Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Mozilla’s DNS over HTTPs

blog.mozilla.org

Post reply on HN
Print view View original

701–710 of 777 posts

Re: Mozilla’s DNS over HTTPs

#701

Post by comex »

Peepootoler wrote: post #692
lovelearning wrote: post #84

As a resident of a country whose government and ISPs heavily and habitually censor the Internet for political reasons, I for one truly appreciate Firefox's DoH. They should also enable 'network.security.esni.enabled' by default because the censors here have upgraded from DNS to SNI-based blocking. I get it that better solutions are possible, but got to teach people to first walk before teaching them to run. AFAIK, Ch…

Since they're apparently using Cloudflare, there will likely be censorship, too. It'll just be censorship that is deemed politically correct in the US / Western world, like cutting off sites like the Daily Stormer, 8chan etc. Cloudflare has already done that before.

> Cloudflare does not block or filter content through the Cloudflare Resolver for Firefox. As part of its agreement with Mozilla, Cloudflare is providing only direct DNS resolution. If Cloudflare were to receive written requests from law enforcement and government agencies to block access to domains or content through the Cloudflare resolver for Firefox, Cloudflare would, in consultation with Mozilla, exhaust our legal remedies before complying with such a request. We also commit to documenting any government request to block access in our semi-annual transparency report, unless legally prohibited from doing so.

https://developers.cloudflare.com/1.1.1.1/commitment-to-priv...

Re: Mozilla’s DNS over HTTPs

#702

Post by comex »

the8472 wrote: post #463
j0057 wrote: post #423

Earlier quoted context omitted.

SNI is not a good argument, there is work being done to encrypt that as well in TLS 1.3 with Encrypted SNI[1]. [1] https://blog.cloudflare.com/encrypted-sni/

ESNI only helps if you're fronting through things like cloudflare, again putting more eggs and information into a single basket and making them a more valuable target for TLAs.

True, centralization is a downside. But the alternative is having no privacy from government agencies. Even if you somehow believe your ISP won't be subject to these hypothetical interception orders that CloudFlare would be subject to (why?), there are plenty of points to tap in between your ISP and the website you're visiting.

Re: Mozilla’s DNS over HTTPs

#703

Post by syshum »

zamalek wrote: post #508
syshum wrote: post #468

Earlier quoted context omitted.

I dont use my ISP as my DNS provider, I have a custom setup using PiHole and other methods to provide secure DNS Resolution Firefox should not be forcing this shit on me, time to search for yet another browser that will respect users. Mozilla is clearly more interested in commercial viability via their partnerships with large corporations (like CloudFlare) then in protecting Users

The only way to solve the ISP DNS inspection problem is by one of: * Using DoH. For this to work with PiHole, you need to have a DoH resolver on the device, and then instruct the PiHole to recurse to that resolver instead - possibly your own in a VM somewhere? * Using a permanent encrypted VPN to your own machine in the cloud and routing all DNS through that, then recursing to some DNS that you trust. * Write your ow…

>>Anything else and your ISP/evil-state-actor is able to to see your DNS traffic in plain-text

and you believe CloudFlare is not a "evil state actor" or has not been compromised or never will be compromised by an "evil state actor"

Wow your faith in CloudFlare is much much higher than mine

Personally I trust my current ISP (which is not one of the big boys) more than I trust CloudFlare.

I do not trust cloudflare at all and believe they are the are one of the biggest threats to the future of open web there is today.

Re: Mozilla’s DNS over HTTPs

#704

Post by neop1x »

Will /etc/hosts still work? I was surprised it is ignored completely after DNS over HTTPS is enabled. I don't see why it can't first consult this standard local source regardless of DoH. This is making development more painful. Similarly to how Android stopped supporting locally-installed custom CA certificates globally for all apps, making HTTPS debugging impossible. :(

Re: Mozilla’s DNS over HTTPs

#705

Post by belorn »

_8j50 wrote: post #449
nullc wrote: post #289

I'm so sad to see Mozilla move forward with this massive attack on user privacy. Firefox DoH is snake oil, plain and simple. It sends all the users DNS queries to Cloudflare, adding a new party which can surveil the user's traffic (and can be legally compelled to do so and not disclose this fact)-- providing a convenient choke point to save spies and hackers the trouble and exposure of extracting the data from tens o…

Your ISP is literally selling this information right now in the US. What are you even talking about? Use google if you don't like CF, or just disable it! Do a little threat modeling here please. Let's say CF sells this data, what do they know about you other than your IP and the sites you visit? While your ISP,employer,school,etc... Can tie that activity to you as a person. Being compelled legally? I did not know pri…

> Do a little threat modeling here please

Yes, lets do some threat modeling. In the first model we have the ISP that host a DNS resolver. The traffic goes from the client to the server hosted by the ISP.

In the second model we have a CDN that host a DNS resolver. Where is the CDN hosted? At the ISP. The traffic goes from the client to the server hosted by the ISP.

How has the threat model changed? The CDN has a contract between it and the ISP, and legally this should mean that the ISP have no legal right to look in the server that they host and copy the information.

For law enforcement this should change nothing. I don't expect the CDN contract with the ISP to radically limit the secret police, nor the regular police, or even the courts ability to demand censoring of websites. The last part might however generate some court cases and thus delays before things return to the same situation we have today.

