Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Comcast, Mozilla strike privacy deal to encrypt DNS lookups in Firefox

arstechnica.com

Post reply on HN
Print view View original

71–80 of 211 posts

Re: Comcast, Mozilla strike privacy deal to encrypt DNS lookups in Firefox

#71

Post by treve »

sandworm101 wrote: post #33
Skunkleton wrote: post #21

Earlier quoted context omitted.

> Route DNS to trusted non-profit entities. I'm sure you know this, but some readers might not. DNS is totally insecure. Even if you change your DNS server from the default to 1.1.1.1 or whatever, your ISP can and does still read and/or intercept these requests. This sort of interference is absolutely trivial to implement, even at scale. Don't think it isn't happening to you.

>> Even if you change your DNS server from the default to 1.1.1.1 or whatever, your ISP can and does still read and/or intercept these requests. Not if VPNs/firewalls are properly implmented. Plugging DNS leaks is security 101.

I get that VPNs are considered more trustworthy by some (although so many also have shoddy records/ownership), but it's still 1 extra party to trust vs. just your DNS provider.

Re: Comcast, Mozilla strike privacy deal to encrypt DNS lookups in Firefox

#73

Post by jlgaddis »

jefftk wrote: post #61
jlgaddis wrote: post #51

Earlier quoted context omitted.

In a corporate network, it's pretty common to block all outgoing DNS traffic (53/TCP and 53/UDP), except from the company's DNS servers. In that case, DoH does let malware do something new -- block the company's existing DNS policies, quert logging, and security monitoring!

DoH is a protocol for using HTTPS to learn what IPs to talk to. Malware does not need DoH to do this. They can simply run an ordinary HTTPS server with a self-signed cert on an arbitrary IP, with a simple JSON-based or whatever protocol, and have support for that in their client.

> Malware does not need DoH to do this.

Yes, you're right, of course.

There are any number of things that malware can do. Most of it doesn't, however, and can either be stopped completely or, at the least, detected quite easily using some basic techniques.

Re: Comcast, Mozilla strike privacy deal to encrypt DNS lookups in Firefox

#74

Post by parliament32 »

bzbarsky wrote: post #52
nfoz wrote: post #50

> "Adding ISPs in the TRR program paves the way for providing customers with the security of trusted DNS resolution, while also offering the benefits of a resolver provided by their ISP such as parental control services and better optimized, localized results," the announcement said. What? No! Why would DNS have "optimized, localized results"?

Consider a hostname that can map to different, widely geographically separated, IPs. You probably want the one with the lowest latency, which is likely to be the closest-located one. Not guaranteed, of course.

You should just use anycast for that instead of trying to shoehorn it in with DNS trickery.

Re: Comcast, Mozilla strike privacy deal to encrypt DNS lookups in Firefox

#75

Post by xxpor »

jlivingood wrote: post #55
jlgaddis wrote: post #46

Let me make sure I've got this right: * Comcast sniffs / records / tracks their user's DNS traffic * Mozilla announced they would enable DoH by default, to protect end user's DNS data from shady ISPs like Comcast * Comcast then raised hell about Mozilla's decision (presumably because they would no longer have access to this data) * Now, Comcast and Mozilla come to some sort of agreement which effectively restores Com…

> Comcast sniffs / records / tracks their user's DNS traffic Actually not only does Comcast say they don't do that ( https://www.xfinity.com/privacy/policy/dns ) but now has signed a contract to this effect as well, thereby meeting the same level of commitment as the other TRR operators. This means IMO that Mozilla is doing a good job leading the industry on DNS privacy and convincing many of the merits of a strong p…

The link provided only concerns logging of DNS requests on Comcast's DNS servers themselves. It doesn't say anything about recording packets to UDP port 53 in general. If Comcast were recording every packet I sent to 8.8.8.8 they wouldn't be breaking the letter of the policy.

Re: Comcast, Mozilla strike privacy deal to encrypt DNS lookups in Firefox

#76

Post by Nextgrid »

jlgaddis wrote: post #46

Let me make sure I've got this right: * Comcast sniffs / records / tracks their user's DNS traffic * Mozilla announced they would enable DoH by default, to protect end user's DNS data from shady ISPs like Comcast * Comcast then raised hell about Mozilla's decision (presumably because they would no longer have access to this data) * Now, Comcast and Mozilla come to some sort of agreement which effectively restores Com…

I don't understand why Mozilla should care or get involved at all into what Comcast thinks of them.

Mozilla introduce a privacy feature in a free, open-source browser. Comcast bitches about it because it prevents them from doing shenanigans, essentially incriminating themselves and proving that the feature is both working as expected and necessary.

Why does Mozilla need to care about Comcast's opinion on this, and try to work out an "agreement" with them? It's equivalent to antivirus software actually working, and then the antivirus developer does a deal with the virus makers because the antivirus is actually effective and the virus makers are complaining.

I am really disappointed in Mozilla's recent features, poor focus and nonsensical management.

Re: Comcast, Mozilla strike privacy deal to encrypt DNS lookups in Firefox

#77

Post by heavyset_go »

jlgaddis wrote: post #46

Let me make sure I've got this right: * Comcast sniffs / records / tracks their user's DNS traffic * Mozilla announced they would enable DoH by default, to protect end user's DNS data from shady ISPs like Comcast * Comcast then raised hell about Mozilla's decision (presumably because they would no longer have access to this data) * Now, Comcast and Mozilla come to some sort of agreement which effectively restores Com…

> I'm really confused why Mozilla would agree to this.

If it's anything like their CloudFlare deals, then Mozilla did this because they were able to secure contracts that provide additional privacy protections for Mozilla's customers that the parent company doesn't normally provide to end-users.

In theory, those contracts should be enforceable in court. Whether or not you think the companies Mozilla contracts with will find ways to snoop on the private data anyway is a different story.

Re: Comcast, Mozilla strike privacy deal to encrypt DNS lookups in Firefox

#78

Post by detaro »

jlgaddis wrote: post #46

Let me make sure I've got this right: * Comcast sniffs / records / tracks their user's DNS traffic * Mozilla announced they would enable DoH by default, to protect end user's DNS data from shady ISPs like Comcast * Comcast then raised hell about Mozilla's decision (presumably because they would no longer have access to this data) * Now, Comcast and Mozilla come to some sort of agreement which effectively restores Com…

Also: People don't want Mozilla to send all DoH traffic to one company, so Mozilla has set a list of things they require a company to do so that they'll use their DoH servers automatically. Apparently, Comcast has agreed to said list. (We'll have to see if details on oversight and enforcement are published)

Re: Comcast, Mozilla strike privacy deal to encrypt DNS lookups in Firefox

#80

Post by stefan_ »

jlgaddis wrote: post #46

Let me make sure I've got this right: * Comcast sniffs / records / tracks their user's DNS traffic * Mozilla announced they would enable DoH by default, to protect end user's DNS data from shady ISPs like Comcast * Comcast then raised hell about Mozilla's decision (presumably because they would no longer have access to this data) * Now, Comcast and Mozilla come to some sort of agreement which effectively restores Com…

This is the Mozilla we know. While touting their privacy record, they keep running head first into the biggest privacy debacles imaginable.

Certifying an ISP that ran a NXDOMAIN hijack scheme while no doubt also selling DNS data for DoH is beyond the pale.

Post reply on HN