Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Mozilla’s DNS over HTTPs

blog.mozilla.org

Post reply on HN
Print view View original

581–590 of 777 posts

Re: Mozilla’s DNS over HTTPs

#581

Post by pkulak »

lovelearning wrote: post #84

As a resident of a country whose government and ISPs heavily and habitually censor the Internet for political reasons, I for one truly appreciate Firefox's DoH. They should also enable 'network.security.esni.enabled' by default because the censors here have upgraded from DNS to SNI-based blocking. I get it that better solutions are possible, but got to teach people to first walk before teaching them to run. AFAIK, Ch…

Wow, I had no idea encrypted SNI was a thing. That's very good news, because without it, DNS over TLS is pretty useless.

Re: Mozilla’s DNS over HTTPs

#583

Post by tptacek »

datenwolf wrote: post #535
raesene9 wrote: post #446

Earlier quoted context omitted.

Most end users don't just "run their own recursive resolver-cache" They take whatever DNS server is provided by their ISP I'd guess that 99+% of Internet users have no idea how to run their own DNS server, let alone set up DoT.

That's not a good counterargument. Why you ask? Because that's something that OS vendors could easily and trivially deploy with only minimal effort. For example on Linux you could do this with running a localhost instance of unbound, and having a DHCP client hook script updating unbound's configuration for domain specific authorative DNS servers based on the DHCP options for nameserver and domain name. Just put that…

I like how someone on HN tells you that ordinary users have no idea how to set up their own DNS servers and you respond with how Linux users can set up unbound. Like, well argued!

There is also something poetic about how the people that know how and are inclined to set up their own unbound servers on their laptops are getting worse security than everyone else. That sparks joy for me.

Re: Mozilla’s DNS over HTTPs

#584

Post by gshulegaard »

dang wrote: post #491
_8j50 wrote: post #449

Earlier quoted context omitted.

Your ISP is literally selling this information right now in the US. What are you even talking about? Use google if you don't like CF, or just disable it! Do a little threat modeling here please. Let's say CF sells this data, what do they know about you other than your IP and the sites you visit? While your ISP,employer,school,etc... Can tie that activity to you as a person. Being compelled legally? I did not know pri…

> What are you even talking about? Can you please edit swipes like that out of your comments when posting to HN? They break the site guidelines and provoke others into doing worse. https://news.ycombinator.com/newsguidelines.html

I think it's a good call out to keep in mind the guidelines, but technically the original comment also breaks guidelines.

Two wrongs don't make a right, but I would suggest trying to avoid the appearance of personal bias when calling out guidelines infractions on a comment without also calling out infractions within the context equally.

Re: Mozilla’s DNS over HTTPs

#585

Post by alwillis »

alwillis wrote: post #263

The underlying issue is that a DoH provider can craft the DNS answers individual users get if it wants to. Think about it: a Firefox DoH user could get different DNS answers than other apps get on the same machine using standard DNS on port 53, if Google or Cloudflare wanted to, because they’re essentially talking to different versions of the internet. Remember, all of the properties that allows HTTPS to be trackable…

I posted the article Centralised DoH is bad for Privacy, in 2019 and beyond to HN nearly a week ago [1].

Here’s the money quote:

DNS over HTTPS however neatly separates out each device (and even each individual application on that device) to a separate query stream. This alone is worrying, as we now have individual users’ queries, but the TLS that underlies HTTPS also typically uses TLS Resumption which offers even further tracking capabilities.

[1]: https://news.ycombinator.com/item?id=22362864

Re: Mozilla’s DNS over HTTPs

#586

Post by mike-cardwell »

abstractbarista wrote: post #569
nullc wrote: post #289

I'm so sad to see Mozilla move forward with this massive attack on user privacy. Firefox DoH is snake oil, plain and simple. It sends all the users DNS queries to Cloudflare, adding a new party which can surveil the user's traffic (and can be legally compelled to do so and not disclose this fact)-- providing a convenient choke point to save spies and hackers the trouble and exposure of extracting the data from tens o…

I don't care if my ISP knows I visit reddit.com. I do care if they know I visit reddit.com/r/something I'm already protected by TLS for the latter. Newer TLS will eventually protect me from the former (in combination with DNS encryption).

