Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Mozilla’s DNS over HTTPs

blog.mozilla.org

Post reply on HN
Print view View original

551–560 of 777 posts

Re: Mozilla’s DNS over HTTPs

#551

Post by djsumdog »

nullc wrote: post #530
djsumdog wrote: post #407

Earlier quoted context omitted.

American ISPs can and do sell your data legally. I don't really trust my ISP (I run my own DNS server at home and tunnel its requests over to a cloud VM), but I trust Cloudflare even less.

"Legally" is dubious. Intercepting any private wire communication is a clear violation of federal law (e.g. 18 U.S. Code § 2511), and a violation of the law in many states (e.g. CA PC 631). Unfortunately, the US government is one of the larger users of ISP surveillance activities, benefiting through the purchase of private data as well as using administrative subpoena to obtain the data collected by ISPs without due…

Are you sure about that? This passed in 2017 and I don't think it's been reversed:

http://clerk.house.gov/evs/2017/roll202.xml

Re: Mozilla’s DNS over HTTPs

#552

Post by cracker_jacks »

I guess most of the people against this change have been lucky enough to never live in a place where the internet is actively censored.

It must be nice living in a place where you don't have to worry about access. But for many of us, there's no point in privacy without access.

Re: Mozilla’s DNS over HTTPs

#554

Post by the8472 »

ThePhysicist wrote: post #538
the8472 wrote: post #525

Earlier quoted context omitted.

> I can think of several ways to drastically improve the privacy of web extensions by providing audit logging or more fine-grained control over permissions. You were talking about API surface though. Neither of these things are API surface in itself. They are after the fact, informing the user what it can do and what it did with those APIs. > It's just pointless to have the most advanced content blocking mechanisms w…

Reducing the API surface is also a way to improve privacy, and I also see many ways in which you could do this, e.g. by not revealing the path (or at least the query part) of the URL to extensions. It's entirely doable and most extensions can work fine without knowing every single URL you open. Apple, Google & FB have all shown that this approach works to improve privacy (not that I want to endorse them here as priva…

> It's entirely doable and most extensions can work fine without knowing every single URL you open.

It's needed by: Greasemonkey (to determine whether to run a script), content blockers, password managers (to determine whether to fill in on that site) and any extension running web-standards compliant javascript against a page's DOM (i.e. any page-modifying extensions) as inherent part of standards-compliance

This covers a very large fraction of the most downloaded extensions https://addons.mozilla.org/en-US/firefox/search/?platform=wi...

> You can also have an officially sanctioned distribution channel like an app store and still retain the ability to install any software you want.

In theory, yes. But in reality mozilla has been making it more and more difficult to install extensions. You cannot install extensions not signed by mozilla on stable firefox. They already have assumed exclusive control there.

Re: Mozilla’s DNS over HTTPs

#555

Post by mike-cardwell »

demarq wrote: post #478
nullc wrote: post #289

I'm so sad to see Mozilla move forward with this massive attack on user privacy. Firefox DoH is snake oil, plain and simple. It sends all the users DNS queries to Cloudflare, adding a new party which can surveil the user's traffic (and can be legally compelled to do so and not disclose this fact)-- providing a convenient choke point to save spies and hackers the trouble and exposure of extracting the data from tens o…

> It sends all the users DNS queries to Cloudflare, adding a new party it removes many parties (some unknown) who have no legal oversight, and adds a select parties who are legally bound to respect your privacy. > because the user's destination IPs remain unencrypted This makes no sense. your ISP cannot see that you are visiting facebook because the IP shows up us cloudflare urrrghhh! > At the moment you can disable…

"This makes no sense. your ISP cannot see that you are visiting facebook"

There are many massive databases of ip to hostname mappings which can be trivially queried by an ISP to see what service you're connecting to.

Or if they see you connecting to 185.60.216.35, they can just:

  curl http://185.60.216.35 -v 2>&1|grep Location
Or:

  openssl s_client -connect 185.60.216.35:443 2>&1 | openssl x509 -text|grep Subject:
Or one of a miriad of other ways to get a hint about the hostname of the service you're connecting to, at which point they can automatically do forward DNS lookups to confirm what matches.

