Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Mozilla’s DNS over HTTPs

blog.mozilla.org

Post reply on HN
Print view View original

571–580 of 777 posts

Re: Mozilla’s DNS over HTTPs

#571

Post by godelski »

dogecoinbase wrote: post #467
_8j50 wrote: post #449

Earlier quoted context omitted.

Your ISP is literally selling this information right now in the US. What are you even talking about? Use google if you don't like CF, or just disable it! Do a little threat modeling here please. Let's say CF sells this data, what do they know about you other than your IP and the sites you visit? While your ISP,employer,school,etc... Can tie that activity to you as a person. Being compelled legally? I did not know pri…

I trust Cloudflare and Google (the other major DoH proponent) not to sell my data, because they have no need to do so. They are subject to law enforcement inquiries just like everyone else, so this does nothing for privacy in that regard (and actually increases the attack surface). This also does not separate who can see your DNS from who can see your traffic, in fact it consolidates it, and this is why both Google (…

> I trust Cloudflare and __Google__ (the other major DoH proponent) not to sell my data, because they have no need to do so.

Isn't Google's entire business model... data collection? Maybe Google won't sell the data, but they'll use it and sell the information they gather with it (i.e. ad targeting). I'm not sure this is meaningfully better than selling data (though there are definitely arguments to be made there).

AFAIK CF isn't in the business of ads and really data collection is just a waste of their disk space.

Re: Mozilla’s DNS over HTTPs

#572

Post by WorldMaker »

nullc wrote: post #547
WorldMaker wrote: post #518

Earlier quoted context omitted.

Firefox tries to recognize some personalized DNS servers and prefer them to DoH in cases where it finds them. The FAQ here suggests that work is ongoing and they are hoping tech-savvy DNS alternatives used for things like parental controls and ad blocking meet them somewhere in the middle in terms of making it easier to Firefox to auto-disable DoH when a user has explicitly opted in to more power user configurations.…

> you should be able to find the Firefox settings on your devices to disable DoH, You should be able to find a buried config option to regain your privacy is _not_ a position that we should consider acceptable! There are serious logistical challenges keeping the option off even at a household level. At the moment it isn't difficult to block at the network level, but presumably they'll start evading those blocks event…

Mozilla seems to have made it clear that where DoH is on by default the config option won't be "buried", particularly because out of the box multiple options will be provided (both Cloudflare and NextDNS). That you see it as "regain" says we probably have different threat models/assessments here, I'm not sure I can help you much further with the paranoia associated with your current threat model.

Re: Mozilla’s DNS over HTTPs

#573

Post by jedisct1 »

nothrabannosir wrote: post #6
Vinnl wrote: post #2

I think this is generally a good thing. Two questions I've often seen surface on HN though weren't answered: 1. Isn't this better implemented at the OS level? 2. Isn't centralisation to two DoH providers more centralised than five large ISPs? Others are probably better suited to answer, but the answers I can think of: 1. Yes, but it is not, so this solution is second-best. If Operating Systems decide to tackle this p…

FWIW, wrt 1: you can use dnscrypt and a bitbar plugin to have this at the OS level on Mac. It’s a faff to setup but once it works it really does work. https://www.dnscrypt.org/ Optional for menu icon: https://getbitbar.com/ and https://github.com/jedisct1/bitbar-dnscrypt-proxy-switcher

https://www.dnscrypt.info

The .org is not legit.

Re: Mozilla’s DNS over HTTPs

#574

Post by yborg »

jiveturkey wrote: post #358
dimensi0nal wrote: post #229

Earlier quoted context omitted.

Cloudflare's resolver does not send the client subnet, which hurts performance when users connect to anything that doesn't use Cloudflare.

That's one thing, sure, but that doesn't affect the majority of sites. CF's DNS POPs are likely more dense than the great majority of service providers POPs. So using the subnet of the resolver is about as good (if not better) than having ECS info for practical purposes. (Because the client is normally going to hit the closest DNS POP to them in BGP network distance.) I'm not a CF fanboi, in fact I think they are evi…

>Your ISP already knows what websites you visit, they don't need the DNS because they see the actual traffic.

