Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Mozilla’s DNS over HTTPs

blog.mozilla.org

Post reply on HN
Print view View original

761–770 of 777 posts

Re: Mozilla’s DNS over HTTPs

#761

Post by throw0101a »

_8j50 wrote: post #631
Marsymars wrote: post #613

Earlier quoted context omitted.

> Also, as someone in Canada, I downloaded the "English" version of Firefox, which probably meant "en_US" locale: guess what, I'm affected. As are plenty of less technical people who don't understand about going into about:config and changing things to "en_CA". The en-ca locale was only added to Firefox in September 2018, I think it's the default for any new downloads since then, but FF won't automatically change the…

Can't you just disable DoH?

> Can't you just disable DoH?

I'm just going to tell my mother in her 60s about editing about:conf settings.

This shouldn't be opt-out.

Re: Mozilla’s DNS over HTTPs

#762

Post by throw0101a »

ecnahc515 wrote: post #642
throw0101a wrote: post #486

Earlier quoted context omitted.

If anything hits port 53 on the outgoing gateway, and it's not from our recursive servers, then we know that network element needs to be looked at: either it's mis-configured or malicious. Anything that uses our recursive servers is monitored, and we can check against blacklists, either in real-time or after-the-fact through logging. * https://en.wikipedia.org/wiki/Domain_generation_algorithm * https://en.wikipedia.o…

Then your security strategy definitely needs improvements, since malware often uses hardcoded IPs to bypass DNS proxying/forwarding that corporate networks use. Seriously, this argument could be used to say we should be using HTTP instead of HTTPS, but anyone doing security knows if they really need that level of introspection they need to MITM HTTPS traffic with a MITM proxy. If you care that much, you also need to…

DNS sniffing takes care of a lot of low-hanging fruit.

Re: Mozilla’s DNS over HTTPs

#763

Post by johnisgood »

nullc wrote: post #668
johnisgood wrote: post #664

Earlier quoted context omitted.

> So, I don't think cloudflare has amassed much goodwill at all, and that's even before getting into how their 'protection' made much of the internet unusable behind tor or other anonymization proxies. Funnily enough Cloudflare supports DNS over Tor[1][2], and I think they are the only one. Please let me know if there are others! [1] https://developers.cloudflare.com/1.1.1.1/fun-stuff/dns-over... [2] https://blog.clo…

That's pretty cool!

Yeah, really hoping someone else will come along and give me alternatives though. Cloudflare is a bit iffy.

Re: Mozilla’s DNS over HTTPs

#764

Post by bscphil »

shawnz wrote: post #756
bscphil wrote: post #755

Earlier quoted context omitted.

Not Mozilla.

So in that situation, would Mozilla then be the good guys by adopting DoH and fixing the user's broken network level DNS? So basically whether Mozilla is doing the right thing or not here is entirely dependent on who the archive.is operators decide to target? What about all the services that will be fixed for users after Mozilla makes this change, due to poorly operated DNS from the provider?

Nah, the lesson is that users are going to blame you when you make low level arbitrary changes that break things when they're not capable of knowing about and fixing the technical problems that arise. The fact that a change might accidentally fix problems sometimes isn't a counter example to that general principle.

Re: Mozilla’s DNS over HTTPs

#765

Post by shawnz »

bscphil wrote: post #764
shawnz wrote: post #756

Earlier quoted context omitted.

So in that situation, would Mozilla then be the good guys by adopting DoH and fixing the user's broken network level DNS? So basically whether Mozilla is doing the right thing or not here is entirely dependent on who the archive.is operators decide to target? What about all the services that will be fixed for users after Mozilla makes this change, due to poorly operated DNS from the provider?

Nah, the lesson is that users are going to blame you when you make low level arbitrary changes that break things when they're not capable of knowing about and fixing the technical problems that arise. The fact that a change might accidentally fix problems sometimes isn't a counter example to that general principle.

Even when the possibility of things getting fixed is substantially more likely than the possibility of things getting broken?

By default Firefox will fall back to the network resolver if DoH can't get the results, so the only way that a situation like this could happen is if someone purposely sabotages the DoH results like with archive.is.

Furthermore, what you are saying could basically be used to rationalize putting any kind of potentially breaking change behind an off-by-default configurable. Do you think the web would be the sophisticated application platform it is today if browser vendors actually had that philosophy? Would that actually be better for John Doe, to make them have to learn about the technical aspects of every new web technology before they are able to take advantage of them?

Re: Mozilla’s DNS over HTTPs

#766

Post by corford »

tptacek wrote: post #731
corford wrote: post #720

Earlier quoted context omitted.

