Live data from Hacker News

Firefox 143 for Android to introduce DoH

blog.mozilla.org

41–50 of 121 posts

Re: Firefox 143 for Android to introduce DoH

#41

Earlier quoted context omitted.

Why is DoH in the browser more private than DoH in the OS?

It's not Google. My heuristic is that the bigger the tech giant the more sophisticated, indirect, and obfuscated the sharing/selling of data.

The fact that Google has incurred over $3 billion in fines in recent years specifically for infringing people's privacy should be a consideration!

Re: Firefox 143 for Android to introduce DoH

#42
post #33

>DNS query [...] in the clear. [...] (DoH) plugs this privacy leak [...] no one on the network, not your internet service provider [...] can eavesdrop on your browsing Whoever could see DNS traffic can still see the target you're connecting to...

The promise is especially dangerous when a huge fraction of traffic doesn't use Encrypted Client Hello, [1] so the domain name is sent in the clear with the initial request to the server.

A while back I wrote a quick proof-of-concept that parses packet data from sniffglue [2] and ran it on my very low powered router to log all source IP address + hostname headers. It didn't even use a measurable amount of CPU, and I didn't bother to implement it efficiently, either.

I think it's safe to assume that anyone in a position to MITM you, including your ISP, could easily be logging this traffic if they want to.

[1] https://en.wikipedia.org/wiki/Server_Name_Indication#Encrypt...

[2] https://github.com/kpcyrd/sniffglue

Re: Firefox 143 for Android to introduce DoH

#44

Firefox for Android is some of the worst software I've ever used. A lot of extensions won't work in it, and even Edge Canary is far better with them. It is extremely slow, and the UI is horrible. I'm running it on a device with a Qualcomm SM8635 Snapdragon 8s Gen 3 chipset, and it just crawls. The UI is very unresponsive, and page load times are terrible. It also has to reload the page if it was running in the backgr…

I don't have any issues with it. NoScript and uBlock Origin are working fine for me.

Re: Firefox 143 for Android to introduce DoH

#45
post #6

Earlier quoted context omitted.

Privacy.

Why is DoH in the browser more private than DoH in the OS?

Because there are fewer actors to trust.

In the OS you need to trust (1) the OS vendor, (2) the client vendor & (3) any VPN app or HTTP intermediary that's integrated with OS network APIs.

In the client you need only to trust the client vendor.

Re: Firefox 143 for Android to introduce DoH

#46

Firefox for Android is some of the worst software I've ever used. A lot of extensions won't work in it, and even Edge Canary is far better with them. It is extremely slow, and the UI is horrible. I'm running it on a device with a Qualcomm SM8635 Snapdragon 8s Gen 3 chipset, and it just crawls. The UI is very unresponsive, and page load times are terrible. It also has to reload the page if it was running in the backgr…

That's pretty harsh. It works fine for me. But even if it didn't, I'd still use it just for uBlock Origin.

Re: Firefox 143 for Android to introduce DoH

#47

Firefox for Android is some of the worst software I've ever used. A lot of extensions won't work in it, and even Edge Canary is far better with them. It is extremely slow, and the UI is horrible. I'm running it on a device with a Qualcomm SM8635 Snapdragon 8s Gen 3 chipset, and it just crawls. The UI is very unresponsive, and page load times are terrible. It also has to reload the page if it was running in the backgr…

Edge canary runs on android with full extension support?

Re: Firefox 143 for Android to introduce DoH

#48
post #46

Firefox for Android is some of the worst software I've ever used. A lot of extensions won't work in it, and even Edge Canary is far better with them. It is extremely slow, and the UI is horrible. I'm running it on a device with a Qualcomm SM8635 Snapdragon 8s Gen 3 chipset, and it just crawls. The UI is very unresponsive, and page load times are terrible. It also has to reload the page if it was running in the backgr…

That's pretty harsh. It works fine for me. But even if it didn't, I'd still use it just for uBlock Origin.

I'm running it on a device with a Qualcomm SM8635 Snapdragon 8s Gen 3 chipset, and it just crawls. The UI is very unresponsive, and page load times are terrible.

For youtube background play Brave is much better.

Re: Firefox 143 for Android to introduce DoH

#49

This doesn't address why this needs to be built in to the browser when Android already does DoH by itself. I assume there's a reason, does anyone know what it is?

Android does same-provider auto-upgrade if it determines that the recursive supports DoH (last I checked, if it's on Google's list). However, this means that unless you configure your own resolver, you're vulnerable to whoever controls the network substituting their own resolver. Firefox uses a set of vetted and pre-specified resolvers ("trusted recursive resolvers"), so is less vulnerable to this form of attack. I say "less vulnerable" because by default it will fall back to the system DNS on failure, but you can configure hard-fail.

You may or may not think this is a better design (I was one of the people responsible for Firefox doing things this way, so I do), but hopefully this explains the difference.

See: https://educatedguesswork.org/posts/dns-security-dox/ for more on the difference.

Re: Firefox 143 for Android to introduce DoH

#50

Firefox for Android is some of the worst software I've ever used. A lot of extensions won't work in it, and even Edge Canary is far better with them. It is extremely slow, and the UI is horrible. I'm running it on a device with a Qualcomm SM8635 Snapdragon 8s Gen 3 chipset, and it just crawls. The UI is very unresponsive, and page load times are terrible. It also has to reload the page if it was running in the backgr…

Edge canary runs on android with full extension support?

Yep. Enable extensions in edge://flags/. Then you can use ublock origin. You can install any crx file extension if you enable developer mode.
Post reply on HN