Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Comcast, Mozilla strike privacy deal to encrypt DNS lookups in Firefox

arstechnica.com

Post reply on HN
Print view View original

101–110 of 211 posts

Re: Comcast, Mozilla strike privacy deal to encrypt DNS lookups in Firefox

#101

Post by booi »

xxpor wrote: post #75
jlivingood wrote: post #55

Earlier quoted context omitted.

> Comcast sniffs / records / tracks their user's DNS traffic Actually not only does Comcast say they don't do that ( https://www.xfinity.com/privacy/policy/dns ) but now has signed a contract to this effect as well, thereby meeting the same level of commitment as the other TRR operators. This means IMO that Mozilla is doing a good job leading the industry on DNS privacy and convincing many of the merits of a strong p…

The link provided only concerns logging of DNS requests on Comcast's DNS servers themselves. It doesn't say anything about recording packets to UDP port 53 in general. If Comcast were recording every packet I sent to 8.8.8.8 they wouldn't be breaking the letter of the policy.

Hopefully this is exactly what DoH should be addressing.

Re: Comcast, Mozilla strike privacy deal to encrypt DNS lookups in Firefox

#102

Post by etrabroline »

Eikon wrote: post #81
jlivingood wrote: post #53

Earlier quoted context omitted.

> Why would DNS have "optimized, localized results"? Any content that is CDN-based (which is most content) dynamically responds to DNS queries based on network and geographic location - to support CDN localization. In this way, Akamai for example knows the end user is in Boston on a Comcast network and will send the recursive DNS server a dynamic response that points to a directly-connected local-to-Boston content se…

Any serious CDN is doing that with anycast, not with geodns which has tons of drawbacks.

You're right. This is really cool tech. https://www.cloudflare.com/learning/cdn/glossary/anycast-net...

Re: Comcast, Mozilla strike privacy deal to encrypt DNS lookups in Firefox

#103

Post by pbhjpbhj »

ta576248_743568 wrote: post #15
gruez wrote: post #11

>Comcast told Ars yesterday that "Firefox users on Xfinity should automatically default to Xfinity resolvers under Mozilla's Trusted Recursive Resolver program, unless they have manually chosen a different resolver, or if DoH is disabled. How would this work? Is the detection done once, everytime firefox starts, or everytime the network changes? Would you ever get into a situation where you're not using comcast, but…

My understanding is that Comcast signs a legally-binding contract with Mozilla which imposes the requirements on them [0]. This obviously isn't perfect protection, but it substantially increases the risk of failing to adhere to the requirements. Mozilla claims "We intend to publicly document violations of this Policy and take additional actions if necessary." [1]. Presumably the additional actions include suing for d…

Surely damages will be approximately zero? There has to be something else to sway Comcast's executives to abide by the contract, surely. Like the CEO agrees to forfeit an amount equal to their previous years total earnings, from all sources, ... that would be an interesting contract!

Re: Comcast, Mozilla strike privacy deal to encrypt DNS lookups in Firefox

#104

Post by the8472 »

xoa wrote: post #100
the8472 wrote: post #45

Earlier quoted context omitted.

That just means moving from the ISP in a prime position for snooping to various CDNs being in that prime position. You traded one master for another.

> You traded one master for another. No. By definition, last mile ISP sees 100% of net-bound traffic. "Various CDNs" itself already represents a dilution of that view, and are not universal themselves. It's an inherent improvement even outside of other factors. But there are other factors, including a decrease in the level of natural monopoly. Last-mile ISPs often have zero effective competition, and even with one or…

You have a contractual relation with your ISP and they're in your jurisdiction so at least in theory you have legal recourse.

Advocating for ESNI on the other hand means argueing for more centralization towards entities which are far more removed from you where you have little recourse. So as far as incentives go they may be more beholden to some law enforcement agency than you the non-customer.

There are difference, but it does not appear to be an obvious improvement to me.

Re: Comcast, Mozilla strike privacy deal to encrypt DNS lookups in Firefox

#105

Post by floatingatoll »

surround wrote: post #96

I’ve never understood the purpose of DOH. It doesn’t really hide your traffic from any party, does it?

It encrypts your DNS traffic over the public wire in a way that only the DOH endpoint operator can decrypt, preventing plaintext interception/modification attacks by unauthorized malicious actors positioned between you and the DOH endpoint

It represents your DNS traffic over the wire as encrypted HTTPS traffic, which decreases the effectiveness of deep packet inspection and traffic shaping systems operated by some network providers.