Re: Mozilla’s DNS over HTTPs

#706

Post by comex »

alwillis wrote: post #263

The underlying issue is that a DoH provider can craft the DNS answers individual users get if it wants to. Think about it: a Firefox DoH user could get different DNS answers than other apps get on the same machine using standard DNS on port 53, if Google or Cloudflare wanted to, because they’re essentially talking to different versions of the internet. Remember, all of the properties that allows HTTPS to be trackable…

> Cloudflare does not block or filter content through the Cloudflare Resolver for Firefox. As part of its agreement with Mozilla, Cloudflare is providing only direct DNS resolution. If Cloudflare were to receive written requests from law enforcement and government agencies to block access to domains or content through the Cloudflare resolver for Firefox, Cloudflare would, in consultation with Mozilla, exhaust our legal remedies before complying with such a request. We also commit to documenting any government request to block access in our semi-annual transparency report, unless legally prohibited from doing so. https://developers.cloudflare.com/1.1.1.1/commitment-to-priv....

Re: Mozilla’s DNS over HTTPs

#707

Post by lagadu »

irrational wrote: post #456
mooman219 wrote: post #426

Earlier quoted context omitted.

If I sit any family member down in front of this comment, their eyes would glaze over. Not only is what you mention a PITA, it's impossible for most people.

I'm a programmer and I have no idea what OPs comment means. I keep meaning to learn about networking stuff, but there is always so many other things to learn and since I don't work with devops or networking stuff it hasn't really been a priority.

Fire up a Linux VM and check out the named howto. Not only will you learn a lot about dns, you'll have a working server by the end of it.

Re: Mozilla’s DNS over HTTPs

#708

Post by cmroanirgo »

swiley wrote: post #523
irrational wrote: post #456

Earlier quoted context omitted.

I'm a programmer and I have no idea what OPs comment means. I keep meaning to learn about networking stuff, but there is always so many other things to learn and since I don't work with devops or networking stuff it hasn't really been a priority.

Most of that comment is Mozilla BS and not networking stuff. --Someone with a decent understanding of networking

Agreed. Just looked up about trr nonsense and found this 'setting':

> network.trr.excluded-domains

> Comma separated list of domain names to be resolved using the native resolver instead of TRR. Users may add domains they wish to exclude from TRR to this pref. This pref can be used to make /etc/hosts works with DNS over HTTPS in Firefox. Setting network.trr.excluded-domains to include host names from /etc/hosts will make them fall back to platform DNS, which will use the rules in /etc/hosts.

So, rather than using the hosts file, network admins & devs now have to specify 'special sauce' in FF too?

I'm not buying DoH for this reason alone, because it throws out a lot of legacy (albeit always regarded as hokey) for no good reason. If FFox is doing it's own DNS stuff is MUST (at least) do hosts file resolution, imho. Otherwise it leaks names, which kinda defeats one of the main the purposes of DoH: which is to maintain critical privacy in places where it's being abused.

Re: Mozilla’s DNS over HTTPs

#709

Post by unionpivo »

bad_user wrote: post #697
unionpivo wrote: post #690

Earlier quoted context omitted.

Unless you always use VPN, they can still do that, even with DOH. And if you use VPN, they can see your traffic. Personally I trust my ISP more than some random VPN provider on the net.

First of all we are not talking about the trustworthiness of VPNs, that's a separate discussion entirely. And no, I don't trust my ISP more than I trust my VPN, but I understand your mistrust as VPNs are indeed not so private as they are marketed. But imo this is throwing the baby with the bathwater. Go to Germany, download a movie either from the Pirate Bay or see one from one of the many illegal websites streaming…

Sure in that case makes sense to use VPN.

> I predict there will be plenty of privacy respecting services to choose from.

Why, where is the money in there ? Sure there might be some, but many ?

Call me cynic but I don't think google(one of the biggest public DNS servers atm) or clodflare(probably second biggest) are providing this service out of goodness of their harts.

If you worry about DNS that much, running your own is not that hard (I am running one at home* , and one at the place I work).

Re: Mozilla’s DNS over HTTPs

#710

Post by comex »

alwillis wrote: post #585
alwillis wrote: post #263

The underlying issue is that a DoH provider can craft the DNS answers individual users get if it wants to. Think about it: a Firefox DoH user could get different DNS answers than other apps get on the same machine using standard DNS on port 53, if Google or Cloudflare wanted to, because they’re essentially talking to different versions of the internet. Remember, all of the properties that allows HTTPS to be trackable…

I posted the article Centralised DoH is bad for Privacy, in 2019 and beyond to HN nearly a week ago [1]. Here’s the money quote: DNS over HTTPS however neatly separates out each device (and even each individual application on that device) to a separate query stream. This alone is worrying, as we now have individual users’ queries, but the TLS that underlies HTTPS also typically uses TLS Resumption which offers even f…

Yes, in the hypothetical case that some agency is compelling CloudFlare (and/or NextDNS) to provide ongoing real-time decryption, which would be somewhat unprecedented: not entirely dissimilar to things which have been publicly reported before, but not the same either. In the more likely case that that isn't happening, you make those agencies' lives a lot harder.
Post reply on HN