I think DoH itself is a good thing. What seems fishy though is hardcoding Cloudflare as the default DoH service.
It's absolutely not hardcoded.
Not technically, but you know what I mean.
Mozilla’s DNS over HTTPs
561–570 of 777 posts
Re: Mozilla’s DNS over HTTPs
#562So FireFox will now not simply query my internal DNS server? Good luck with that, because I've disabled outbound DNS except from that server.
Guess I'm not using FireFox any more. :(
Re: Mozilla’s DNS over HTTPs
#563As a resident of a country whose government and ISPs heavily and habitually censor the Internet for political reasons, I for one truly appreciate Firefox's DoH. They should also enable 'network.security.esni.enabled' by default because the censors here have upgraded from DNS to SNI-based blocking. I get it that better solutions are possible, but got to teach people to first walk before teaching them to run. AFAIK, Ch…
Notice that this page says they are only rolling it out in the US right now. I guess it'll be available elsewhere soon?
Re: Mozilla’s DNS over HTTPs
#564Earlier quoted context omitted.
SNI is not a good argument, there is work being done to encrypt that as well in TLS 1.3 with Encrypted SNI[1]. [1] https://blog.cloudflare.com/encrypted-sni/
There's a tcp/443 connection to 208.80.153.224, what site could it be? $ whois 208.80.153.224 NetRange: 208.80.152.0 - 208.80.155.255 CIDR: 208.80.152.0/22 NetName: WIKIMEDIA NetHandle: NET-208-80-152-0-1 Parent: NET208 (NET-208-0-0-0-0) NetType: Direct Assignment OriginAS: AS14907 Organization: Wikimedia Foundation Inc. (WIKIM) RegDate: 2007-07-23 Updated: 2014-01-29 Comment: http://www.wikimediafoundation.org Ref:…
mike@blob:~$ host 208.80.153.224
224.153.80.208.in-addr.arpa domain name pointer text-lb.codfw.wikimedia.org.
mike@blob:~$ openssl s_client -connect 208.80.153.224:443 2>&1 | openssl x509 -text|grep Subject:
Subject: C = US, ST = California, L = San Francisco, O = "Wikimedia Foundation, Inc.", CN = *.wikipedia.org
Re: Mozilla’s DNS over HTTPs
#565This is kind of a sub-issue but from the infographic in TFA: >Q. Will DoH lead to a greater centralization of DNS, which will be bad for the Internet as a whole? >A. We agree that centralization is bad for the Internet. Today in practice, DNS is >centralized because consumer devices are locked to the DNS service of the ISPs. >And just five companies control over 80% of the US broadband internet market. For one thing,…
> do they block DNS queries to other services?
Some providers use MitM attacks on DNS queries, to do things like block content or replace NXDOMAIN with SPAM. (Probably obviously, this is not possible with DoH.)
Re: Mozilla’s DNS over HTTPs
#566I just uninstalled firefox and switched to chromium for good (or bad).
Re: Mozilla’s DNS over HTTPs
#567Earlier quoted context omitted.
> They can even see the url Only for plaintext http. For ssl/https - the hostname/ip can leak with SNI, but should be safe with ESNI (encrypted SNI). The URL should be in the request, which comes after the TLS handshake (hence SNI, so that the server can pick a certificate before knowing the HTTP HOST header). SNI is a problem - but not much worse than the fact that a mitm can see who talks to who (IP) - IMNHO.
ESNI is still in draft.
Quite. I didn't mean to imply a host/ip header wouldn't leak today - but I see how my comment can be read that way.
In fact, siblings point about cf (cloud flare) is relevant - as cf eats the world, SNI will potentially be more of a problem; if you connect to site A via IP a, and B via ip b - not much is revealed if host headers A and B leaks, given that traffic to a and b is already obvious. But when you connect to cf on a "nearby" IP c, it suddenly becomes more of a problem that host headers for A, B, D and E are leaking. Not necessarily worse than when your ISP could see you talking to IP a and b - but worse in the sense that you reveal some information to your ISP that would otherwise only be known to cf.
Re: Mozilla’s DNS over HTTPs
#568Earlier quoted context omitted.
Your ISP is literally selling this information right now in the US. What are you even talking about? Use google if you don't like CF, or just disable it! Do a little threat modeling here please. Let's say CF sells this data, what do they know about you other than your IP and the sites you visit? While your ISP,employer,school,etc... Can tie that activity to you as a person. Being compelled legally? I did not know pri…
Sorry for channeling the dude here but that is just, like your opinion man. I think many of the critical voices now are coming from the EU. We have data protection laws. The ISP can't just sell browsing data. That has been illegal since before we had data protection laws, that is actually legally the same as opening other people's letters and reading them. So ... different threat model over here. I am always using th…
> I am always using the US-EN Firefox version because frankly why would I use translated software when I can understand and use the original.
This is maybe not the topic of discussion, but the argument is that your computer is your tool, and the computer should speak your language and adapt itself to you, and not the other way around. For this reason I like and prefer software that speaks my native language! However, I don't have patience for bad translations, and in those cases I'll avoid the translated apps. Not a problem for Firefox!
Re: Mozilla’s DNS over HTTPs
#569I'm so sad to see Mozilla move forward with this massive attack on user privacy. Firefox DoH is snake oil, plain and simple. It sends all the users DNS queries to Cloudflare, adding a new party which can surveil the user's traffic (and can be legally compelled to do so and not disclose this fact)-- providing a convenient choke point to save spies and hackers the trouble and exposure of extracting the data from tens o…
I don't care if my ISP knows I visit reddit.com.
I do care if they know I visit reddit.com/r/something
I'm already protected by TLS for the latter. Newer TLS will eventually protect me from the former (in combination with DNS encryption).
Re: Mozilla’s DNS over HTTPs
#570I'm so sad to see Mozilla move forward with this massive attack on user privacy. Firefox DoH is snake oil, plain and simple. It sends all the users DNS queries to Cloudflare, adding a new party which can surveil the user's traffic (and can be legally compelled to do so and not disclose this fact)-- providing a convenient choke point to save spies and hackers the trouble and exposure of extracting the data from tens o…
SNI is not a good argument, there is work being done to encrypt that as well in TLS 1.3 with Encrypted SNI[1]. [1] https://blog.cloudflare.com/encrypted-sni/
It is since ESNI is only a draft right now. Implementations matter.