When hosted at heavily-used CDN endpoints that receive other (non-DOH) HTTPS traffic, it requires a network provider who wishes for whatever reason to block your DNS traffic to block all HTTPS traffic to all CDN endpoints.

Re: Comcast, Mozilla strike privacy deal to encrypt DNS lookups in Firefox

#106

Post by sprayk »

entropicdrifter wrote: post #70
sprayk wrote: post #47

Earlier quoted context omitted.

How would encrypting DNS help me avoid Comcast MITMing my HTTP traffic to inject bandwidth cap notifications? Doesn't the system just inject a script tag into the appropriate place in the HTTP response?

HTTPS Everywhere + encrypted DNS blocks a huge chunk of what they can see without expending effort on you in particular

that is not what I was asking. GP claimed that encrypted DNS would stop comcast from injecting notifications into HTTP traffic, I want to know how that would work, in the hopes that my assumptions about the system are wrong.

Re: Comcast, Mozilla strike privacy deal to encrypt DNS lookups in Firefox

#107

Post by pwdisswordfish2 »

jlivingood wrote: post #55
jlgaddis wrote: post #46

Let me make sure I've got this right: * Comcast sniffs / records / tracks their user's DNS traffic * Mozilla announced they would enable DoH by default, to protect end user's DNS data from shady ISPs like Comcast * Comcast then raised hell about Mozilla's decision (presumably because they would no longer have access to this data) * Now, Comcast and Mozilla come to some sort of agreement which effectively restores Com…

> Comcast sniffs / records / tracks their user's DNS traffic Actually not only does Comcast say they don't do that ( https://www.xfinity.com/privacy/policy/dns ) but now has signed a contract to this effect as well, thereby meeting the same level of commitment as the other TRR operators. This means IMO that Mozilla is doing a good job leading the industry on DNS privacy and convincing many of the merits of a strong p…

Can users enforce that contract if it is breached? Maybe users should be named explicitly as third party beneficiaries.

Mozilla is a company and needs to compensate its CEO and staff. The CEO received $2,458,350 in 2018.^1 Everything Mozilla does cannot be solely for users' benefit. Mozilla, the people behind it, have their own financial interests.

1. https://assets.mozilla.net/annualreport/2018/mozilla-2018-fo...

Re: Comcast, Mozilla strike privacy deal to encrypt DNS lookups in Firefox

#108

Post by causality0 »

jlgaddis wrote: post #46

Let me make sure I've got this right: * Comcast sniffs / records / tracks their user's DNS traffic * Mozilla announced they would enable DoH by default, to protect end user's DNS data from shady ISPs like Comcast * Comcast then raised hell about Mozilla's decision (presumably because they would no longer have access to this data) * Now, Comcast and Mozilla come to some sort of agreement which effectively restores Com…

It would also be a good idea to split your encrypted DNS lookups between as many providers as possible so as to both minimize its value to any one entity and also minimize the amount of data a single bad-faith provider would get.

Re: Comcast, Mozilla strike privacy deal to encrypt DNS lookups in Firefox

#109

Post by pbhjpbhj »

SAI_Peregrinus wrote: post #38
CWuestefeld wrote: post #4

At home I've got a pihole handling my DNS, including using DoH to Cloudflare. I assume that this configuration is superior to whatever FF is doing natively, and I should disable FF's DoH support?

No need to disable Firefox's DoH support, just point it at your pihole as the DoH provider.

How do you do that without accessing each client, like how do I disable DoH on my home network for all devices without having to access all devices?

Re: Comcast, Mozilla strike privacy deal to encrypt DNS lookups in Firefox

#110

Post by sprayk »

willcipriano wrote: post #44
rydre wrote: post #25

Earlier quoted context omitted.

>What you're claiming is false. Cloudflare has over 200 PoPs; in your own name servers, you can use the Cloudflare Resolver's IP (which will be a "close to the user" IP, not 1.1.1.1) to do geotargeting and serve from your closest IP address/server. What if my server is closer than cloudflare? Why is cloudflare artificially limiting?

I use cloudflare precisely because I don't want clients hitting the server directly. That's its entire purpose. For both caching and anti-ddos reasons.

rydre is specifically talking about the perspective of someone running a non-cloudflare CDN or possibly a site that does their own CDN with DNS rather than anycast because they explicitly don't want to use cloudflare for whatever reason. They are not talking about someone just hosting a site.
Post reply on HN