Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Mozilla’s DNS over HTTPs

blog.mozilla.org

Post reply on HN
Print view View original

651–660 of 777 posts

Re: Mozilla’s DNS over HTTPs

#651

Post by jlgaddis »

nullc wrote: post #453
kbenson wrote: post #444

Earlier quoted context omitted.

Mozilla has previously noted that Cloudfare is contractually obligated to keep the traffic private and not monetize or share it. That's not perfect, but without a law requiring it that's about the best you can get in the U.S. (assuming the contract has teeth in the penalties it imposes).

I'd be willing to accept a lien on the homes of the senior cloudflare and mozilla executives with a contract that will forfeit the value of their homes and allow me to sell them and donate the funds to charity, should it be demonstrated that Firefox-Cloudflare DoH is being used to surveil users. There are many things that could be done. The problem is that the promises they make sound grand but aren't real, they woul…

That would certainly give a new meaning to "we take security seriously" -- one I would also love to see!

Re: Mozilla’s DNS over HTTPs

#652

Post by alwillis »

growse wrote: post #607
alwillis wrote: post #592

Earlier quoted context omitted.

DNS over TSL (DoT) is a much better alternative to DoH, at least when it comes to the ability to be tracked. For example, because it’s not using HTTP, there are no cookies or SNI to worry about. More at https://news.ycombinator.com/item?id=22418005 .

> DNS over TSL (DoT) is a much better alternative to DoH, at least when it comes to the ability to be tracked. > For example, because it’s not using HTTP, there are no cookies or SNI to worry about. > More at https://news.ycombinator.com/item?id=22418005 . The fact that it can be trivially blocked by anyone on the network path does not make it "much better".

The fact that it can be trivially blocked by anyone on the network path does not make it "much better".

Of course anyone on the "network path" can block almost any protocol; DoT isn’t unique in that regard.

The concern is many large businesses block port 853 but that's because prior to the development of DoT, there was no reason for IT departments to configure firewalls to enable it. Most organizations only have a handful of ports available, including 443, which is what HTTPS uses and therefore DoH works as a result.

I've been running DNS over TLS using the Unbound [1] resolver for my home LAN on a spare laptop for a few weeks now and it’s been great.

Given the privacy trade-offs between privacy and security, many IT departments would opt to make port 853 available for DoT rather than increasing the ability for their users to be tracked.

As I mentioned elsewhere in this thread, the article Centralised DoH is bad for Privacy, in 2019 and beyond [2] clearly describes the issues with DoH:

DNS over HTTPS opens up DNS to all the tracking possibilities present in HTTPS and TLS. As it stands, DNS over UDP almost always gets some free privacy by mixing all devices on a network together – an outside snooper sees a stream of queries coming from a household, a coffeeshop or even an entire office building, with no way to tie a query to any specific device or user. Such mixing of queries provides an imperfect but useful modicum of privacy.

DNS over HTTPS however neatly separates out each device (and even each individual application on that device) to a separate query stream. This alone is worrying, as we now have individual users’ queries, but the TLS that underlies HTTPS also typically uses TLS Resumption which offers even further tracking capabilities.

[1]: https://www.ctrl.blog/entry/unbound-tls-forwarding.html

[2]: https://labs.ripe.net/Members/bert_hubert/centralised-doh-is...

Re: Mozilla’s DNS over HTTPs

#653

Post by sp332 »

alwillis wrote: post #544
sp332 wrote: post #410

Earlier quoted context omitted.

What DoH implementation sends cookies?

They all can; that’s built in to HTTPS. Whether they will, we’ll have to wait and see.

Normal DNS over UDP can also contain arbitrary data, which completely hypothetcally could be used to send identifying data about the client. E.g. https://unit42.paloaltonetworks.com/dns-tunneling-how-dns-ca... But that's not really a strike against the protocol, that would be a fault of the implementation.

Re: Mozilla’s DNS over HTTPs

#654

Post by mantap »

gsich wrote: post #334
mantap wrote: post #116

Earlier quoted context omitted.

That doesn't work anymore. ISPs are not going to block AWS IP ranges or Azure IP ranges, etc. The cloud killed IP blocking. The pirate bay is supposed to be blocked in UK by court order , but because they use cloudflare it's still accessible and only DNS blocked.

Blocking wasn't the point in the post above.

Okay fair but they are two sides of the same coin. Blocking is active snooping. If an ISP knows what site you are visiting they can block the connection. In both cases the way to prevent it is to extinguish privacy leaks.

Re: Mozilla’s DNS over HTTPs

#655

Post by all_blue_chucks »

vetinari wrote: post #148
lovelearning wrote: post #84

As a resident of a country whose government and ISPs heavily and habitually censor the Internet for political reasons, I for one truly appreciate Firefox's DoH. They should also enable 'network.security.esni.enabled' by default because the censors here have upgraded from DNS to SNI-based blocking. I get it that better solutions are possible, but got to teach people to first walk before teaching them to run. AFAIK, Ch…

Chrome uses opportunistic DoT - it uses your system configured resolver, and if it supports DoT, it will use DoT, if not, it will fall back to 53/udp. I like Chrome's approach much better; it doesn't force you to statically configure DNS server - it is a PITA, especially when roamining and you want to resolve hostnames available only in local networks.

