Live data from Hacker News

Mozilla’s DNS over HTTPs

blog.mozilla.org

751–760 of 777 posts

Re: Mozilla’s DNS over HTTPs

#751
post #537
post #522

Earlier quoted context omitted.

Your ISP can still see the IPs that you are talking to... What are you talking about? They can even see the url even if you dont use them as your DNS

> They can even see the url Only for plaintext http. For ssl/https - the hostname/ip can leak with SNI, but should be safe with ESNI (encrypted SNI). The URL should be in the request, which comes after the TLS handshake (hence SNI, so that the server can pick a certificate before knowing the HTTP HOST header). SNI is a problem - but not much worse than the fact that a mitm can see who talks to who (IP) - IMNHO.

so we agree the ESNI is not in used?

Re: Mozilla’s DNS over HTTPs

#752
post #597

Earlier quoted context omitted.

> Your ISP is literally selling this information right now No, mine is not. > Use google if you don't like CF Google is no better. > or just disable it! It is never okay to hijack my DNS lookups. Posting a note someplace about how it can be restored does not change the fact that you hijacked it, and does not make it okay. > This is not adding a new party that can surveil you Given that the DoH provider is a new party…

They're not doing it in secret. Use a different browser if you don't like it, or fork it. Mozilla have made a value judgement that DoH is more useful to end users than the supposed privacy loss. You're free to disagree, but neither of you is objectively correct .

IMHO Mozilla have made a bad call justified by misguided security.

People _are_ using a different browser.

People _have_ forked, (mostly webkit based)

When everyone has stopped using FireFox, will Mozilla conclude that the Internet is finally secure?

If we see an uptick in Firefox usage we can presume Mozilla's value judgement was correct.

Re: Mozilla’s DNS over HTTPs

#753
post #703

Earlier quoted context omitted.

The only way to solve the ISP DNS inspection problem is by one of: * Using DoH. For this to work with PiHole, you need to have a DoH resolver on the device, and then instruct the PiHole to recurse to that resolver instead - possibly your own in a VM somewhere? * Using a permanent encrypted VPN to your own machine in the cloud and routing all DNS through that, then recursing to some DNS that you trust. * Write your ow…

>>Anything else and your ISP/evil-state-actor is able to to see your DNS traffic in plain-text and you believe CloudFlare is not a "evil state actor" or has not been compromised or never will be compromised by an "evil state actor" Wow your faith in CloudFlare is much much higher than mine Personally I trust my current ISP (which is not one of the big boys) more than I trust CloudFlare. I do not trust cloudflare at a…

Cloudflare aren't the only people running a DoH endpoint

Re: Mozilla’s DNS over HTTPs

#754
post #624

Earlier quoted context omitted.

I think maybe you misunderstood what I'm asking. Why couldn't such a spy just hardcode their own DNS server IP address, rather than using your network provided DNS server? If the answer is that you'll blacklist the spy's DNS servers, then how is that any different than the situation with DoH? DoH isn't adding any value for the spy unless you are doing deep packet inspection of any packet that contains DNS data.

> If the answer is that you'll blacklist the spy's DNS servers, then how is that any different than the situation with DoH? There are two differences that DoH brings up about this. The first is that because mainstream DNS providers are beginning to support DoH, there is no need for anyone to set up their own private DNS server. In fact, they wouldn't want to -- much better to use a real one that can't be blocked with…

> The first is that because mainstream DNS providers are beginning to support DoH, there is no need for anyone to set up their own private DNS server.

That was already true though, because they could have used those mainstream providers' unencrypted DNS servers too.

> Sure it is. It effectively disables a layer of defenses from the spies.

But why would any spy rely on such a layer when you've left the front door (unencrypted DNS) wide open?

Re: Mozilla’s DNS over HTTPs

#755
post #737

Earlier quoted context omitted.

In general, yes, that solves the problem for local domains. But anyone who needs to do anything at all complicated is going to have trouble with this, not just Pi-Hole users. For example, take your average John Doe who uses Firefox. Not particularly technically competent. A new version of Firefox comes out, and all the Archive.is domains break. Who does he blame for that, and how does he solve the problem? What's hap…

And if it happened to be that Archive.is actually had a beef with John Doe's ISP, who's to blame for that default getting picked?

