Comcast, Mozilla strike privacy deal to encrypt DNS lookups in Firefox • Hacker News Board

Re: Comcast, Mozilla strike privacy deal to encrypt DNS lookups in Firefox

#11

Post by gruez » Thu, Jun 25, 2020, 2:44 PM UTC

>Comcast told Ars yesterday that "Firefox users on Xfinity should automatically default to Xfinity resolvers under Mozilla's Trusted Recursive Resolver program, unless they have manually chosen a different resolver, or if DoH is disabled.

How would this work? Is the detection done once, everytime firefox starts, or everytime the network changes? Would you ever get into a situation where you're not using comcast, but are still using comcast dns? eg. you have VPN enabled or your laptop moved to somewhere else.

>Joining Mozilla's program means that Comcast agreed that it won't "retain, sell, or transfer to any third party (except as may be required by law) any personal information, IP addresses, or other user identifiers, or user query patterns from the DNS queries sent from the Firefox browser," along with other requirements.

And how is this enforced? If comcast breaches the agreement, is anyone going to sue them for punitive damages? Given the current state of the US legal system (eg. what happened equifax after the breach), these assurances are worthless to me.

Re: Comcast, Mozilla strike privacy deal to encrypt DNS lookups in Firefox

#12

Post by tssva » Thu, Jun 25, 2020, 2:46 PM UTC

rydre wrote: post #7

tmikaeld wrote: post #3

Earlier quoted context omitted.

Agreed, if it was cloudflare I would have at least given them the benefits of a doubt, but not Comcast.

Cloudflare is harmful to independent CDN's. They hide the originating i.p. address (no other does it) to the nameserver in the name of "privacy" so you can only have as much granularity as the nearest cloudflare server to user (anti-competitive). That is unless you buy an ipv4 block (because everyone is still on ipv4) and set up anycast. For non 1.1.1.1 dns users I can just set up varnish and they'll be served via GE…

Not forwarding EDNS client subnet is a requirement for Mozilla TRR partners. NextDNS also doesn't forward EDNS subnet client since it is a partner and soon Comcast will be joining that list. Although not currently a member of the program Quad9 also by default doesn't forward EDNS subnet info.

Re: Comcast, Mozilla strike privacy deal to encrypt DNS lookups in Firefox

#13

Post by rydre » Thu, Jun 25, 2020, 3:05 PM UTC

tssva wrote: post #12

rydre wrote: post #7

Earlier quoted context omitted.

Cloudflare is harmful to independent CDN's. They hide the originating i.p. address (no other does it) to the nameserver in the name of "privacy" so you can only have as much granularity as the nearest cloudflare server to user (anti-competitive). That is unless you buy an ipv4 block (because everyone is still on ipv4) and set up anycast. For non 1.1.1.1 dns users I can just set up varnish and they'll be served via GE…

Not forwarding EDNS client subnet is a requirement for Mozilla TRR partners. NextDNS also doesn't forward EDNS subnet client since it is a partner and soon Comcast will be joining that list. Although not currently a member of the program Quad9 also by default doesn't forward EDNS subnet info.

I host my name server's myself. If Mozilla is really doing this, they're misguided. All this does is make it impossible to serve requests from nearest webserver. You are getting the ip address anyways, so why do this? This means if I get someone from netherlands I'd have to redirect their requests from www.example.com to nl.example.com or buy an ipv4 block, set up anycast and then serve from the closest ipaddress/server. The end result is same. I'll always get the end user's ip address unless they use a VPN or something.

This is a stupid decision by Mozilla. Too bad Firefox users when visiting websites making their own CDN's without anycast/country level redirects will see much slower sites.

Re: Comcast, Mozilla strike privacy deal to encrypt DNS lookups in Firefox

#14

Post by [deleted] » Thu, Jun 25, 2020, 3:16 PM UTC

rydre wrote: post #10

DoctorOW wrote: post #9

Earlier quoted context omitted.

EDIT: I associated the name Cloudflare with the main product. I forgot the context of this being about DNS and therefore my comment is about Cloudflare CDN not 1.1.1.1 > Cloudflare is harmful to independent CDN's. Cloudflare is a competitor to CDNs. You don't need to use a CDN with Cloudflare, they proxy your content fully and do caching along the way as needed. > Their privacy claim is a lie because your webserver i…

> It's not a lie. Cloudflare is the nameserver, and the CDN. So after resolution the end user still has just a Cloudflare IP. > In 2011 Google wrote an IETF draft to send Client IP information using the EDNS0 extension and this is usually called ‘edns-client-subnet’. As a DNS client, it means that a truncated version of your IP address will be added into the DNS request. The DNS server will use this truncated IP addr…

[deleted]

Re: Comcast, Mozilla strike privacy deal to encrypt DNS lookups in Firefox

#15

Post by ta576248_743568 » Thu, Jun 25, 2020, 3:16 PM UTC

gruez wrote: post #11

>Comcast told Ars yesterday that "Firefox users on Xfinity should automatically default to Xfinity resolvers under Mozilla's Trusted Recursive Resolver program, unless they have manually chosen a different resolver, or if DoH is disabled. How would this work? Is the detection done once, everytime firefox starts, or everytime the network changes? Would you ever get into a situation where you're not using comcast, but…

My understanding is that Comcast signs a legally-binding contract with Mozilla which imposes the requirements on them [0]. This obviously isn't perfect protection, but it substantially increases the risk of failing to adhere to the requirements. Mozilla claims "We intend to publicly document violations of this Policy and take additional actions if necessary." [1]. Presumably the additional actions include suing for damages pursuant to the breach of contract.

