reply on HN