Not Mozilla.

Re: Mozilla’s DNS over HTTPs

#756
post #737

Earlier quoted context omitted.

And if it happened to be that Archive.is actually had a beef with John Doe's ISP, who's to blame for that default getting picked?

Not Mozilla.

So in that situation, would Mozilla then be the good guys by adopting DoH and fixing the user's broken network level DNS?

So basically whether Mozilla is doing the right thing or not here is entirely dependent on who the archive.is operators decide to target?

What about all the services that will be fixed for users after Mozilla makes this change, due to poorly operated DNS from the provider?

Re: Mozilla’s DNS over HTTPs

#757
One point I haven't seen covered yet is split-horizon DNS where there are actually servers listening on both sides of the horizon (though possibly different ones).

Example #1: I have a personal server running at home that is reachable from the internet through a PageKite tunnel. It's reachable through a public address of the form https://xyz.pagekite.me. The connection is secured by a Let's Encrypt certificate, which means I have to use this address to avoid HTTPS errors and the domain has to be reachable from the internet so I can fulfill challenges.

However, I'd also like to access the server from my LAN without an unnecessary round-trip through the internet: I might want to avoid unnecessary data costs or display certain content only available to LAN clients. So from the internet, the domain should resolve to the PageKite tunnel, but inside the LAN, the domain should resolve directly to the server's LAN address.

This is relatively easy to accomplish using traditional DNS: Just set up a local DNS server that serves the LAN address. However, how do you do that with DoH?

Example #2: You want to set up an internet router at home. The instructions ask you to connect to www.routerlogin.net to pull up the web interface. The domain is split-horizon: When requested through the router, it will resolve to the router's internal address and be served by the router's internal web server. When requested from the internet, it will point to a generic info page from the vendor.

Now with DoH, you'd always see the generic info page, even when connecting through the router.

Re: Mozilla’s DNS over HTTPs

#758
post #8

Earlier quoted context omitted.

And now they have a one-stop shop for all their DNS surveillance needs.

> And now they have a one-stop shop for all their DNS surveillance needs. There are a few dozens of DoH services out there [1] and nothing prevents anybody else from running their own. [1] https://github.com/curl/curl/wiki/DNS-over-HTTPS

There are dozens, and yet Mozilla chooses the same company that forces Google captcha on site visitors that try to protect their privacy by using a VPN or Tor?

Re: Mozilla’s DNS over HTTPs

#759
post #8

Earlier quoted context omitted.

And now they have a one-stop shop for all their DNS surveillance needs.

> And now they have a one-stop shop for all their DNS surveillance needs. There are a few dozens of DoH services out there [1] and nothing prevents anybody else from running their own. [1] https://github.com/curl/curl/wiki/DNS-over-HTTPS

How many of those "dozens" would you consider usable as a default for a browser?

Re: Mozilla’s DNS over HTTPs

#760
post #611

Earlier quoted context omitted.

mike@blob:~$ host 208.80.153.224 224.153.80.208.in-addr.arpa domain name pointer text-lb.codfw.wikimedia.org. mike@blob:~$ openssl s_client -connect 208.80.153.224:443 2>&1 | openssl x509 -text|grep Subject: Subject: C = US, ST = California, L = San Francisco, O = "Wikimedia Foundation, Inc.", CN = *.wikipedia.org Yeah, our ISPs are going to be totally in the dark thanks to DoH. /s

> mike@blob:~$ host 208.80.153.224 224.153.80.208.in-addr.arpa domain name pointer text-lb.codfw.wikimedia.org. mike@blob:~$ openssl s_client -connect 208.80.153.224:443 2>&1 | openssl x509 -text|grep Subject: Subject: C = US, ST = California, L = San Francisco, O = "Wikimedia Foundation, Inc.", CN = *.wikipedia.org Yeah, our ISPs are going to be totally in the dark thanks to DoH. /s minjiexin.com resolves to the sam…

> ... what's the user doing?

$ telnet minjiexin.com 80

Trying 208.80.153.224...

Connected to minjiexin.com.

Escape character is '^]'.

GET / HTTP/1.0

HTTP/1.1 400

[...]

Wikimedia Error

[...]

Big mystery.

Post reply on HN