Opportunistic security that can be disabled by attackers is not really security.

Re: Mozilla’s DNS over HTTPs

#656

Post by dang »

_8j50 wrote: post #628
dang wrote: post #614

Earlier quoted context omitted.

I don't see how the GP comment broke the site guidelines. "Snake oil" is close to name-calling, but I don't think it's really over the line, and if we started moderating HN comments for that kind of thing, there would be a huge backlash from the community. Is there something else that I missed? These things are matters of degree in any case, and "what are you even talking about" is clear cut.

Person a: I like the blue stuff in oranges Person b: what are you even talking about? Oranges do not have a blue inside. Now what is a swipe about this or breaking a guidline. It did give the impression ( to me at least) as if I was being picked on. But I think in reality you probably misunderstood the tone and intent. Of course this is just my opinion, what you say is the law here and I intend to abide.

I believe you, but intent unfortunately doesn't communicate itself well in internet forums, so the burden is on the commenter to disambiguate.

https://hn.algolia.com/?dateRange=all&page=0&prefix=false&qu...

In this case the phrase was one that commonly communicates dismissiveness, which is why I interpreted you the way I did. If you read the guidelines it's clear that (to take your example) such a reply can be shortened to "Oranges do not have a blue inside".

However: no harm done! I appreciate your reply and your intention.

Re: Mozilla’s DNS over HTTPs

#657

Post by 6510 »

nullc wrote: post #312
6510 wrote: post #299

How will courts blocking domains work after this?

Much more effectively: A single party to issue an order to instead of a great number.

My ISP was ordered to block the pirate bay and its mirrors. I just enabled DNS over https and I'm able to access it again.

Re: Mozilla’s DNS over HTTPs

#658

Post by alwillis »

zamalek wrote: post #616
alwillis wrote: post #592

Earlier quoted context omitted.

DNS over TSL (DoT) is a much better alternative to DoH, at least when it comes to the ability to be tracked. For example, because it’s not using HTTP, there are no cookies or SNI to worry about. More at https://news.ycombinator.com/item?id=22418005 .

DoT only solves the SNI problem during the DNS request itself. It doesn't do a thing about the SNI during the request to the actual website, which is where all the privacy concerns are.

DoT only solves the SNI problem during the DNS request itself. It doesn't do a thing about the SNI during the request to the actual website, which is where all the privacy concerns are.

Sure, but until we have encrypted SNI, which is in draft, meta data is going to leak, but that's a separate issue from either DoT or DoH.

But because DoT doesn't use HTTPS, you don't get some of its downsides like using cookies for tracking, for example.

Re: Mozilla’s DNS over HTTPs

#659

Post by sgentle »

_8j50 wrote: post #625
dang wrote: post #491

Earlier quoted context omitted.

> What are you even talking about? Can you please edit swipes like that out of your comments when posting to HN? They break the site guidelines and provoke others into doing worse. https://news.ycombinator.com/newsguidelines.html

I don't get how that's a swipe, it is not a rhetorical question, my intent there is to literally ask what he's talking about given the arguments made. I did not attack the commenter personally,"brigade" or an ad-hominem argument. I think you might be misunderstandig our conversation here, this being a text medium it is hard to comminicate tone and body language. It's not uncommon for me to say a phrase like in techni…

It's easy to get hung up on specific words, so it might be easier to consider meanings. What is the meaning of the phrase "What are you even talking about?" Is it a question? If so, what answer were you hoping for?

If I take you at your word that it's not rhetorical, then I could replace your question with "what do you mean?" – however, if you don't know what the poster means, why does the rest of the comment continue as if you understood them perfectly?

The more plausible interpretation of "what are you even talking about?" is "you are spouting nonsense". Yes, your wording is more polite, but the meaning is the same. The only way a polite insult isn't an insult is if you assume the person you're insulting doesn't understand it. Kinda makes it two insults, really.

All discourse is interpersonal, and how you disagree with someone's statements has interpersonal implications. I think your argument misses the point. I also think your argument is disingenuous and avoids engaging with substance in order to project misunderstanding onto the person trying to help you.

Both of those are opinions about your statements. Which do you think best exemplifies the following?

> Be kind. Don't be snarky. Comments should get more thoughtful and substantive, not less, as a topic gets more divisive. Have curious conversation; don't cross-examine.

Re: Mozilla’s DNS over HTTPs

#660

Post by basilgohar »

nullc wrote: post #455
geophertz wrote: post #399

Earlier quoted context omitted.

Unfortunately it's not so easy to black hole `use-application-dns.net` for parental control. (people don't run their own DNS server).

FWIW, I've found that running a local unbound server with moderately aggressive caching makes a visible improvement in browsing speed. For us technical folks, it worth doing for the speed up even without getting into the configurability/privacy implications.

I have had the exact same experience. It's one of the first things I verify whenever I connect from a new location – are my queries being resolved by my local unbound or not.
Post reply on HN