Mozilla’s DNS over HTTPs • Hacker News Board

Re: Mozilla’s DNS over HTTPs

#101

Post by BiteCode_dev » Tue, Feb 25, 2020, 1:53 PM UTC

peteretep wrote: post #98

BiteCode_dev wrote: post #85

Cloud flare is American and we know since the PRISM scandal that US based tech companies are directly plugged into the NSA, and everybody in the chain will deny it under the threat of prison. So, if this rolls out 'as-is' in any other country than the US, we will go from "all DNS requests are clear text, but dispatched among many entities" to "DNS requests are encrypted, but all read and controlled by american agenci…

NSA don’t factor into my personal threat model _at all_ where random ISPs snooping and selling do. I would gladly give the NSA all of my traffic unencrypted in exchange for decent commercial privacy

I supposed not having a dictatorship regime in your country history book helps to see things that way.

Given the way my country went from freedom to "regime de Vichy" in a few years, during my grandpa time, I don't want a state level entity having that kind of power.

Since the US state level entities decided they could now ignore Habeas Corpus and legitimated torture, secret courts and declared impunity for them-self, I especially don't want them to have that kind of power.

Re: Mozilla’s DNS over HTTPs

#102

Post by tbyehl » Tue, Feb 25, 2020, 1:58 PM UTC

cm2187 wrote: post #38

ComputerGuru wrote: post #31

Can someone please explain why there can’t be a DHCP or RA option for which DoH server to use? Why are we going out of our way to make sure the sysadmin has to configure each and every piece of software on each and every single PC rather than just set it one in a centralized location, like every other networking option? DoH will leave my machines unable to resolve all my internal domain names, right?

Is it a big deal to have your internal domain names accessible externally? Many (though not all) DNS server allow private IPs in DNS.

It creates a vulnerability for external devices -- they're trying to communicate with myhost.mydomain.com but really they're talking to whatever device has the same IP address on the network they're attached to.

Some DNS hosters disallow private IPs. Some public resolvers and consumer routers will filter out responses containing private IPs.

Re: Mozilla’s DNS over HTTPs

#103

Post by silon42 » Tue, Feb 25, 2020, 1:58 PM UTC

userbinator wrote: post #82

Jonnax wrote: post #74

Earlier quoted context omitted.

DNS isn't a VPN nor really a security product. It's just a look up table. The job blocking domains should be the job of a firewall. Of course this becomes more complex. But any application can implement DNS over HTTPS. Malware could even just get a list of IPs from another IP. An application can even just hard code IPs rather than using DNS and then they're in the same position.

Tunneling DNS inside HTTPS effectively forms part of a VPN already (and I wonder when Mozilla will decide to also stuff the rest of the traffic through...) DNS-based blocking is not perfect, but is currently still very powerful for things like adblocking. You're basically saying that Firefox is now behaving like malware, which I agree with... Windows 10's telemetry is also another piece of software which has started…

Exactly. To control DoH we need to start to MITM all connections and block everthing else unless whitelisted.

Re: Mozilla’s DNS over HTTPs

#104

Post by 72deluxe » Tue, Feb 25, 2020, 1:59 PM UTC

Spivak wrote: post #55

aduitsis wrote: post #43

If you are a network administrator and want none of this, look at that: https://support.mozilla.org/en-US/kb/canary-domain-use-appli... Basically, make use-application-dns.net. return an error (any kind will do). Filter it in your recursor for example. Having the browser change a fundamental behaviour that used to stand for decades is highly problematic. If nothing else, it is the network administrator who should hav…

This logic makes no sense to me. Can you imagine if AT&T or Spectrum made a statement like this? The “network administrator” is an untrusted 3rd party who should have basically 0 say in how my device operates. The device administrator, ie the owner of the machine, is the one who should have the final say over when DoH is used. The use-application-dns record is for businesses that want an easy way to stop DoH on machi…

So what if I run a Pihole at home as a DNS server and want to stop being able to resolve various domains? I would like to know how to stop all devices (actually worse, individual applications!) on my network deciding to DoH of their own accord (and therefore bypassing my local DNS server).

This kind of centralised ability to block DoH is very useful to me.

Re: Mozilla’s DNS over HTTPs

#105

Post by BiteCode_dev » Tue, Feb 25, 2020, 2:01 PM UTC

rndgermandude wrote: post #93

BiteCode_dev wrote: post #85

Cloud flare is American and we know since the PRISM scandal that US based tech companies are directly plugged into the NSA, and everybody in the chain will deny it under the threat of prison. So, if this rolls out 'as-is' in any other country than the US, we will go from "all DNS requests are clear text, but dispatched among many entities" to "DNS requests are encrypted, but all read and controlled by american agenci…

They only enabled it by default for US users, so at this time it doesn't really matter. shrugs When they roll out in the EU, I will pay close attention to how they are doing it, what partners they use under what jurisdictions etc.

