Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Comcast, Mozilla strike privacy deal to encrypt DNS lookups in Firefox

arstechnica.com

Post reply on HN
Print view View original

161–170 of 211 posts

Re: Comcast, Mozilla strike privacy deal to encrypt DNS lookups in Firefox

#161

Post by Santosh83 »

SheinhardtWigCo wrote: post #135
beezle wrote: post #126

Earlier quoted context omitted.

OK sure but what good is that when my next TCP/UDP activity after a dns lookup is to actually connect to that host? The upstream ISP knows exactly where you are going right? They can store and reverse that info and do with it as they wish.

An IP address is often less specific than a hostname, and will become less useful over time due to IPv4 address space exhaustion and concentration of internet services among a small number of cloud providers. Widespread use of DOH therefore makes it harder for ISPs and middleboxes to interfere without collateral damage. It's far from perfect, but it'll help.

Provided we get eSNI everywhere too, or it is easy for middlemen to sniff out your actual hostname even though the IP may be shared with thousands/millions of other hosts.

Re: Comcast, Mozilla strike privacy deal to encrypt DNS lookups in Firefox

#162

Post by [deleted] »

godelski wrote: post #156
metaphor wrote: post #151

Earlier quoted context omitted.

> Your employer... It also lobbies for damaging policies. To be sure, jlivingood isn't just some enterprise grunt with an opinion, but VP of Technology Policy & Standards.

Do you have a link for this? This is a pretty big difference in disclosure.

[deleted]

Re: Comcast, Mozilla strike privacy deal to encrypt DNS lookups in Firefox

#163

Post by Ericson2314 »

Everyone is complaining:

- No DOH: "DNS is trivial to snoop"

- DOH with Cloudflair: "DNS is not longer distributed"

- DOH with ISPs: "Great, the ISPs get the data again"

Well, guess what? With the current changes we get rid of the arbitrary snooper problem while preserving DNS as a distributed service: not bad, not amazing, but strictly better than before this all began!

Of course ISPs are sketch, and Comcast in particular, but I rather have multiple providers to play off against each other. The upcoming IETF draft they mention would also restore the ability of network admins to adjust the default DOH (just like with regular DNS)---also good.

Actual anatomized and distributed DNS querying would require vastly different technology that anything being proposed in these comments.

Re: Comcast, Mozilla strike privacy deal to encrypt DNS lookups in Firefox

#164

Post by pwdisswordfish2 »

wrkronmiller wrote: post #147
pbhjpbhj wrote: post #94

Earlier quoted context omitted.

Where can we read the contract?

The policy linked by the article is here: https://wiki.mozilla.org/Security/DOH-resolver-policy#Enforc...

This just leads to a wiki page listing two TRR's, where someone admits that whatever "privacy policies" TRR's provide are not "contracts". Then someone replies that "there are legal contracts between Mozilla and those two listed providers". That does not mean those contracts relate to protecting user privacy. If you dig, there will be nothing there. There is nothing in any contract to protect any user. Neither Mozilla nor TRR's are "on the hook" for protecting user privacy. What I mean by that is that if some user's privacy is breached, there is absolutely zero liability accruing to Mozilla or TRR's.

https://wiki.mozilla.org/index.php?title=User_talk:Wthayer&a...

You, the end-user, will not get to see Mozilla's contracts. Policies are not contracts.

There seems to be some common misunderstandings about "policies" and tech companies are exploiting them. There is nothing legally binding in a policy and in the case the company deviates from the policy, there is no way for an affected user to "enforce" the policy she thought was being adhered to. This is of course assuming anyone outside the company actually discovers that a policy is being violated. Usually policy violations are non-detectable from outside the company.

Re: Comcast, Mozilla strike privacy deal to encrypt DNS lookups in Firefox

#165

Post by hellcow »

godelski wrote: post #156
metaphor wrote: post #151

Earlier quoted context omitted.

> Your employer... It also lobbies for damaging policies. To be sure, jlivingood isn't just some enterprise grunt with an opinion, but VP of Technology Policy & Standards.

Do you have a link for this? This is a pretty big difference in disclosure.

https://blog.mozilla.org/blog/2020/06/25/comcasts-xfinity-in...

Compare the username to the "Vice President, Technology Policy and Standards at Comcast Cable" in this blog post.