[0] https://blog.mozilla.org/netpolicy/2020/02/25/the-facts-mozi... [1] https://wiki.mozilla.org/Security/DOH-resolver-policy#Enforc...

Re: Comcast, Mozilla strike privacy deal to encrypt DNS lookups in Firefox

#16

Post by danShumway » Thu, Jun 25, 2020, 3:45 PM UTC

This is a net increase in privacy for most people on Comcast networks, I'm glad to see Mozilla striking a deal like this -- especially with the privacy agreements Comcast is signing. But you should still switch your encrypted DNS provider to someone else like Cloudflare or similar.

In short, good move, but you personally can make better moves than trusting Comcast.

Re: Comcast, Mozilla strike privacy deal to encrypt DNS lookups in Firefox

#17

Post by zaroth » Thu, Jun 25, 2020, 3:48 PM UTC

DoctorOW wrote: post #9

rydre wrote: post #7

Earlier quoted context omitted.

Cloudflare is harmful to independent CDN's. They hide the originating i.p. address (no other does it) to the nameserver in the name of "privacy" so you can only have as much granularity as the nearest cloudflare server to user (anti-competitive). That is unless you buy an ipv4 block (because everyone is still on ipv4) and set up anycast. For non 1.1.1.1 dns users I can just set up varnish and they'll be served via GE…

EDIT: I associated the name Cloudflare with the main product. I forgot the context of this being about DNS and therefore my comment is about Cloudflare CDN not 1.1.1.1 > Cloudflare is harmful to independent CDN's. Cloudflare is a competitor to CDNs. You don't need to use a CDN with Cloudflare, they proxy your content fully and do caching along the way as needed. > Their privacy claim is a lie because your webserver i…

I think you’re confusing how CloudFlare can hide the server IP from the user (to protect against DDoS) versus how CloudFlare DNS hides the client’s IP from the name server, even though the Client IP is exposed to the web server by Cloudflare, and of course standard Cloudflare is irrelevant if the requested site isn’t using the Cloudflare service in the first place.

Re: Comcast, Mozilla strike privacy deal to encrypt DNS lookups in Firefox

#18

Post by presumably » Thu, Jun 25, 2020, 3:54 PM UTC

rydre wrote: post #13

tssva wrote: post #12

Earlier quoted context omitted.

Not forwarding EDNS client subnet is a requirement for Mozilla TRR partners. NextDNS also doesn't forward EDNS subnet client since it is a partner and soon Comcast will be joining that list. Although not currently a member of the program Quad9 also by default doesn't forward EDNS subnet info.

I host my name server's myself. If Mozilla is really doing this, they're misguided. All this does is make it impossible to serve requests from nearest webserver. You are getting the ip address anyways, so why do this? This means if I get someone from netherlands I'd have to redirect their requests from www.example.com to nl.example.com or buy an ipv4 block, set up anycast and then serve from the closest ipaddress/ser…

What you're claiming is false.

Cloudflare has over 200 PoPs; in your own name servers, you can use the Cloudflare Resolver's IP (which will be a "close to the user" IP, not 1.1.1.1) to do geotargeting and serve from your closest IP address/server.

Re: Comcast, Mozilla strike privacy deal to encrypt DNS lookups in Firefox

#19

Post by presumably » Thu, Jun 25, 2020, 3:57 PM UTC

rydre wrote: post #10

DoctorOW wrote: post #9

Earlier quoted context omitted.

EDIT: I associated the name Cloudflare with the main product. I forgot the context of this being about DNS and therefore my comment is about Cloudflare CDN not 1.1.1.1 > Cloudflare is harmful to independent CDN's. Cloudflare is a competitor to CDNs. You don't need to use a CDN with Cloudflare, they proxy your content fully and do caching along the way as needed. > Their privacy claim is a lie because your webserver i…

> It's not a lie. Cloudflare is the nameserver, and the CDN. So after resolution the end user still has just a Cloudflare IP. > In 2011 Google wrote an IETF draft to send Client IP information using the EDNS0 extension and this is usually called ‘edns-client-subnet’. As a DNS client, it means that a truncated version of your IP address will be added into the DNS request. The DNS server will use this truncated IP addr…

There is only a single "archive" that does not allow access to Cloudflare DNS users - not many.

It is also exceedingly unlikely that you have greater density of anycast PoPs than Cloudflare's 200+. In your case, you have zero...

Re: Comcast, Mozilla strike privacy deal to encrypt DNS lookups in Firefox

#20

Post by WarOnPrivacy » Thu, Jun 25, 2020, 3:58 PM UTC

> Mozilla in November accused ISPs of lying to Congress in order to spread confusion about encrypted DNS. Mozilla's letter to Congress criticized Comcast

> NCTA cable lobby that Comcast belongs to wrote a letter to Congress objecting to Google's plans for encrypted DNS. Comcast gave members of Congress a lobbying presentation that claimed the encrypted-DNS plan would "centraliz[e] a majority of worldwide DNS data with Google". Comcast's lobbying presentation also complained about Mozilla's plan for Firefox.

Compromise, 2020 style: Comcast retains access to it's users DNS data and Mozilla doesn't dogpiled by NCTA-purchased legislators.