Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Comcast, Mozilla strike privacy deal to encrypt DNS lookups in Firefox

arstechnica.com

Post reply on HN
Print view View original

51–60 of 211 posts

Re: Comcast, Mozilla strike privacy deal to encrypt DNS lookups in Firefox

#51

Post by jlgaddis »

jefftk wrote: post #42
deeter72 wrote: post #35

Earlier quoted context omitted.

Again not the most ideal way to do things and Mozilla is doing a different approach to Chrome and Edge. and also a concern is that malware can use DoH to retrieve data without logging suspicious DNS queries on Firewall DNS logs which are monitored to highlight of new domains that have not been pre-approved. DNS should be something that is handled by the OS. I favor DoT which is secure and practical over DoH.

> malware can use DoH to retrieve data without logging suspicious DNS queries on Firewall DNS logs Malware can already query IPs of its choice to learn about other IPs it should contact. DoH doesn't let it do anything new.

In a corporate network, it's pretty common to block all outgoing DNS traffic (53/TCP and 53/UDP), except from the company's DNS servers.

In that case, DoH does let malware do something new -- block the company's existing DNS policies, quert logging, and security monitoring!

Re: Comcast, Mozilla strike privacy deal to encrypt DNS lookups in Firefox

#52

Post by bzbarsky »

nfoz wrote: post #50

> "Adding ISPs in the TRR program paves the way for providing customers with the security of trusted DNS resolution, while also offering the benefits of a resolver provided by their ISP such as parental control services and better optimized, localized results," the announcement said. What? No! Why would DNS have "optimized, localized results"?

Consider a hostname that can map to different, widely geographically separated, IPs. You probably want the one with the lowest latency, which is likely to be the closest-located one. Not guaranteed, of course.

Re: Comcast, Mozilla strike privacy deal to encrypt DNS lookups in Firefox

#53

Post by jlivingood »

nfoz wrote: post #50

> "Adding ISPs in the TRR program paves the way for providing customers with the security of trusted DNS resolution, while also offering the benefits of a resolver provided by their ISP such as parental control services and better optimized, localized results," the announcement said. What? No! Why would DNS have "optimized, localized results"?

> Why would DNS have "optimized, localized results"?

Any content that is CDN-based (which is most content) dynamically responds to DNS queries based on network and geographic location - to support CDN localization. In this way, Akamai for example knows the end user is in Boston on a Comcast network and will send the recursive DNS server a dynamic response that points to a directly-connected local-to-Boston content server.

Re: Comcast, Mozilla strike privacy deal to encrypt DNS lookups in Firefox

#54

Post by jlgaddis »

speedgoose wrote: post #34
deeter72 wrote: post #22

Earlier quoted context omitted.

This is why I absolutely despise DoH. SysAdmins have no direct control over it. In my organization we have blocked direct IP access from userspace VLAN's to all known public DNS servers thus forcing all clients to rely on the company DNS servers, which is not the most ideal way to do things.

Why do you want them to rely on the company DNS servers?

1. Internal names won't resolve if a client is using, for example, 1.1 as their DNS server (breaking, among other things, logging on to an Active Directory domain!)

2. Many companies have established DNS logging and monitoring in place for security.

Re: Comcast, Mozilla strike privacy deal to encrypt DNS lookups in Firefox

#55

Post by jlivingood »

jlgaddis wrote: post #46

Let me make sure I've got this right: * Comcast sniffs / records / tracks their user's DNS traffic * Mozilla announced they would enable DoH by default, to protect end user's DNS data from shady ISPs like Comcast * Comcast then raised hell about Mozilla's decision (presumably because they would no longer have access to this data) * Now, Comcast and Mozilla come to some sort of agreement which effectively restores Com…

> Comcast sniffs / records / tracks their user's DNS traffic

Actually not only does Comcast say they don't do that (https://www.xfinity.com/privacy/policy/dns) but now has signed a contract to this effect as well, thereby meeting the same level of commitment as the other TRR operators. This means IMO that Mozilla is doing a good job leading the industry on DNS privacy and convincing many of the merits of a strong pro-privacy philosophy.

(disclosure: I work for Comcast and have been working on encrypted DNS)

Re: Comcast, Mozilla strike privacy deal to encrypt DNS lookups in Firefox

#56

Post by jbverschoor »

bosswipe wrote: post #32

Weird that a network or OS level concern is being moved to the application layer. But considering that trust in all the other layers has been lost, from the ISP to the OS (specifically Windows), maybe this makes sense.

