Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Mozilla’s DNS over HTTPs

blog.mozilla.org

Post reply on HN
Print view View original

611–620 of 777 posts

Re: Mozilla’s DNS over HTTPs

#611

Post by growse »

mike-cardwell wrote: post #564
throw0101a wrote: post #484

Earlier quoted context omitted.

There's a tcp/443 connection to 208.80.153.224, what site could it be? $ whois 208.80.153.224 NetRange: 208.80.152.0 - 208.80.155.255 CIDR: 208.80.152.0/22 NetName: WIKIMEDIA NetHandle: NET-208-80-152-0-1 Parent: NET208 (NET-208-0-0-0-0) NetType: Direct Assignment OriginAS: AS14907 Organization: Wikimedia Foundation Inc. (WIKIM) RegDate: 2007-07-23 Updated: 2014-01-29 Comment: http://www.wikimediafoundation.org Ref:…

mike@blob:~$ host 208.80.153.224 224.153.80.208.in-addr.arpa domain name pointer text-lb.codfw.wikimedia.org. mike@blob:~$ openssl s_client -connect 208.80.153.224:443 2>&1 | openssl x509 -text|grep Subject: Subject: C = US, ST = California, L = San Francisco, O = "Wikimedia Foundation, Inc.", CN = *.wikipedia.org Yeah, our ISPs are going to be totally in the dark thanks to DoH. /s

> mike@blob:~$ host 208.80.153.224 224.153.80.208.in-addr.arpa domain name pointer text-lb.codfw.wikimedia.org. mike@blob:~$ openssl s_client -connect 208.80.153.224:443 2>&1 | openssl x509 -text|grep Subject: Subject: C = US, ST = California, L = San Francisco, O = "Wikimedia Foundation, Inc.", CN = *.wikipedia.org Yeah, our ISPs are going to be totally in the dark thanks to DoH. /s

minjiexin.com resolves to the same IP. So, you see an HTTPS connection to 208.80.153.224, what's the user doing?

Re: Mozilla’s DNS over HTTPs

#612

Post by donmcronald »

corford wrote: post #495

I'm getting pretty pissed off the with the arrogance of US internet tech companies sidestepping formal protocol design & industry adoption because it isn't moving "fast enough" for them. Without ESNI, DoH is essentially meaningless for the class of privacy invaders it is supposed to combat against. By the time ESNI is out, DoT would have had enough time to mature and gain wide enough adoption. DoT is better because a…

> Regardless of DNS, your device still needs to connect to an IP.

All of the bad actors from the users’ perspective (ads, tracking, etc.) will sit behind Cloudflare, Cloudfront, etc. and you won’t be able to do anything about it.

Re: Mozilla’s DNS over HTTPs

#613

Post by Marsymars »

throw0101a wrote: post #483
_8j50 wrote: post #449

Earlier quoted context omitted.

Your ISP is literally selling this information right now in the US. What are you even talking about? Use google if you don't like CF, or just disable it! Do a little threat modeling here please. Let's say CF sells this data, what do they know about you other than your IP and the sites you visit? While your ISP,employer,school,etc... Can tie that activity to you as a person. Being compelled legally? I did not know pri…

> Your ISP is literally selling this information right now in the US. What are you even talking about? Every time Firefox starts up it probably phones home to check for updates. The incoming request is traceable from the user's IP and Mozilla could figure out if the user is with a privacy-violating ISP: they could then only enable OS-bypassing DoH for those users. Those who run Firefox in corporate networks would be…

> Also, as someone in Canada, I downloaded the "English" version of Firefox, which probably meant "en_US" locale: guess what, I'm affected. As are plenty of less technical people who don't understand about going into about:config and changing things to "en_CA".

The en-ca locale was only added to Firefox in September 2018, I think it's the default for any new downloads since then, but FF won't automatically change the locale for existing installs.

Re: Mozilla’s DNS over HTTPs

#614

Post by dang »

gshulegaard wrote: post #584
dang wrote: post #491

Earlier quoted context omitted.

> What are you even talking about? Can you please edit swipes like that out of your comments when posting to HN? They break the site guidelines and provoke others into doing worse. https://news.ycombinator.com/newsguidelines.html

I think it's a good call out to keep in mind the guidelines, but technically the original comment also breaks guidelines. Two wrongs don't make a right, but I would suggest trying to avoid the appearance of personal bias when calling out guidelines infractions on a comment without also calling out infractions within the context equally.

I don't see how the GP comment broke the site guidelines. "Snake oil" is close to name-calling, but I don't think it's really over the line, and if we started moderating HN comments for that kind of thing, there would be a huge backlash from the community. Is there something else that I missed?

These things are matters of degree in any case, and "what are you even talking about" is clear cut.

Re: Mozilla’s DNS over HTTPs

#615

Post by the8472 »

kyuudou wrote: post #591
the8472 wrote: post #504

Earlier quoted context omitted.

> just like they can do with any of the ISPs There is a 3rd option: Operating your own recursive resolver.

