Comcast, Mozilla strike privacy deal to encrypt DNS lookups in Firefox • Hacker News Board

Re: Comcast, Mozilla strike privacy deal to encrypt DNS lookups in Firefox

#21

Post by Skunkleton » Thu, Jun 25, 2020, 4:05 PM UTC

sandworm101 wrote: post #8

Washuu wrote: post #2

Considering that Comcast sniffs, intercepts, and injects into HTTP web sites for their customer notification system(data cap overages and such) this just screams suspicious to me even if it seems like it is meant to be a good announcement. I am not sure how I am supposed to trust that they will do the right thing for their customers.

There is nothing that Comcast can do that would increase my opinion of them re privacy. In my security regime ISPs like them are on the other side. Last-mile ISPs are unsecured public networks that shouldn't be trusted any more than free airport wifi. I want them blind to everything I (and my client) does online. Encrypt everything. Route DNS to trusted non-profit entities. Serve me the encrypted data I request but o…

> Route DNS to trusted non-profit entities.

I'm sure you know this, but some readers might not. DNS is totally insecure. Even if you change your DNS server from the default to 1.1.1.1 or whatever, your ISP can and does still read and/or intercept these requests. This sort of interference is absolutely trivial to implement, even at scale. Don't think it isn't happening to you.

Re: Comcast, Mozilla strike privacy deal to encrypt DNS lookups in Firefox

#22

Post by deeter72 » Thu, Jun 25, 2020, 4:11 PM UTC

apocalyptic0n3 wrote: post #5

CWuestefeld wrote: post #4

At home I've got a pihole handling my DNS, including using DoH to Cloudflare. I assume that this configuration is superior to whatever FF is doing natively, and I should disable FF's DoH support?

If you do not disable Firefox's DoH support, it will by pass your Pi-Hole entirely. So you'd lose all the benefits of that and be limited to just the protections Firefox provides (which are great, to be clear. Just not as good as a well-sourced Pi0Hole)

This is why I absolutely despise DoH. SysAdmins have no direct control over it. In my organization we have blocked direct IP access from userspace VLAN's to all known public DNS servers thus forcing all clients to rely on the company DNS servers, which is not the most ideal way to do things.

Re: Comcast, Mozilla strike privacy deal to encrypt DNS lookups in Firefox

#23

Post by solarkraft » Thu, Jun 25, 2020, 4:16 PM UTC

Skunkleton wrote: post #21

sandworm101 wrote: post #8

Earlier quoted context omitted.

There is nothing that Comcast can do that would increase my opinion of them re privacy. In my security regime ISPs like them are on the other side. Last-mile ISPs are unsecured public networks that shouldn't be trusted any more than free airport wifi. I want them blind to everything I (and my client) does online. Encrypt everything. Route DNS to trusted non-profit entities. Serve me the encrypted data I request but o…

> Route DNS to trusted non-profit entities. I'm sure you know this, but some readers might not. DNS is totally insecure. Even if you change your DNS server from the default to 1.1.1.1 or whatever, your ISP can and does still read and/or intercept these requests. This sort of interference is absolutely trivial to implement, even at scale. Don't think it isn't happening to you.

... which is exactly why DoH is gaining attention.

But I keep wondering: Can't the ISP trivially correlate the accessed IP addresses with their corresponding sites even without DNS query data?

Re: Comcast, Mozilla strike privacy deal to encrypt DNS lookups in Firefox

#24

Post by yjftsjthsd-h » Thu, Jun 25, 2020, 4:17 PM UTC

deeter72 wrote: post #22

apocalyptic0n3 wrote: post #5

Earlier quoted context omitted.

If you do not disable Firefox's DoH support, it will by pass your Pi-Hole entirely. So you'd lose all the benefits of that and be limited to just the protections Firefox provides (which are great, to be clear. Just not as good as a well-sourced Pi0Hole)

This is why I absolutely despise DoH. SysAdmins have no direct control over it. In my organization we have blocked direct IP access from userspace VLAN's to all known public DNS servers thus forcing all clients to rely on the company DNS servers, which is not the most ideal way to do things.

Don't you just set a canary domain - https://support.mozilla.org/en-US/kb/canary-domain-use-appli... - and then it's disabled for your network?

Re: Comcast, Mozilla strike privacy deal to encrypt DNS lookups in Firefox

#25

Post by rydre » Thu, Jun 25, 2020, 4:23 PM UTC

presumably wrote: post #18

rydre wrote: post #13

Earlier quoted context omitted.

I host my name server's myself. If Mozilla is really doing this, they're misguided. All this does is make it impossible to serve requests from nearest webserver. You are getting the ip address anyways, so why do this? This means if I get someone from netherlands I'd have to redirect their requests from www.example.com to nl.example.com or buy an ipv4 block, set up anycast and then serve from the closest ipaddress/ser…

What you're claiming is false. Cloudflare has over 200 PoPs; in your own name servers, you can use the Cloudflare Resolver's IP (which will be a "close to the user" IP, not 1.1.1.1) to do geotargeting and serve from your closest IP address/server.