Same.

Gotta also make sure I don't get a US Firefox build somehow.

Re: Mozilla’s DNS over HTTPs

#106

Post by bepvte » Tue, Feb 25, 2020, 2:02 PM UTC

lovelearning wrote: post #84

As a resident of a country whose government and ISPs heavily and habitually censor the Internet for political reasons, I for one truly appreciate Firefox's DoH. They should also enable 'network.security.esni.enabled' by default because the censors here have upgraded from DNS to SNI-based blocking. I get it that better solutions are possible, but got to teach people to first walk before teaching them to run. AFAIK, Ch…

I've noticed some problems with eSNI so far unfortunately. Some domains like discordapp.com have some access points with eSNI enabled and some without, so when clients access the ones without eSNI, they believe that they are under attack. I cannot wait for it to be finished and implemented though, it would be a huge benefit for the privacy of millions.

Re: Mozilla’s DNS over HTTPs

#107

Post by tialaramex » Tue, Feb 25, 2020, 2:03 PM UTC

gumby wrote: post #59

The overhead of setting up and using an https connection is massive compared to DNS which can fit in a UDP transaction. Do they establish a connection and leave it open for a long period? Supporting that would be a big commitment on the part of the resolvers.

Small DNS queries and answers fit in one UDP packet, but larger ones don't and have to be retried as TCP.

HTTPS/2 over TLS 1.3 (which is the baseline you should assume for these relatively new services) is one TCP setup plus potentially 0-RTT TLS on all but the first visit.

0-RTT is safe here because a DNS query is just a question with no side effects. Replay attacks (the risk 0-RTT incurs) don't do anything:

Gumby: "What is the IPv4 address of news.ycombinator.com?" encrypted so that only DoH Server and you can read it

Server: "209.216.230.240" encrypted so that only Gumby and the DoH server can read it

Attacker: Replays Gumby's packet with no knowledge what it means

Server: Same reply, also unintelligible to attacker just like the original

For HTTPS/3 (over QUIC rather than TLS+TCP) it's UDP so the only "overhead" is from the crypto setup which is modest on even a relatively weak machine.

Re: Mozilla’s DNS over HTTPs

#108

Post by bepvte » Tue, Feb 25, 2020, 2:03 PM UTC

Vinnl wrote: post #2

I think this is generally a good thing. Two questions I've often seen surface on HN though weren't answered: 1. Isn't this better implemented at the OS level? 2. Isn't centralisation to two DoH providers more centralised than five large ISPs? Others are probably better suited to answer, but the answers I can think of: 1. Yes, but it is not, so this solution is second-best. If Operating Systems decide to tackle this p…

For point 1, Windows 10 plans to implement this.

Re: Mozilla’s DNS over HTTPs

#109

Post by peteretep » Tue, Feb 25, 2020, 2:04 PM UTC

BiteCode_dev wrote: post #101

peteretep wrote: post #98

Earlier quoted context omitted.

NSA don’t factor into my personal threat model _at all_ where random ISPs snooping and selling do. I would gladly give the NSA all of my traffic unencrypted in exchange for decent commercial privacy

I supposed not having a dictatorship regime in your country history book helps to see things that way. Given the way my country went from freedom to "regime de Vichy" in a few years, during my grandpa time, I don't want a state level entity having that kind of power. Since the US state level entities decided they could now ignore Habeas Corpus and legitimated torture, secret courts and declared impunity for them-self…

If a malicious power takes over your country they’ll hit you with a rubber hose until you give up your secrets much before they give a shit about your internet history, I suspect.

Re: Mozilla’s DNS over HTTPs

#110

Post by bepvte » Tue, Feb 25, 2020, 2:05 PM UTC

userbinator wrote: post #76

ocdtrekkie wrote: post #29

Earlier quoted context omitted.

For one, it’s ironically first being deployed in countries where DNS manipulation by the government isn’t happening (US first generally), but Google has competitive concerns with ISPs getting ad targeting data. I feel like defending against oppressive governments is being used more as an excuse than a driving motivation. The primary concern seems to be that Google really wants to protect its monopoly, and Firefox, as…

Decades of experience have told me that whenever some big organisation wants to do something in the name of "security", it's almost always an excuse to remove freedom and force their control over everyone. Yes, that includes oppressive governments too... but I hardly think that even more centralisation is the solution. The old security vs freedom quote is surprisingly relevant in so many situations today.

This argument can be applied to the encouraging the rollout of HSTS and HTTPS by firefox and google, which cant be disabled very easily by administrators.