Then why were the big ISPs lobbying against this plan when proposed by Google originally? Because they truly were concerned for the welfare of the Internet as they claimed? This is a concern they've never exhibited in the past, their only demonstrated concerns have been related to their revenue streams.

Re: Mozilla’s DNS over HTTPs

#575

Post by organsnyder »

RL_Quine wrote: post #296
organsnyder wrote: post #281

Earlier quoted context omitted.

Good point. Sniffing traffic is orders of magnitude more expensive than simply logging DNS queries.

tcpdump -i any -s 1500 '(tcp[((tcp[12:1] & 0xf0) >> 2)+5:1] = 0x01) and (tcp[((tcp[12:1] & 0xf0) >> 2):1] = 0x16)' -nnXSs0 -ttt Is it though? This one liner works just fine for me on my gateway and is capturing quite a huge number of raw SNI names. 0x0110: c008 0016 0013 0010 000d c00d c003 000a ................ 0x0120: 00ff 0100 0113 0000 001d 001b 0000 186c ...............l 0x0130: 6f67 7369 6e6b 2e64 6576 6963 657…

Sure, that would work for a SOHO gateway, but at ISP scale that's a ton more traffic to be sniffing.

Re: Mozilla’s DNS over HTTPs

#576

Post by np_tokumei »

We just published our proposal of a decentralized DoH resolution to address this exact problem of single-point-of-trust/failure. As Firefox is looking for more reliable partners for their "Trusted Recursive Resolver program", we strongly believe and hope that "K-resolver" will be seriously considered as an option to improve DNS privacy for not only Firefox users, but also the general Internet.

https://twitter.com/NP_tokumei/status/1220802795512578048?s=...

https://arxiv.org/pdf/2001.08901

Re: Mozilla’s DNS over HTTPs

#577

Post by chupa-chups »

lovelearning wrote: post #84

As a resident of a country whose government and ISPs heavily and habitually censor the Internet for political reasons, I for one truly appreciate Firefox's DoH. They should also enable 'network.security.esni.enabled' by default because the censors here have upgraded from DNS to SNI-based blocking. I get it that better solutions are possible, but got to teach people to first walk before teaching them to run. AFAIK, Ch…

Shill or idiot. VPN or Tor would be the answer.

Yes, I'm consciously spending karma on this answer.

Re: Mozilla’s DNS over HTTPs

#579

Post by qw3rty01 »

rovr138 wrote: post #436
blackearl wrote: post #433

Earlier quoted context omitted.

You should only use a domain you own or something that isn't routable. You can't blame FF for that

That was an issue with .dev and then google acquired the TLD.

.dev isn't an rfc2606 reserved TLD, so it shouldn't have been used for internal domains in the first place

Re: Mozilla’s DNS over HTTPs

#580

Post by dreamcompiler »

whoopdedo wrote: post #122
drenginian wrote: post #15

Earlier quoted context omitted.

>> People just run a local resolver that’s support’s these things. Nowhere do “people just run a local resolver”. Grandma and aunty Beryl certainly don’t, nor does any other ordinary person. If you want secure DNS you have to build it in to the browser. Only systems people think that this is the sort of thing that ordinary people do.

Does Grandma have a small WiFi router that her cable modem is plugged into? Well that device provides local DNS for her.

Not true. In the default case, Grandma's wifi router is just passing along -- via DHCP -- the IP address of the cable company's DNS resolver to Grandma's computer. Which the wifi router itself probably obtained via DHCP or a similar mechanism from the modem. This is in no sense a "local DNS resolver."

If Grandma has a grandchild that knows how to set up a PiHole, it's a different story. But that's certainly not the majority of Grandmas or the majority of wifi routers.

Post reply on HN