I've found this harder and harder over the years. My usual MOD was installing and configuring the caching-nameserver BIND package in rpm-based RHEL-downstream distros and MaraDNS in everything else. I've just kind of given up because reasons but I'm still very supportive of any of these kinds of efforts.

unbound is much easier to configure than BIND in my experience

Re: Mozilla’s DNS over HTTPs

#616

Post by zamalek »

alwillis wrote: post #592
zamalek wrote: post #508

Earlier quoted context omitted.

The only way to solve the ISP DNS inspection problem is by one of: * Using DoH. For this to work with PiHole, you need to have a DoH resolver on the device, and then instruct the PiHole to recurse to that resolver instead - possibly your own in a VM somewhere? * Using a permanent encrypted VPN to your own machine in the cloud and routing all DNS through that, then recursing to some DNS that you trust. * Write your ow…

DNS over TSL (DoT) is a much better alternative to DoH, at least when it comes to the ability to be tracked. For example, because it’s not using HTTP, there are no cookies or SNI to worry about. More at https://news.ycombinator.com/item?id=22418005 .

DoT only solves the SNI problem during the DNS request itself. It doesn't do a thing about the SNI during the request to the actual website, which is where all the privacy concerns are.

Re: Mozilla’s DNS over HTTPs

#617

Post by bscphil »

ignoramous wrote: post #430
mooman219 wrote: post #426

Earlier quoted context omitted.

If I sit any family member down in front of this comment, their eyes would glaze over. Not only is what you mention a PITA, it's impossible for most people.

AFAIK, when one turns on DoH, Firefox's trr.mode defaults to 2 . And that's the default behaviour most would want except for the ones using pi-hole et al.

In general, yes, that solves the problem for local domains. But anyone who needs to do anything at all complicated is going to have trouble with this, not just Pi-Hole users.

For example, take your average John Doe who uses Firefox. Not particularly technically competent. A new version of Firefox comes out, and all the Archive.is domains break. Who does he blame for that, and how does he solve the problem?

What's happening behind the scenes is that Firefox switched his DNS address on him without warning. And Cloudflare (the DNS endpoint used by Firefox by default) returns incorrect IP addresses for the Archive.is domains (because the admin of these domains returns fake addresses to Cloudflare from their authoritative DNS server).

Most people are using DNS provided by their ISP, so they haven't seen this problem before. I know about the problem, and my resolver (Unbound) is set to use Cloudflare over TLS for most requests, but sends Archive.is domains to Google's DNS instead. This solves the problem for me. Firefox switching to Cloudflare by default not only breaks sites like this for the average user, it even breaks my workaround that fixes the problem.

(I can't currently reproduce the problem, so maybe Archive.is caved and started sending working IP addresses. But it's the sort of problem that can happen when you start messing around with DNS. Your users will blame you if a site doesn't load in your browser, but works in other ones.)

Re: Mozilla’s DNS over HTTPs

#618

Post by zAy0LfpBZLC8mAC »

windexh8er wrote: post #543
MoronInAHurry wrote: post #520

Earlier quoted context omitted.

Cloudflare's business lost them over $100 million last year alone. The way they operate right now is not a viable business, and we have no idea what they will change when they need to become one.

Maybe you're new to the tech/security space, but the majority of companies operate at a loss as they grow and pivot their business. If you follow Cloudflare they've only recently begun to start to sell into the enterprise space with new products as in the SASE space and beyond their traditional DDoS/WAF/encryption plays. Even with those "legacy" products - Cloudflare never heavily sold into large enterprise compared…

No, it clearly says that if they haven't figured out a business model yet, the business model they will end up figuring out might just as well be selling your data, so it's maybe not wise to make the internet depend on them not doing so.

Re: Mozilla’s DNS over HTTPs

#619

Post by justlexi93 »

In an effort to further protect the privacy of its users online, Firefox has begun rolling out encrypted DNS over HTTPS (DoH) by default for US-based users.

To be honest I don't use Firefox that much compared to Chrome.

Re: Mozilla’s DNS over HTTPs

#620

Post by bawolff »

nullc wrote: post #501
bawolff wrote: post #462

Earlier quoted context omitted.

I think this is an unfair response. > DHCP will give you a DNS config So in other words "your default dns provider" > that DNS server can be local, remote Maybe a nitpick but i doubt dhcp is going to hive you a local dns server > it can support DNSSEC Which is irrelevent to the original complaint about "phoning home". DNSSec provides security against certain types of attacks like poisioning. Privacy & evesdropping ar…

> Maybe a nitpick but i doubt dhcp is going to hive you a local dns server 0_o Weird doubt,-- thats why DHCP can give you a DNS server. Otherwise, DNS discovery might as well work by just defining some /32s that always get routed to a nearby DNS server. :) My DHCP servers at home give me a local DNS server... any corporate network that also has internal private naming will necessarily be handing out a resolver intern…

I guess i was interpreting local in the sense of localhost. Which, fair enough, in context that is a silly way to interpret local as local network makes much more sense in context.
Post reply on HN