Re: Comcast, Mozilla strike privacy deal to encrypt DNS lookups in Firefox

#166

Post by muizelaar »

nvr219 wrote: post #148
roblabla wrote: post #92

Earlier quoted context omitted.

> With all due respect, I have personally had contracts with Comcast in the past and have experienced firsthand how well they honor those -- and I am certainly not the only one! Consumer contracts? Because Mozilla having a business contract with Comcast is certainly not the same as you having a consumer contract - Mozilla has the resources to drag Comcast to court should they be found to ignore the agreement.

> Mozilla has the resources to drag Comcast to court They do not. Look at Mozilla's 1099 for proof.

Mozilla took Verizon to court.

Re: Comcast, Mozilla strike privacy deal to encrypt DNS lookups in Firefox

#167

Post by [deleted] »

beezle wrote: post #126
floatingatoll wrote: post #105

Earlier quoted context omitted.

It encrypts your DNS traffic over the public wire in a way that only the DOH endpoint operator can decrypt, preventing plaintext interception/modification attacks by unauthorized malicious actors positioned between you and the DOH endpoint It represents your DNS traffic over the wire as encrypted HTTPS traffic, which decreases the effectiveness of deep packet inspection and traffic shaping systems operated by some ne…

OK sure but what good is that when my next TCP/UDP activity after a dns lookup is to actually connect to that host? The upstream ISP knows exactly where you are going right? They can store and reverse that info and do with it as they wish.

[deleted]

Re: Comcast, Mozilla strike privacy deal to encrypt DNS lookups in Firefox

#168

Post by pabs3 »

SheinhardtWigCo wrote: post #135
beezle wrote: post #126

Earlier quoted context omitted.

OK sure but what good is that when my next TCP/UDP activity after a dns lookup is to actually connect to that host? The upstream ISP knows exactly where you are going right? They can store and reverse that info and do with it as they wish.

An IP address is often less specific than a hostname, and will become less useful over time due to IPv4 address space exhaustion and concentration of internet services among a small number of cloud providers. Widespread use of DOH therefore makes it harder for ISPs and middleboxes to interfere without collateral damage. It's far from perfect, but it'll help.

You might want to read this study on that topic:

"What can you learn from an IP?" https://irtf.org/anrw/2019/slides-anrw19-final44.pdf

Re: Comcast, Mozilla strike privacy deal to encrypt DNS lookups in Firefox

#169

Post by pabs3 »

gsich wrote: post #122
jlgaddis wrote: post #46

Let me make sure I've got this right: * Comcast sniffs / records / tracks their user's DNS traffic * Mozilla announced they would enable DoH by default, to protect end user's DNS data from shady ISPs like Comcast * Comcast then raised hell about Mozilla's decision (presumably because they would no longer have access to this data) * Now, Comcast and Mozilla come to some sort of agreement which effectively restores Com…

>Now, Comcast and Mozilla come to some sort of agreement which effectively restores Comcast's access to their customer's DNS traffic? They could (and can) do that regardless of DNS. Most websites and other services are uniquely identifiable by their IP(-range). Encrypted SNI is still a draft so not applicable here.

> Most websites and other services are uniquely identifiable by their IP(-range).

You are very correct about that:

"What can you learn from an IP?" https://irtf.org/anrw/2019/slides-anrw19-final44.pdf

Basically Encrypted Client Hello (the new name for eSNI) and DoH/DoT are only useful for websites hosted on global CDN providers like Akamai, Cloudflare and so on.

Re: Comcast, Mozilla strike privacy deal to encrypt DNS lookups in Firefox

#170

Post by pabs3 »

SAI_Peregrinus wrote: post #37
solarkraft wrote: post #23

Earlier quoted context omitted.

... which is exactly why DoH is gaining attention. But I keep wondering: Can't the ISP trivially correlate the accessed IP addresses with their corresponding sites even without DNS query data?

Only for sites with dedicated IPs. If they're hosted on some sort of cloud service then the ISP has to sniff the SNI data. And with ESNI coming to encrypt it that hole will be plugged soon.

I found this study interesting:

"What can you learn from an IP?" https://irtf.org/anrw/2019/slides-anrw19-final44.pdf

So essentially ESNI/DoH are only useful for websites on global CDN providers? Why would Mozilla be interested in enhancing those companies profits?

Post reply on HN