Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Mozilla’s DNS over HTTPs

blog.mozilla.org

Post reply on HN
Print view View original

641–650 of 777 posts

Re: Mozilla’s DNS over HTTPs

#641

Post by nullc »

djsumdog wrote: post #551
nullc wrote: post #530

Earlier quoted context omitted.

"Legally" is dubious. Intercepting any private wire communication is a clear violation of federal law (e.g. 18 U.S. Code § 2511), and a violation of the law in many states (e.g. CA PC 631). Unfortunately, the US government is one of the larger users of ISP surveillance activities, benefiting through the purchase of private data as well as using administrative subpoena to obtain the data collected by ISPs without due…

Are you sure about that? This passed in 2017 and I don't think it's been reversed: http://clerk.house.gov/evs/2017/roll202.xml

Hm. FCC getting a ruling overturned that strengthens the law doesn't change the existing law, however.

Re: Mozilla’s DNS over HTTPs

#642

Post by ecnahc515 »

throw0101a wrote: post #486
JoshTriplett wrote: post #239

Earlier quoted context omitted.

So you're counting on malware's continued use of plaintext DNS as part of your network's security strategy?

If anything hits port 53 on the outgoing gateway, and it's not from our recursive servers, then we know that network element needs to be looked at: either it's mis-configured or malicious. Anything that uses our recursive servers is monitored, and we can check against blacklists, either in real-time or after-the-fact through logging. * https://en.wikipedia.org/wiki/Domain_generation_algorithm * https://en.wikipedia.o…

Then your security strategy definitely needs improvements, since malware often uses hardcoded IPs to bypass DNS proxying/forwarding that corporate networks use. Seriously, this argument could be used to say we should be using HTTP instead of HTTPS, but anyone doing security knows if they really need that level of introspection they need to MITM HTTPS traffic with a MITM proxy. If you care that much, you also need to MITM DoH/DoT traffic.

Re: Mozilla’s DNS over HTTPs

#643

Post by nullc »

WorldMaker wrote: post #572
nullc wrote: post #547

Earlier quoted context omitted.

> you should be able to find the Firefox settings on your devices to disable DoH, You should be able to find a buried config option to regain your privacy is _not_ a position that we should consider acceptable! There are serious logistical challenges keeping the option off even at a household level. At the moment it isn't difficult to block at the network level, but presumably they'll start evading those blocks event…

Mozilla seems to have made it clear that where DoH is on by default the config option won't be "buried", particularly because out of the box multiple options will be provided (both Cloudflare and NextDNS). That you see it as "regain" says we probably have different threat models/assessments here, I'm not sure I can help you much further with the paranoia associated with your current threat model.

Paranoia? What exactly is paranoid about being concerned about the browser sending all firefox users traffic for an entire nation to a single party which has the technical ability to monitor all this traffic and under which current norms have essentially zero protection under the law?

Surveillance at large providers is an unambiguous fact, centralizing all user's traffic at one makes it tremendously easier.

The majority of US broadband users are on comcast, which as reported-- in spite of stinking in many respects has made similar public commitments to cloudflare to not monetize this data.

I think you likely have it reversed which threat model is more fringe and which is more concerning.

Re: Mozilla’s DNS over HTTPs

#644

Post by nullc »

growse wrote: post #603
nullc wrote: post #390

Earlier quoted context omitted.

Your ISP, however, is not prevented from collecting and selling your data by DoH. So the addition of default DoH in cloudflare adds an extra party that can intercept your traffic but does not remove any. > DoH seems like a huge step forward in ensuring that no unencrypted traffic is visible to the ISP or local network It does not do this.

DNS traffic is a much richer and more valuable resource than a simple list of IP sessions. Yes, of course your ISP can see who you're connecting to and sell that, but denying them (and anyone else) the ability to collect all DNS traffic is better than not denying that.

DoH is significantly richer than DNS itself because of session reuse.

DNS is cached, other than potential ambiguity related to shared hosts (which can be resolved by looking at SNI)-- I'm failing to see how DNS is richer than the traffic itself. Less costly to monitor? Sure.

Re: Mozilla’s DNS over HTTPs

#645

Post by Pyxl101 »

_8j50 wrote: post #625
dang wrote: post #491

Earlier quoted context omitted.

> What are you even talking about? Can you please edit swipes like that out of your comments when posting to HN? They break the site guidelines and provoke others into doing worse. https://news.ycombinator.com/newsguidelines.html

I don't get how that's a swipe, it is not a rhetorical question, my intent there is to literally ask what he's talking about given the arguments made. I did not attack the commenter personally,"brigade" or an ad-hominem argument. I think you might be misunderstandig our conversation here, this being a text medium it is hard to comminicate tone and body language. It's not uncommon for me to say a phrase like in techni…

A polite way to say this would be "Can you clarify what your concern is?" or "Can you clarify what you're referring to?". The original phrase drips with disdain. If that's not the intended sentiment, then well, that's a challenge of conveying emotions in text. You could always include an emoji to better convey the meaning :-)

Some phrases come with a built-in sentiment that people will assume exists unless it's overridden.