DoH only adds to the number of organisations that can see your web traffic. It does not reduce it, or shift it to a more trustworthy organisation. It just adds more leaks.

DoH/ESNI don't stop your ISPs knowing exactly what sites you're visiting unless we centralise HTTP behind a handful of benevolant gateways the same way Mozilla is doing with DNS.

Fuck that.

Re: Mozilla’s DNS over HTTPs

#557

Post by bcrosby95 »

cracker_jacks wrote: post #552

I guess most of the people against this change have been lucky enough to never live in a place where the internet is actively censored. It must be nice living in a place where you don't have to worry about access. But for many of us, there's no point in privacy without access.

Why not make it opt in then?

Re: Mozilla’s DNS over HTTPs

#558

Post by corford »

ajphdiv wrote: post #549
corford wrote: post #495

I'm getting pretty pissed off the with the arrogance of US internet tech companies sidestepping formal protocol design & industry adoption because it isn't moving "fast enough" for them. Without ESNI, DoH is essentially meaningless for the class of privacy invaders it is supposed to combat against. By the time ESNI is out, DoT would have had enough time to mature and gain wide enough adoption. DoT is better because a…

Seems to be a trend lately. Google recently announced they will start blocking downloads from http websites. Doesn't sound like a bad idea -- but isn't this more a discussion for IETF as well?

The discussion should be around improved UX/UI and better protocols rather than treating people like idiots and abusing your power to unilaterally force behaviour changes on web content providers and consumers.

The more I think about it the more I realise Microsoft's and AOL's instincts were right. Make the internet a walled garden and insert yourself as the gatekeeper.

Their mistake was to do this too early. ~25 years later and the people are now finally ready and willing to allow billion dollar coporates to overtly "manage" their on-line experience for them. Companies love this too because it removes yet one more unseemly shackle from their ambition (i.e. that of needing to work collaboratively with potential competitors) while at the same time providing them with a nice vector to defend their quasi monopoly.

Re: Mozilla’s DNS over HTTPs

#559

Post by simias »

This is kind of a sub-issue but from the infographic in TFA:

>Q. Will DoH lead to a greater centralization of DNS, which will be bad for the Internet as a whole?

>A. We agree that centralization is bad for the Internet. Today in practice, DNS is >centralized because consumer devices are locked to the DNS service of the ISPs. >And just five companies control over 80% of the US broadband internet market.

For one thing, 5 independent providers within the same country is not exactly centralized in my opinion. As far as I understand it Americans don't always effectively have the choice of which ISP they can use, but that's not a technological problem. You won't solve monopolistic and anti-competitive practices with a new layer 7 protocol.

Furthermore what does Mozilla mean by "locked to the DNS service of the ISPs", do they block DNS queries to other services? Here in Europe I can switch to a different DNS any time I want. Sure, it's easier to stick with the defaults and most people will do that but "locked" is a strong word which I suspect is inaccurate in this case.

By that definition of "centralized" you could argue that email is effectively centralized since most people just use the free service provided by a handful of providers.

>The immediate impact of Mozilla enabling DoH in Firefox will be less >centralization, not more because it shifts traffic away from large ISPs, and >provides users with more choice, while respecting enterprise DNS >configurations.

So 5 ISPs meant that the service was effectively centralized, but (at this time) two competing DoH services with Cloudflare selected by default is "less centralization"?

Re: Mozilla’s DNS over HTTPs

#560

Post by rtsil »

JoshTriplett wrote: post #356
nullc wrote: post #326

Earlier quoted context omitted.

Mozilla claims that Cloudflare is not paying them, and claims that they have a contract with cloudflare which prohibits them from selling the data. I don't think that this improves the situation substantially. The history of internet privacy failures is full of empty and unrealized promises, and no amount of contracts or promises can trump a court order or a NSL. "Has no ability to collect" is the gold standard, and…

ISPs can and do sell your information, and can also be served a warrant or NSL. Cloudflare, by contract, is prohibited from doing the former, which is a net improvement even if they're still subject to the latter. It's an incremental improvement, but a positive one. I would certainly love to see an even better protocol for Internet name resolution that prevents anyone from having name-lookup information, but in the m…

> ISPs can and do sell your information

Not in my country, they'll be massively fined if they're caught doing that.

Post reply on HN