Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Comcast, Mozilla strike privacy deal to encrypt DNS lookups in Firefox

arstechnica.com

Post reply on HN
Print view View original

131–140 of 211 posts

Re: Comcast, Mozilla strike privacy deal to encrypt DNS lookups in Firefox

#131

Post by SheinhardtWigCo »

Nextgrid wrote: post #76
jlgaddis wrote: post #46

Let me make sure I've got this right: * Comcast sniffs / records / tracks their user's DNS traffic * Mozilla announced they would enable DoH by default, to protect end user's DNS data from shady ISPs like Comcast * Comcast then raised hell about Mozilla's decision (presumably because they would no longer have access to this data) * Now, Comcast and Mozilla come to some sort of agreement which effectively restores Com…

I don't understand why Mozilla should care or get involved at all into what Comcast thinks of them. Mozilla introduce a privacy feature in a free, open-source browser. Comcast bitches about it because it prevents them from doing shenanigans, essentially incriminating themselves and proving that the feature is both working as expected and necessary. Why does Mozilla need to care about Comcast's opinion on this, and tr…

> Why does Mozilla need to care about Comcast's opinion on this, and try to work out an "agreement" with them?

Money.

Re: Comcast, Mozilla strike privacy deal to encrypt DNS lookups in Firefox

#132

Post by topranks »

jlgaddis wrote: post #51
jefftk wrote: post #42

Earlier quoted context omitted.

> malware can use DoH to retrieve data without logging suspicious DNS queries on Firewall DNS logs Malware can already query IPs of its choice to learn about other IPs it should contact. DoH doesn't let it do anything new.

In a corporate network, it's pretty common to block all outgoing DNS traffic (53/TCP and 53/UDP), except from the company's DNS servers. In that case, DoH does let malware do something new -- block the company's existing DNS policies, quert logging, and security monitoring!

Not really.

Malware could always use some proprietary wrapping in TLS to hide name resolution.

Domain fronting through Azure is still a thing for instance.

Re: Comcast, Mozilla strike privacy deal to encrypt DNS lookups in Firefox

#133

Post by topranks »

speedgoose wrote: post #34
deeter72 wrote: post #22

Earlier quoted context omitted.

This is why I absolutely despise DoH. SysAdmins have no direct control over it. In my organization we have blocked direct IP access from userspace VLAN's to all known public DNS servers thus forcing all clients to rely on the company DNS servers, which is not the most ideal way to do things.

Why do you want them to rely on the company DNS servers?

Policy.

Not sending my private browsing data/DNS history to a third party (Cloudflare, Google etc.)

Re: Comcast, Mozilla strike privacy deal to encrypt DNS lookups in Firefox

#134

Post by shirro »

Tin foil hat time but I can't help feeling a lot of things promoted as privacy solutions like VPNs and DoH are just aggregating data in a handful of locations so it is easier to intercept. Sure they have privacy policies but are they worth the paper they are written on when state actors are bound by a totally different set of rules?

I recently changed my local dnssec resolver to forward to quad9 and cloudflare using DoT because I was sick of the high latency with DNS resolving on boot. I would forward to my own DoT server if there was some authentication built into it and I could deny other traffic. But I have gone from dns requests being aggregated at my ISP for easy inspection my the democratically elected government of my own country, to a my own dns resolver which while it isn't aggregated is still easy enough to intercept under warrant for local law enforcement (which I generally support) to aggregating my queries in a few logs which are likely in foreign countries where I have no say in how they are used or abused. I am not sure what problem we are trying to solve with this technology.

Re: Comcast, Mozilla strike privacy deal to encrypt DNS lookups in Firefox

#135

Post by SheinhardtWigCo »

beezle wrote: post #126
floatingatoll wrote: post #105

Earlier quoted context omitted.

It encrypts your DNS traffic over the public wire in a way that only the DOH endpoint operator can decrypt, preventing plaintext interception/modification attacks by unauthorized malicious actors positioned between you and the DOH endpoint It represents your DNS traffic over the wire as encrypted HTTPS traffic, which decreases the effectiveness of deep packet inspection and traffic shaping systems operated by some ne…

OK sure but what good is that when my next TCP/UDP activity after a dns lookup is to actually connect to that host? The upstream ISP knows exactly where you are going right? They can store and reverse that info and do with it as they wish.

An IP address is often less specific than a hostname, and will become less useful over time due to IPv4 address space exhaustion and concentration of internet services among a small number of cloud providers. Widespread use of DOH therefore makes it harder for ISPs and middleboxes to interfere without collateral damage. It's far from perfect, but it'll help.

Re: Comcast, Mozilla strike privacy deal to encrypt DNS lookups in Firefox

#137

Post by a1369209993 »

CWuestefeld wrote: post #4

At home I've got a pihole handling my DNS, including using DoH to Cloudflare. I assume that this configuration is superior to whatever FF is doing natively, and I should disable FF's DoH support?

Strictly speaking you should run DoH to your pihole, to prevent local-network attacks, but that's a fairly minor issue and supposedly (epistemic status: outright hearsay) DoH is intentionally difficult to configure correctly (ie to a non-mozilla-approved server).

Re: Comcast, Mozilla strike privacy deal to encrypt DNS lookups in Firefox

#138

Post by nerdponx »

pbhjpbhj wrote: post #98
heavyset_go wrote: post #77

Earlier quoted context omitted.

> I'm really confused why Mozilla would agree to this. If it's anything like their CloudFlare deals, then Mozilla did this because they were able to secure contracts that provide additional privacy protections for Mozilla's customers that the parent company doesn't normally provide to end-users. In theory, those contracts should be enforceable in court. Whether or not you think the companies Mozilla contracts with wi…

Who are Mozilla's customers? Google are to a close approximation the only ones who pay them??

The optimist would say s/customer/donor but I'm not an optimist.

Re: Comcast, Mozilla strike privacy deal to encrypt DNS lookups in Firefox

#139

Post by daguava »

Regardless of how good this deal actually is, I have a knee-jerk reaction to anything regarding Comcast.

I would not trust them with anything whatsoever.

Mozilla even if they made a good decision here seems to be taking a step backwards just by virtue of associating with Comcast in any slight form whatsoever.

Re: Comcast, Mozilla strike privacy deal to encrypt DNS lookups in Firefox

#140

Post by a1369209993 »

sprayk wrote: post #116
parliament32 wrote: post #74

Earlier quoted context omitted.

You should just use anycast for that instead of trying to shoehorn it in with DNS trickery.

It's interesting that the DNS-based solution is considered "trickery", when I don't really know anyone except for very networking-focused people who can explain how anycast works to achieve the same thing. While BGP is definitely not magic, it feels way more magic to me than DNS. The DNS-based solution, in comparison, seems way simpler to explain: get general location of IP of requester, send back the IP of a server…

> I don't really know anyone except for very networking-focused people who can explain how anycast works to achieve the same thing.

I'm not familiar with the crap the IETF et al have smeared on it, but in principle, it's very simple: each network vertex maintains a mapping from (blocks of) addresses to edges (and the neighbors on the other ends of each edge) moving closer to that address, such that the directed edges for any given address form a rooted directed graph (ie a tree) where the root is the host with that address. Anycast just relaxes the requirement that the latent directed graph for a anycast address form a single tree with a single root, and instead allows multiple trees and roots forming a exact cover of the network. Updates still try to find the neighbor with the shortest round-trip time, but now there can be multiple network vertices with RTT=0 (ie multiple servers with the same anycast address).

Post reply on HN