The whole newroling stack needs encryption etc. This is one reason why you see everything moving of the layers. The other is, that Http servers are widely available, tested and easily scalable

Re: Comcast, Mozilla strike privacy deal to encrypt DNS lookups in Firefox

#57

Post by jlivingood »

gruez wrote: post #11

>Comcast told Ars yesterday that "Firefox users on Xfinity should automatically default to Xfinity resolvers under Mozilla's Trusted Recursive Resolver program, unless they have manually chosen a different resolver, or if DoH is disabled. How would this work? Is the detection done once, everytime firefox starts, or everytime the network changes? Would you ever get into a situation where you're not using comcast, but…

> How would this work?

A 1st draft of the steering mechanism just posted today for comment at https://tools.ietf.org/id/draft-rescorla-doh-cdisco-00.txt

Re: Comcast, Mozilla strike privacy deal to encrypt DNS lookups in Firefox

#58

Post by jlgaddis »

kodablah wrote: post #31

How does FF know my DNS is a Comcast-provided one? Is there an IP list kept inside of browsers and updated?

Comcast's ASNs and networks are documented in ARIN's WHOIS database and various route registries. Hell, Comcast probably publishes a list on their own web site.

So, yeah, Mozilla can easily determine if a user is on the Comcast network just from their IP address.

Also, while Comcast actually has a bunch of DNS servers spread across the country, I believe that nowadays they're mostly "promoting" the use of 75.75.75.75 and 75.75.76.76 (which, AFAIK, are anycasted and direct end users to their "local" DNS servers).

Re: Comcast, Mozilla strike privacy deal to encrypt DNS lookups in Firefox

#59

Post by hellcow »

jlivingood wrote: post #55
jlgaddis wrote: post #46

Let me make sure I've got this right: * Comcast sniffs / records / tracks their user's DNS traffic * Mozilla announced they would enable DoH by default, to protect end user's DNS data from shady ISPs like Comcast * Comcast then raised hell about Mozilla's decision (presumably because they would no longer have access to this data) * Now, Comcast and Mozilla come to some sort of agreement which effectively restores Com…

> Comcast sniffs / records / tracks their user's DNS traffic Actually not only does Comcast say they don't do that ( https://www.xfinity.com/privacy/policy/dns ) but now has signed a contract to this effect as well, thereby meeting the same level of commitment as the other TRR operators. This means IMO that Mozilla is doing a good job leading the industry on DNS privacy and convincing many of the merits of a strong p…

Respectfully, Comcast has an ATROCIOUS privacy record. Full stop. A quick search came up with [1] [2] [3].

Your employer actively and repeatedly abuses the privacy and trust of its customers. It also lobbies for damaging policies.

I do not trust Comcast. Firefox associating itself with Comcast makes me trust Firefox significantly less.

[1] https://oag.ca.gov/news/press-releases/attorney-general-kama...

[2] https://www.king5.com/article/news/local/comcast-fined-9-mil...

[3] https://consumerist.com/2016/04/01/comcast-says-fcc-privacy-...

Re: Comcast, Mozilla strike privacy deal to encrypt DNS lookups in Firefox

#60

Post by Paul-ish »

jlivingood wrote: post #55
jlgaddis wrote: post #46

Let me make sure I've got this right: * Comcast sniffs / records / tracks their user's DNS traffic * Mozilla announced they would enable DoH by default, to protect end user's DNS data from shady ISPs like Comcast * Comcast then raised hell about Mozilla's decision (presumably because they would no longer have access to this data) * Now, Comcast and Mozilla come to some sort of agreement which effectively restores Com…

> Comcast sniffs / records / tracks their user's DNS traffic Actually not only does Comcast say they don't do that ( https://www.xfinity.com/privacy/policy/dns ) but now has signed a contract to this effect as well, thereby meeting the same level of commitment as the other TRR operators. This means IMO that Mozilla is doing a good job leading the industry on DNS privacy and convincing many of the merits of a strong p…

If Comcast sells DNS data now, they open themselves up to penalties from the both FTC and Mozilla. FTC because they enforce privacy policies, and Mozilla because of the contract they have.

I would say this Mozilla changing the overall ecosystem for the better.

Post reply on HN