> I'm already protected by TLS for the latter.

True

> Newer TLS will eventually protect me from the former (in combination with DNS encryption).

False. Your ISP will see a port 443 connection to 151.101.121.140 and then lookup that IP in whichever of the numerous IP->Website DB's they're using and discover you visited Reddit.

DoH didn't hide from your ISP that you visited Reddit. It just added Cloudflare to the list of orgs that know about it.

Potential fix: Centralise HTTP behind a handful of shared IP addresses so the IP->Website mapping isn't so easy. Did somebody say Cloudflare?

Re: Mozilla’s DNS over HTTPs

#587

Post by jp_sc »

jancsika wrote: post #344
fludlight wrote: post #256

Earlier quoted context omitted.

I know Brave is supposed to be a privacy-centric browser, but their plan for advertising seems at odds with that. Advertising is a slippery slope and I wonder how long before these promises are eroded or outright reversed. > 100% of your ad spend is placed for active users that opt-in to a rewarding private ad experience. > Craft effective offers and provide captivating full-page experiences directly with consumers i…

> I know Brave is supposed to be a privacy-centric browser, but their plan for advertising seems at odds with that. I know "Have I Been Pwned" is supposed to be a security tool for white hats, but the fact that they collected hundreds of millions of users passwords seems at odds with that. Additionally, there's a service called 1password that leverages this data. It claims to be a tool to help users know if their pas…

1Password is a very popular password manager.

Re: Mozilla’s DNS over HTTPs

#588

Post by cnst »

larrysalibra wrote: post #44

Questions I couldn’t find answers to in the post or linked info about the Trusted Resolver Program: What’s in it for the Cloudflare & NextDNS? Are they getting paid to handle this traffic or paying to have the opportunity to access this data? Can users outside the US opt-in? The comment about having “no plans” to enable this outside the USA seems a bit disingenuous. Hard to believe they built this program / feature a…

> What’s in it for the Cloudflare & NextDNS?

I'm amazed noone else is asking this. CF's whole business model centres around the concept of denying website access to minorities they classify as "bots". Some big actors can afford to practice the notion of reciprocity by blocking access to Cloudflare in return — https://news.ycombinator.com/item?id=21155056 — try doing that now when you might end up blocking access to your site for all Firefox users.

Re: Mozilla’s DNS over HTTPs

#589

Post by 9HZZRfNlpR »

djsumdog wrote: post #407
ThePhysicist wrote: post #362

Earlier quoted context omitted.

I trust my own DNS provider much more than I trust Cloudflare to be honest. Also, most DNS requests over that “insecure protocol” happened over a single network hop or two and never left the infrastructure of the ISP. Cloudflare is now a public company and they need to aggressively monetize their services. Selling browsing data is a lucrative business and becoming “the” DNS provider for most users (while locking out…

American ISPs can and do sell your data legally. I don't really trust my ISP (I run my own DNS server at home and tunnel its requests over to a cloud VM), but I trust Cloudflare even less.

I trust my ISP but not American companies. They roll out only in America but obviously it's coming, and they use locale to detect it? My locale is set to en_US too, surely I'm not alone doing it because of translated software. Firefox has a small market in America anyway and America is not the world. We know big tech is in bed with your three letter agencies.

Re: Mozilla’s DNS over HTTPs

#590

Post by alwillis »

_8j50 wrote: post #449
nullc wrote: post #289

I'm so sad to see Mozilla move forward with this massive attack on user privacy. Firefox DoH is snake oil, plain and simple. It sends all the users DNS queries to Cloudflare, adding a new party which can surveil the user's traffic (and can be legally compelled to do so and not disclose this fact)-- providing a convenient choke point to save spies and hackers the trouble and exposure of extracting the data from tens o…

Your ISP is literally selling this information right now in the US. What are you even talking about? Use google if you don't like CF, or just disable it! Do a little threat modeling here please. Let's say CF sells this data, what do they know about you other than your IP and the sites you visit? While your ISP,employer,school,etc... Can tie that activity to you as a person. Being compelled legally? I did not know pri…

It’s much worse than you think: https://news.ycombinator.com/item?id=22418005
Post reply on HN