Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Mozilla’s DNS over HTTPs

blog.mozilla.org

Post reply on HN
Print view View original

741–750 of 777 posts

Re: Mozilla’s DNS over HTTPs

#741

Post by tialaramex »

ignoramous wrote: post #723
tialaramex wrote: post #442

Earlier quoted context omitted.

If you configure a personal NextDNS URL as the DoH provider then unsurprisingly NextDNS will know that URL was used, and personalise things accordingly. If you use Firefox's defaults but pick NextDNS from the list, you don't get personalisation as NextDNS has no idea who you are. A nice thing about DoH here: For DNS over TLS NextDNS has to hide the configuration ID in the hostname, which as a result is revealed in SN…

> ...for DoH they can put it in the path and so it is encrypted like everything else. Wait: You mean to say URLs are encrypted? I thought not. There must be a reason why GET requests aren't used for secret-sharing, for instance, as opposed to POST. What am I missing?

An HTTPS URL has several parts, let's look at them in turn from left to right of a URL https://userinfo@someserver.example:1234/foo/search?term=goo...

The scheme will always be HTTPS and that isn't sent anywhere but it's implied.

The userinfo (often empty) is encrypted and delivered to the server. This could be login credentials but in the modern web it's largely unused.

The hostname someserver.example is delivered to the server unencrypted using SNI (Server Name Indication) before encryption switches on. This is used to enable virtual hosting - the server may behave differently depending on which name you want. The Encrypted SNI work (eSNI) at the TLS Working Group intends to standardise a way to encrypt this information - note that if your IP address only serves one single web site the hostname doesn't give much extra away so eSNI is mostly interested to bulk hosts, the cloud and so on.

The port 1234 is not delivered anywhere but it's implied since the connection will use this TCP port.

The path /foo/search is encrypted, this is the part NextDNS uses to distinguish one customer from another if you use their custom URLs rather than the built-in default in Firefox.

The query parameters ?term=goose are encrypted

The fragment identifier #egg is not sent to the server this is used only locally in the browser engine itself.

The reason you shouldn't design web sites to use GET for secrets is that URL ends up in the user's URL bar and gets bookmarked or shared with friends.

Re: Mozilla’s DNS over HTTPs

#742

Post by teknopaul »

cmroanirgo wrote: post #708
swiley wrote: post #523

Earlier quoted context omitted.

Most of that comment is Mozilla BS and not networking stuff. --Someone with a decent understanding of networking

Agreed. Just looked up about trr nonsense and found this 'setting': > network.trr.excluded-domains > Comma separated list of domain names to be resolved using the native resolver instead of TRR. Users may add domains they wish to exclude from TRR to this pref. This pref can be used to make /etc/hosts works with DNS over HTTPS in Firefox. Setting network.trr.excluded-domains to include host names from /etc/hosts will…

This is so true. FireFox is terrible at spaffing private info at search engines.

Breaking DNS is madness IMHO. Its just more sites that dont work on FF.

Broken is not more secure, its just broken.

Re: Mozilla’s DNS over HTTPs

#743

Post by teknopaul »

Polylactic_acid wrote: post #647
vetinari wrote: post #148

Earlier quoted context omitted.

Chrome uses opportunistic DoT - it uses your system configured resolver, and if it supports DoT, it will use DoT, if not, it will fall back to 53/udp. I like Chrome's approach much better; it doesn't force you to statically configure DNS server - it is a PITA, especially when roamining and you want to resolve hostnames available only in local networks.

Firefox has no issues with local domains and DoH. It makes a DoH request first and when that returns nothing it tries regular DNS.

That is an issue.

Apart from the wait.

Spaff hostnames to cloudflare, fail, then try harder.

Users expect

hosts: files,dns

Admins expect dns to work.

FireFox should not be fscking with network config.

If they do, they should try not to break users first.

Firefox is borken. Security is not improved. My DNS requests never leave the LAN.

Re: Mozilla’s DNS over HTTPs

#744

Post by Polylactic_acid »

teknopaul wrote: post #743
Polylactic_acid wrote: post #647

Earlier quoted context omitted.

Firefox has no issues with local domains and DoH. It makes a DoH request first and when that returns nothing it tries regular DNS.

That is an issue. Apart from the wait. Spaff hostnames to cloudflare, fail, then try harder. Users expect hosts: files,dns Admins expect dns to work. FireFox should not be fscking with network config. If they do, they should try not to break users first. Firefox is borken. Security is not improved. My DNS requests never leave the LAN.

Half of your comment doesn't make any sense but for the rest of it, its just incorrect. The change in firefox hasn't broken anything, security is certainly improved in combination with other efforts like encrypted SNI. And yes, your dns requests always leave your lan at least once. You can run your own DNS server locally but that dns server has to ask other servers for the data since it can't store a local copy of the entire dns system. A local dns server is just a cache but with a few users its likely not doing any more than your browser cache.

Re: Mozilla’s DNS over HTTPs

#745

Post by ignoramous »

tialaramex wrote: post #741
ignoramous wrote: post #723

Earlier quoted context omitted.