Re: Mozilla’s DNS over HTTPs

#646

Post by nullc »

freeAgent wrote: post #610
sneak wrote: post #540

Earlier quoted context omitted.

> Firefox DoH is snake oil, plain and simple. This is not an accurate statement, for the commonly accepted definition of "snake oil". Your privacy concerns are, from an angle, legitimate (although encrypted protocols, as a general rule, are more private than plaintext protocols), but this is a bit over the top. TFA also mentions that they are partnering with NextDNS, so your claims about centralization are on shaky g…

I think his point is about the default behavior pointing to Cloudflare. Unless the user changes the DNS provider setting, everyone will be on Cloudflare. With that said, I think this is pretty over-the-top. Part of the reason Cloudflare is the default (and NextDNS is an option) is because they are abiding by Mozilla's Trusted Recursive Resolver policy: https://wiki.mozilla.org/Security/DOH-resolver-policy The only wa…

The mozilla policy allows cloudflare to permanently store and exploit per-domain-name but not per user data. So even going by the letter of the policy and considering cloudflare alone there is still a privacy loss.

Moreover, the current legal standard in the US is that users have no expectation of privacy for data that third parties have stored about their activity. As a result there is potentially limited to no due process protection for user information in this scheme. Cloudflare could be required to turn the information over via an administrative subpoena and without the oversight of even a court or any ability for the impacted users to learn about or challenge the surveillance.

> I will say that I trust Cloudflare a whole heckuva lot more than I trust Comcast, Charter, AT&T, Verizon, etc. to be practicing good security

Than any one of them? I could imagine that. Than all? Cloudflare is a much bigger target.

> I see this decentralizing DNS request data.

Could you elaborate on that? I see this as massively centralizing DNS request data (onto cloudflare) and this change is the most problematic part of the whole thing.

Re: Mozilla’s DNS over HTTPs

#647

Post by Polylactic_acid »

vetinari wrote: post #148
lovelearning wrote: post #84

As a resident of a country whose government and ISPs heavily and habitually censor the Internet for political reasons, I for one truly appreciate Firefox's DoH. They should also enable 'network.security.esni.enabled' by default because the censors here have upgraded from DNS to SNI-based blocking. I get it that better solutions are possible, but got to teach people to first walk before teaching them to run. AFAIK, Ch…

Chrome uses opportunistic DoT - it uses your system configured resolver, and if it supports DoT, it will use DoT, if not, it will fall back to 53/udp. I like Chrome's approach much better; it doesn't force you to statically configure DNS server - it is a PITA, especially when roamining and you want to resolve hostnames available only in local networks.

Firefox has no issues with local domains and DoH. It makes a DoH request first and when that returns nothing it tries regular DNS.

Re: Mozilla’s DNS over HTTPs

#648

Post by Polylactic_acid »

stjohnswarts wrote: post #195
lovelearning wrote: post #84

As a resident of a country whose government and ISPs heavily and habitually censor the Internet for political reasons, I for one truly appreciate Firefox's DoH. They should also enable 'network.security.esni.enabled' by default because the censors here have upgraded from DNS to SNI-based blocking. I get it that better solutions are possible, but got to teach people to first walk before teaching them to run. AFAIK, Ch…

I'm surprised that they wouldn't block the DNS providers in your country though?

Won't help if cloudflare sticks the resolver on the same IP range as regular cloudflare sites. Countries would have to choose to block most of the internet.

Re: Mozilla’s DNS over HTTPs

#649

Post by nullc »

gshulegaard wrote: post #584
dang wrote: post #491

Earlier quoted context omitted.

> What are you even talking about? Can you please edit swipes like that out of your comments when posting to HN? They break the site guidelines and provoke others into doing worse. https://news.ycombinator.com/newsguidelines.html

I think it's a good call out to keep in mind the guidelines, but technically the original comment also breaks guidelines. Two wrongs don't make a right, but I would suggest trying to avoid the appearance of personal bias when calling out guidelines infractions on a comment without also calling out infractions within the context equally.

It wasn't my intention to make an inflammatory comment.

My statement was strongly worded, but it is my informed opinion as a subject matter expert: As someone who worked in ISP networking for over a decade, worked at Mozilla, and work on network protocol, I feel that I'm entitled to have a strongly stated opinion and I believe I substantiated it in my post. I'm also happy to have a polite discussion justifying it further.

Re: Mozilla’s DNS over HTTPs

#650

Post by gonational »

I’m gonna get some heat for this, but that’s OK; it’s my honest opinion.

I can’t really think of a better way to hamper progress on an open specification then by delegating the problem to some private corporation; especially one that has a penchant for censorship.

If more than .0003% of people actually used Firefox, we would have to worry about Cloudflare taking over the entire Internet. So it’s probably a good thing Mozilla ruined their brand over the past decade.

I would be willing to bet money that Mozilla is getting paid millions of dollars by Cloudflare for this.

In the meantime, this is the final straw for me. I’m done with Firefox for life. I haven’t used anything but Firefox since 2007... 13 years...

Post reply on HN