How does FF know my DNS is a Comcast-provided one? Is there an IP list kept inside of browsers and updated?
Comcast, Mozilla strike privacy deal to encrypt DNS lookups in Firefox
31–40 of 211 posts
Re: Comcast, Mozilla strike privacy deal to encrypt DNS lookups in Firefox
#32Weird that a network or OS level concern is being moved to the application layer. But considering that trust in all the other layers has been lost, from the ISP to the OS (specifically Windows), maybe this makes sense.
Re: Comcast, Mozilla strike privacy deal to encrypt DNS lookups in Firefox
#33Earlier quoted context omitted.
There is nothing that Comcast can do that would increase my opinion of them re privacy. In my security regime ISPs like them are on the other side. Last-mile ISPs are unsecured public networks that shouldn't be trusted any more than free airport wifi. I want them blind to everything I (and my client) does online. Encrypt everything. Route DNS to trusted non-profit entities. Serve me the encrypted data I request but o…
> Route DNS to trusted non-profit entities. I'm sure you know this, but some readers might not. DNS is totally insecure. Even if you change your DNS server from the default to 1.1.1.1 or whatever, your ISP can and does still read and/or intercept these requests. This sort of interference is absolutely trivial to implement, even at scale. Don't think it isn't happening to you.
>> Even if you change your DNS server from the default to 1.1.1.1 or whatever, your ISP can and does still read and/or intercept these requests.
Not if VPNs/firewalls are properly implmented. Plugging DNS leaks is security 101.
Re: Comcast, Mozilla strike privacy deal to encrypt DNS lookups in Firefox
#34Earlier quoted context omitted.
If you do not disable Firefox's DoH support, it will by pass your Pi-Hole entirely. So you'd lose all the benefits of that and be limited to just the protections Firefox provides (which are great, to be clear. Just not as good as a well-sourced Pi0Hole)
This is why I absolutely despise DoH. SysAdmins have no direct control over it. In my organization we have blocked direct IP access from userspace VLAN's to all known public DNS servers thus forcing all clients to rely on the company DNS servers, which is not the most ideal way to do things.
Why do you want them to rely on the company DNS servers?
Re: Comcast, Mozilla strike privacy deal to encrypt DNS lookups in Firefox
#35Earlier quoted context omitted.
This is why I absolutely despise DoH. SysAdmins have no direct control over it. In my organization we have blocked direct IP access from userspace VLAN's to all known public DNS servers thus forcing all clients to rely on the company DNS servers, which is not the most ideal way to do things.
Don't you just set a canary domain - https://support.mozilla.org/en-US/kb/canary-domain-use-appli... - and then it's disabled for your network?
Again not the most ideal way to do things and Mozilla is doing a different approach to Chrome and Edge. and also a concern is that malware can use DoH to retrieve data without logging suspicious DNS queries on Firewall DNS logs which are monitored to highlight of new domains that have not been pre-approved.
DNS should be something that is handled by the OS. I favor DoT which is secure and practical over DoH.
Re: Comcast, Mozilla strike privacy deal to encrypt DNS lookups in Firefox
#36Earlier quoted context omitted.
This is why I absolutely despise DoH. SysAdmins have no direct control over it. In my organization we have blocked direct IP access from userspace VLAN's to all known public DNS servers thus forcing all clients to rely on the company DNS servers, which is not the most ideal way to do things.
Why do you want them to rely on the company DNS servers?
Active Directory, Internal Domains, monitoring, blocking, etc.
Re: Comcast, Mozilla strike privacy deal to encrypt DNS lookups in Firefox
#37Earlier quoted context omitted.
> Route DNS to trusted non-profit entities. I'm sure you know this, but some readers might not. DNS is totally insecure. Even if you change your DNS server from the default to 1.1.1.1 or whatever, your ISP can and does still read and/or intercept these requests. This sort of interference is absolutely trivial to implement, even at scale. Don't think it isn't happening to you.
... which is exactly why DoH is gaining attention. But I keep wondering: Can't the ISP trivially correlate the accessed IP addresses with their corresponding sites even without DNS query data?
Only for sites with dedicated IPs. If they're hosted on some sort of cloud service then the ISP has to sniff the SNI data. And with ESNI coming to encrypt it that hole will be plugged soon.
Re: Comcast, Mozilla strike privacy deal to encrypt DNS lookups in Firefox
#38At home I've got a pihole handling my DNS, including using DoH to Cloudflare. I assume that this configuration is superior to whatever FF is doing natively, and I should disable FF's DoH support?
No need to disable Firefox's DoH support, just point it at your pihole as the DoH provider.
Re: Comcast, Mozilla strike privacy deal to encrypt DNS lookups in Firefox
#39Earlier quoted context omitted.
Don't you just set a canary domain - https://support.mozilla.org/en-US/kb/canary-domain-use-appli... - and then it's disabled for your network?
Again not the most ideal way to do things and Mozilla is doing a different approach to Chrome and Edge. and also a concern is that malware can use DoH to retrieve data without logging suspicious DNS queries on Firewall DNS logs which are monitored to highlight of new domains that have not been pre-approved. DNS should be something that is handled by the OS. I favor DoT which is secure and practical over DoH.
[deleted]
Re: Comcast, Mozilla strike privacy deal to encrypt DNS lookups in Firefox
#40I don't know how we can have privacy and Comcast in one sentence. We have a saying where I come from that translates roughly to "Putting the Wolf to Guard the Sheep".
If you don't have any other option but to be with comcast my recommendation is to run Pi-Hole + DoH.