> ...for DoH they can put it in the path and so it is encrypted like everything else. Wait: You mean to say URLs are encrypted? I thought not. There must be a reason why GET requests aren't used for secret-sharing, for instance, as opposed to POST. What am I missing?

An HTTPS URL has several parts, let's look at them in turn from left to right of a URL https://userinfo@someserver.example:1234/foo/search?term=goo... The scheme will always be HTTPS and that isn't sent anywhere but it's implied. The userinfo (often empty) is encrypted and delivered to the server. This could be login credentials but in the modern web it's largely unused. The hostname someserver.example is delivered t…

Thanks for the detailed reply. Appreciate it.

Re: Mozilla’s DNS over HTTPs

#746

Post by coribuci »

belorn wrote: post #711
dheera wrote: post #443

Earlier quoted context omitted.

I wonder what the implications will be for TCP-over-DNS, which besides bypassing firewalls, can also provide anonymity in a different way.

TCP-over-DNS, together with the draft RFC for encrypted resolver to authoritative communication, altolows for more end-to-end style encryption. Clients could do their own secure resolving without relying on a central service.

> Clients could do their own secure resolving without relying on a central service.

So in other words: privilege escalation.

Re: Mozilla’s DNS over HTTPs

#747

Post by coribuci »

_jal wrote: post #623
fefe23 wrote: post #487

Earlier quoted context omitted.

Sorry for channeling the dude here but that is just, like your opinion man. I think many of the critical voices now are coming from the EU. We have data protection laws. The ISP can't just sell browsing data. That has been illegal since before we had data protection laws, that is actually legally the same as opening other people's letters and reading them. So ... different threat model over here. I am always using th…

No, it is not an opinion. It is technically accurate, but may not be relevant to your particular situation. Firefox is used outside of the EU. Speaking of which... > I am always using the US-EN Firefox version Wait, so you want the US version of Firefox to be tuned to EU legal policy?

> > I am always using the US-EN Firefox version

> Wait, so you want the US version of Firefox to be tuned to EU legal policy?

It is not the US version. It's the US language version - or at least that's how they market it.

Re: Mozilla’s DNS over HTTPs

#748

Post by coribuci »

afiori wrote: post #695
kzrdude wrote: post #568

Earlier quoted context omitted.

> I am always using the US-EN Firefox version because frankly why would I use translated software when I can understand and use the original. This is maybe not the topic of discussion, but the argument is that your computer is your tool, and the computer should speak your language and adapt itself to you, and not the other way around. For this reason I like and prefer software that speaks my native language! However,…

From my point of view translated software often just means that googling errors is harder

It's worse than that. Some words did not exist in the target language (the computers are relatively new compared to the age of the language) so they had to be created. Nothing is more annoying than to search for words which make no sense.

Re: Mozilla’s DNS over HTTPs

#749

Post by coribuci »

growse wrote: post #597
foresto wrote: post #593

Earlier quoted context omitted.

> Your ISP is literally selling this information right now No, mine is not. > Use google if you don't like CF Google is no better. > or just disable it! It is never okay to hijack my DNS lookups. Posting a note someplace about how it can be restored does not change the fact that you hijacked it, and does not make it okay. > This is not adding a new party that can surveil you Given that the DoH provider is a new party…

They're not doing it in secret. Use a different browser if you don't like it, or fork it. Mozilla have made a value judgement that DoH is more useful to end users than the supposed privacy loss. You're free to disagree, but neither of you is objectively correct .

> They're not doing it in secret. Use a different browser if you don't like it, or fork it. They are not doing it in plain sight either.

> Mozilla have made a value judgement that DoH is more useful to end users than the supposed privacy loss. You're free to disagree, but neither of you is objectively correct. Mozilla made a lot of "value judgement" lately just like Chrome. That's why i try to switch to seamonkey.

Re: Mozilla’s DNS over HTTPs

#750

Post by coribuci »

belorn wrote: post #705
_8j50 wrote: post #449

Earlier quoted context omitted.

Your ISP is literally selling this information right now in the US. What are you even talking about? Use google if you don't like CF, or just disable it! Do a little threat modeling here please. Let's say CF sells this data, what do they know about you other than your IP and the sites you visit? While your ISP,employer,school,etc... Can tie that activity to you as a person. Being compelled legally? I did not know pri…

> Do a little threat modeling here please Yes, lets do some threat modeling. In the first model we have the ISP that host a DNS resolver. The traffic goes from the client to the server hosted by the ISP. In the second model we have a CDN that host a DNS resolver. Where is the CDN hosted? At the ISP. The traffic goes from the client to the server hosted by the ISP. How has the threat model changed? The CDN has a contr…

> > Do a little threat modeling here please

> Yes, lets do some threat modeling. In the first model we have the ISP that host a DNS resolver. The traffic goes from the client to the server hosted by the ISP.

> In the second model we have a CDN that host a DNS resolver. Where is the CDN hosted? At the ISP. The traffic goes from the client to the server hosted by the ISP.

hosts : files,dns Damn it. When the bloody browser bypasses the OS then it is really a big problem.

Post reply on HN