You're conflating privacy with trust. DNSSEC gives you trust, the VPN gives you "last mile" privacy. DoH is only designed for last mile so useless in encrypting the resolver chain between you and the root servers. Currently there is no way to get a fully encrypted chain (the root servers would need to support DoT or something similar and they don't nor are there any plans for them to do so afaik). So the best (form a…

DoH mitigates the "ISP selling your DNS data" threat, which practically everyone in the US faces, without forcing all your traffic onto a VPN, which not everyone wants. Meanwhile: practically no important zones are signed, so apart from the fact that DNSSEC does nothing to improve privacy, it's also not useful. DNSSEC is moribund; taking steps to enable it is a waste of time.

DoT would also mitigate it in a similar fashion. In both cases mitigate doesn't really have much meaning since, sans VPN, ISPs that are inclined to do so will quite happily continue to find ways to infer where you're browsing to (IP address and CT log correlation being the obvious choices). Ergo, if last mile privacy is you're issue, the best bet is a VPN or some improved regulation so that consumers have a choice if they want an ISP that doesn't spy on them.

Re: Mozilla’s DNS over HTTPs

#767

Post by troquerre »

paraselene_ wrote: post #725
troquerre wrote: post #698

Earlier quoted context omitted.

Cloudflare and Google's dns resolvers got a lot of adoption bc they provided a way for normal people to get around censorship, but they're inherently censorable bc they're run by centralized companies. There are new initiatives aiming to create a distributed dns layer which are promising like https://handshake.org .

And the distributed DNS layer will get censored soon enough if it gets traction. If you need proof, look at how TOR is doing in china.

Security is not binary, it's a spectrum based on cost. It's the same for censorship-resistance. If Handshake increases the cost of internet censorship for every country in the world, then it will have succeeded even if it's still possible for countries like China to censor it.

Re: Mozilla’s DNS over HTTPs

#768

Post by ric2b »

kzrdude wrote: post #568
fefe23 wrote: post #487

Earlier quoted context omitted.

Sorry for channeling the dude here but that is just, like your opinion man. I think many of the critical voices now are coming from the EU. We have data protection laws. The ISP can't just sell browsing data. That has been illegal since before we had data protection laws, that is actually legally the same as opening other people's letters and reading them. So ... different threat model over here. I am always using th…

> I am always using the US-EN Firefox version because frankly why would I use translated software when I can understand and use the original. This is maybe not the topic of discussion, but the argument is that your computer is your tool, and the computer should speak your language and adapt itself to you, and not the other way around. For this reason I like and prefer software that speaks my native language! However,…

But using my native language makes troubleshooting and following tutorials much harder.

Using English is the path of least resistance

Re: Mozilla’s DNS over HTTPs

#769

Post by corford »

zrm wrote: post #735
corford wrote: post #720

Earlier quoted context omitted.

You're conflating privacy with trust. DNSSEC gives you trust, the VPN gives you "last mile" privacy. DoH is only designed for last mile so useless in encrypting the resolver chain between you and the root servers. Currently there is no way to get a fully encrypted chain (the root servers would need to support DoT or something similar and they don't nor are there any plans for them to do so afaik). So the best (form a…

> You're conflating privacy with trust. Confidentiality and authentication are two different things, but the things that provide confidentiality here also provide authentication. DNSSEC only provides authentication, so then you need something else to provide confidentiality at every point in the path. At which point you would also have authentication at every point in the path, so what does that leave for DNSSEC to d…

DNSCurve sounds quite nice (I'm not at all familiar with it tbh). I agree something along those lines with DNSSEC for the last hop to the root would do it.

To be honest my main gripe is with DoH. For non-last-mile privacy/trust, there are indeed many suitable ways to tackle it.

Re: Mozilla’s DNS over HTTPs

#770

Post by corford »

tialaramex wrote: post #721
corford wrote: post #605

Earlier quoted context omitted.

Except, not really. If you're worried about DNS tampering, DNSSEC already exists all the way up to the root servers. If you're worried about ISPs snooping on what sites you visit, they'll continue to be able to do this even with widespread DoH/DoT and ESNI adoption. You still need to connect to an IP and TLS certs still have unique serials (most of which appear on public CT logs). Correlated over a large user populat…

> TLS certs still have unique serials In TLS 1.3 everything sent by the server, including its certificate, is encrypted. This is possible because of a re-ordering of considerations. It used to be that the conversation starts like this: Client: "Hi, I want to talk to Server?" Server: "Here's a certificate for Server, which is me" Client: [ "Secret is 123456" encrypted using the Public Key from the certificate for Serv…

This is very cool. Thanks for the great explanation!
Post reply on HN