Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Mozilla’s DNS over HTTPs

blog.mozilla.org

Post reply on HN
Print view View original

631–640 of 777 posts

Re: Mozilla’s DNS over HTTPs

#631

Post by _8j50 »

Marsymars wrote: post #613
throw0101a wrote: post #483

Earlier quoted context omitted.

> Your ISP is literally selling this information right now in the US. What are you even talking about? Every time Firefox starts up it probably phones home to check for updates. The incoming request is traceable from the user's IP and Mozilla could figure out if the user is with a privacy-violating ISP: they could then only enable OS-bypassing DoH for those users. Those who run Firefox in corporate networks would be…

> Also, as someone in Canada, I downloaded the "English" version of Firefox, which probably meant "en_US" locale: guess what, I'm affected. As are plenty of less technical people who don't understand about going into about:config and changing things to "en_CA". The en-ca locale was only added to Firefox in September 2018, I think it's the default for any new downloads since then, but FF won't automatically change the…

Can't you just disable DoH?

Re: Mozilla’s DNS over HTTPs

#632

Post by _8j50 »

nullc wrote: post #542
e12e wrote: post #537

Earlier quoted context omitted.

> They can even see the url Only for plaintext http. For ssl/https - the hostname/ip can leak with SNI, but should be safe with ESNI (encrypted SNI). The URL should be in the request, which comes after the TLS handshake (hence SNI, so that the server can pick a certificate before knowing the HTTP HOST header). SNI is a problem - but not much worse than the fact that a mitm can see who talks to who (IP) - IMNHO.

ESNI is not in use yet (or just doesn't work). Start up tcpdump and check yourself. At best even it were currently use it only provides protection for sites which are hosted behind DOS mitigation services. (usually cloudflare...)

You need the right TLS lib for it to work, browsers support it. I've seen big sites like facebook and cloudflare use it.

Re: Mozilla’s DNS over HTTPs

#634

Post by _8j50 »

MoronInAHurry wrote: post #520
windexh8er wrote: post #505

Earlier quoted context omitted.

Cloudflare states the same thing. In fact, Cloudflare provides much more detail than Comcast/Xfinity [0]. And, personally, I actually believe Cloudflare. If I have to choose between the two companies it's a no brainer. This is Cloudflare's business, and their business relies on them upholding their privacy promise. Comcast/Xfinity has, in the past, engaged in DNS hijacking [1]. Comcast has had the worst ACSI score ov…

Cloudflare's business lost them over $100 million last year alone. The way they operate right now is not a viable business, and we have no idea what they will change when they need to become one.

How do you think Akamai makes money? CF is a competition.

Re: Mozilla’s DNS over HTTPs

#635

Post by _8j50 »

nwallin wrote: post #604
foresto wrote: post #593

Earlier quoted context omitted.

> Your ISP is literally selling this information right now No, mine is not. > Use google if you don't like CF Google is no better. > or just disable it! It is never okay to hijack my DNS lookups. Posting a note someplace about how it can be restored does not change the fact that you hijacked it, and does not make it okay. > This is not adding a new party that can surveil you Given that the DoH provider is a new party…

> My ISP can still see the domain names of sites I visit, via both SNI and OCSP. Encrypted SNI and OCSP stapling solve those problems.

They see the SNI but not the host. eSNI would help but so do CDNs (even with ocsp/crl since hundreds of sites use a single cert. Domain fronting is getting more common too

Re: Mozilla’s DNS over HTTPs

#636

Post by Spivak »

dsr_ wrote: post #633

https://bugzilla.mozilla.org/show_bug.cgi?id=1614751 Firefox won't bother checking the canary domain if the user clicked "OK" to the DNS-over-HTTPS question.

ITT: Some very annoyed sysadmins that didn’t read the enterprise deployment guide and who apparently rely on “pretty please don’t exfiltrate data” as their enforcement mechanism.

Are they surprised that a change made in the name of preventing your local network operator from slurping your DNS information doesn’t create a way for local network operators to just ignore DoH and slurp DNS information?

Re: Mozilla’s DNS over HTTPs

#637

Post by lovelearning »

abstractbarista wrote: post #563
lovelearning wrote: post #84

As a resident of a country whose government and ISPs heavily and habitually censor the Internet for political reasons, I for one truly appreciate Firefox's DoH. They should also enable 'network.security.esni.enabled' by default because the censors here have upgraded from DNS to SNI-based blocking. I get it that better solutions are possible, but got to teach people to first walk before teaching them to run. AFAIK, Ch…

Notice that this page says they are only rolling it out in the US right now. I guess it'll be available elsewhere soon?

The features are available everywhere to everybody but are not enabled by default. The only difference for US users is that they're enabled by default.

Re: Mozilla’s DNS over HTTPs

#638

Post by Marsymars »

_8j50 wrote: post #631
Marsymars wrote: post #613

Earlier quoted context omitted.

> Also, as someone in Canada, I downloaded the "English" version of Firefox, which probably meant "en_US" locale: guess what, I'm affected. As are plenty of less technical people who don't understand about going into about:config and changing things to "en_CA". The en-ca locale was only added to Firefox in September 2018, I think it's the default for any new downloads since then, but FF won't automatically change the…

Can't you just disable DoH?

Sure, my point was just tangential to clarify on the availability of the en-ca locale for Firefox. I don't even know that DoH is based on the installed browser's locale in the first place. (I'd guess that it isn't, as I'd expect many non-US users use the en-us locale.)

Re: Mozilla’s DNS over HTTPs

#639

Post by waterfowl »

mrpopo wrote: post #627
bscphil wrote: post #617

Earlier quoted context omitted.

In general, yes, that solves the problem for local domains. But anyone who needs to do anything at all complicated is going to have trouble with this, not just Pi-Hole users. For example, take your average John Doe who uses Firefox. Not particularly technically competent. A new version of Firefox comes out, and all the Archive.is domains break. Who does he blame for that, and how does he solve the problem? What's hap…

> the admin of these domains returns fake addresses to Cloudflare from their authoritative DNS server Why?

some prior discussion for context -- https://news.ycombinator.com/item?id=19828317

Re: Mozilla’s DNS over HTTPs

#640

Post by bscphil »

mrpopo wrote: post #627
bscphil wrote: post #617

Earlier quoted context omitted.

In general, yes, that solves the problem for local domains. But anyone who needs to do anything at all complicated is going to have trouble with this, not just Pi-Hole users. For example, take your average John Doe who uses Firefox. Not particularly technically competent. A new version of Firefox comes out, and all the Archive.is domains break. Who does he blame for that, and how does he solve the problem? What's hap…

> the admin of these domains returns fake addresses to Cloudflare from their authoritative DNS server Why?

They have a beef with Cloudflare over Cloudflare removing EDNS Client Subnet for privacy reasons.
Post reply on HN