>What you're claiming is false. Cloudflare has over 200 PoPs; in your own name servers, you can use the Cloudflare Resolver's IP (which will be a "close to the user" IP, not 1.1.1.1) to do geotargeting and serve from your closest IP address/server.

What if my server is closer than cloudflare? Why is cloudflare artificially limiting?

Re: Comcast, Mozilla strike privacy deal to encrypt DNS lookups in Firefox

#26

Post by ViViDboarder » Thu, Jun 25, 2020, 4:29 PM UTC

rydre wrote: post #13

tssva wrote: post #12

Earlier quoted context omitted.

Not forwarding EDNS client subnet is a requirement for Mozilla TRR partners. NextDNS also doesn't forward EDNS subnet client since it is a partner and soon Comcast will be joining that list. Although not currently a member of the program Quad9 also by default doesn't forward EDNS subnet info.

I host my name server's myself. If Mozilla is really doing this, they're misguided. All this does is make it impossible to serve requests from nearest webserver. You are getting the ip address anyways, so why do this? This means if I get someone from netherlands I'd have to redirect their requests from www.example.com to nl.example.com or buy an ipv4 block, set up anycast and then serve from the closest ipaddress/ser…

You will always get the IP because you host the nameserver and the web server. In many cases, the nameserver is hosted by a third party. Doesn’t what Mozilla and Cloudflare have done prevent the nameserver from receiving the originating IP, thus preventing large nameservers from generating user traffic histories? This is an honest question. I’m not fully familiar with the process of running a nameserver.

Re: Comcast, Mozilla strike privacy deal to encrypt DNS lookups in Firefox

#27

Post by NelsonMinar » Thu, Jun 25, 2020, 4:39 PM UTC

Washuu wrote: post #2

Considering that Comcast sniffs, intercepts, and injects into HTTP web sites for their customer notification system(data cap overages and such) this just screams suspicious to me even if it seems like it is meant to be a good announcement. I am not sure how I am supposed to trust that they will do the right thing for their customers.

I'm very suspicious of Comcast too. They've had hostile policies in their Internet management for as long as I can remember, going back to the days they'd forge RST packets because they didn't like customers using BitTorrent.

OTOH as the article says, 'Joining Mozilla's program means that Comcast agreed that it won't "retain, sell, or transfer to any third party (except as may be required by law) any personal information, IP addresses, or other user identifiers, or user query patterns from the DNS queries sent from the Firefox browser'.

I assume Mozilla will audit and keep Comcast honest here, or at least try. I just am left wondering what loophole Comcast has found.

Re: Comcast, Mozilla strike privacy deal to encrypt DNS lookups in Firefox

#28

Post by miyuru » Thu, Jun 25, 2020, 4:42 PM UTC

presumably wrote: post #19

rydre wrote: post #10

Earlier quoted context omitted.

> It's not a lie. Cloudflare is the nameserver, and the CDN. So after resolution the end user still has just a Cloudflare IP. > In 2011 Google wrote an IETF draft to send Client IP information using the EDNS0 extension and this is usually called ‘edns-client-subnet’. As a DNS client, it means that a truncated version of your IP address will be added into the DNS request. The DNS server will use this truncated IP addr…

There is only a single "archive" that does not allow access to Cloudflare DNS users - not many. It is also exceedingly unlikely that you have greater density of anycast PoPs than Cloudflare's 200+. In your case, you have zero...

Akamai has more than 200 pops and do geodns to stear traffic.

If I compare cloudflare DNS vs Google DNS, I can see a difference of ~50ms between the Akamai POPs offered.

https://pastebin.com/raw/xFQb4pVF

Re: Comcast, Mozilla strike privacy deal to encrypt DNS lookups in Firefox

#29

Post by proverbialbunny » Thu, Jun 25, 2020, 4:45 PM UTC

Washuu wrote: post #2

Considering that Comcast sniffs, intercepts, and injects into HTTP web sites for their customer notification system(data cap overages and such) this just screams suspicious to me even if it seems like it is meant to be a good announcement. I am not sure how I am supposed to trust that they will do the right thing for their customers.

I hit commit on that feature. Sorry.

It's not just Comcast. Every ISP that uses Akamai's software to power their ISP has this ability and possibly uses it, just not in obvious ways. And given that almost every ISP in the US, let alone the world, uses this software, well.. that's just how it is.

Though, it's http only. You can always switch to https and they can not do anything. There is no key injection or anything going on thankfully. Also, encrypted DNS should make it moot as well.

Re: Comcast, Mozilla strike privacy deal to encrypt DNS lookups in Firefox

#30

Post by chaostheory » Thu, Jun 25, 2020, 4:46 PM UTC

Washuu wrote: post #2

Considering that Comcast sniffs, intercepts, and injects into HTTP web sites for their customer notification system(data cap overages and such) this just screams suspicious to me even if it seems like it is meant to be a good announcement. I am not sure how I am supposed to trust that they will do the right thing for their customers.

I also wonder what the RIAA and MPAA think of this? I know using a browser isn't ideal for piracy, but at the same time those two organizations are one of several major reasons why ISPs snoop on their customers.