This thing should never be on by default. Mozilla here has decided for me that it is an acceptable layering violation on my system/network. IMHO, this thing is bordering on malware.
Mozilla’s DNS over HTTPs
111–120 of 777 posts
Re: Mozilla’s DNS over HTTPs
#112Earlier quoted context omitted.
> The comment about having “no plans” to enable this outside the USA seems a bit disingenuous The comment actually very clearly says "we do not have plans to roll out the feature in Europe or other regions at this time ". Also I have mixed feelings about this. On one hand yeah, encryption is great and someone sitting between me and my ISP will no longer be able to monitor my DNS queries. On the other hand I don't fee…
> DoH just enables any piece of software or hardware on my network to bypass any security controls I have in place. I think this is an error in how you've thought about the problem. If your "security controls" depend upon other people volunteering to use some protocol then those weren't "security controls" they were more like "guidelines". [ My local airport has a sign and a telephone so that if you've arrived with g…
So I should block outgoing TLS requests to be able to stop DoH?
Seems a bad idea....
At least with DNS I could run a local DNS server and block outgoing port 53 from anything else. Now I no longer have this option and each app gets to look up what it wants, when it wants. Sure, it's great that my ISP cannot see what's in these requests but nor can I! And it also means that any application (eg. any Google product) can query for advertising/tracking domains without me being able to do a thing about it.
It isn't solving a problem - it's creating a far, far worse one (for me).
If I have got this wrong, or there is a method around this - what is it???
Re: Mozilla’s DNS over HTTPs
#113Earlier quoted context omitted.
DNS isn't a VPN nor really a security product. It's just a look up table. The job blocking domains should be the job of a firewall. Of course this becomes more complex. But any application can implement DNS over HTTPS. Malware could even just get a list of IPs from another IP. An application can even just hard code IPs rather than using DNS and then they're in the same position.
Tunneling DNS inside HTTPS effectively forms part of a VPN already (and I wonder when Mozilla will decide to also stuff the rest of the traffic through...) DNS-based blocking is not perfect, but is currently still very powerful for things like adblocking. You're basically saying that Firefox is now behaving like malware, which I agree with... Windows 10's telemetry is also another piece of software which has started…
> I wonder when Mozilla will decide to also stuff the rest of the traffic through
Mozilla has recently begun offering an integrated VPN with Firefox, though unlike DoH that has a monthly subscription fee (hell, I don't blame them for wanting to diversify their revenue). The partner in that case is Mullvad.
> You're basically saying that Firefox is now behaving like malware
This is hyperbole. End users should look out for their own best interests by using any means necessary, which includes hiding as much as they can from the network. If the network doesn't like that, then it has the choice not to allow that user to attach a device to the network.
Re: Mozilla’s DNS over HTTPs
#114Earlier quoted context omitted.
They only enabled it by default for US users, so at this time it doesn't really matter. shrugs When they roll out in the EU, I will pay close attention to how they are doing it, what partners they use under what jurisdictions etc.
Same. Gotta also make sure I don't get a US Firefox build somehow.
You can always disable DNS-over-HTTPS in the network preferences, or set or own resolver, e.g. https://news.ycombinator.com/item?id=22412656
But good point, now I am curious how they detect US-ness. Probably a combination of using the en-US and some geo lookup?
Re: Mozilla’s DNS over HTTPs
#115Earlier quoted context omitted.
I supposed not having a dictatorship regime in your country history book helps to see things that way. Given the way my country went from freedom to "regime de Vichy" in a few years, during my grandpa time, I don't want a state level entity having that kind of power. Since the US state level entities decided they could now ignore Habeas Corpus and legitimated torture, secret courts and declared impunity for them-self…
If a malicious power takes over your country they’ll hit you with a rubber hose until you give up your secrets much before they give a shit about your internet history, I suspect.
Quite the contrary, as shown by as most dictatorships across the world trying to control their piece of the internet. The biggest example being the Big Firewall of China.
This let them control how people think, communicate, consume and inform them-self. But also detects anyone that could oppose the regime. Or make a graph of all allies, suspects, etc.
Then you hit them with a rubber hose :)
Re: Mozilla’s DNS over HTTPs
#116I think this is generally a good thing. Two questions I've often seen surface on HN though weren't answered: 1. Isn't this better implemented at the OS level? 2. Isn't centralisation to two DoH providers more centralised than five large ISPs? Others are probably better suited to answer, but the answers I can think of: 1. Yes, but it is not, so this solution is second-best. If Operating Systems decide to tackle this p…
The ISP can just check which IP you contact, so I don't see this increasing privacy.
That doesn't work anymore. ISPs are not going to block AWS IP ranges or Azure IP ranges, etc. The cloud killed IP blocking. The pirate bay is supposed to be blocked in UK by court order, but because they use cloudflare it's still accessible and only DNS blocked.
Re: Mozilla’s DNS over HTTPs
#117If you are a network administrator and want none of this, look at that: https://support.mozilla.org/en-US/kb/canary-domain-use-appli... Basically, make use-application-dns.net. return an error (any kind will do). Filter it in your recursor for example. Having the browser change a fundamental behaviour that used to stand for decades is highly problematic. If nothing else, it is the network administrator who should hav…
This logic makes no sense to me. Can you imagine if AT&T or Spectrum made a statement like this? The “network administrator” is an untrusted 3rd party who should have basically 0 say in how my device operates. The device administrator, ie the owner of the machine, is the one who should have the final say over when DoH is used. The use-application-dns record is for businesses that want an easy way to stop DoH on machi…
AT&T and Spectrum do not administer your home network, you do. You have the freedom to configure whatever DNS settings you want; if you wish to use their DNS servers you may; if you wish not to, then you may not.
DoH is a non-solution to a non-problem which makes privacy strictly worse by leaking information to Cloudflare in addition to one's ISP.
Re: Mozilla’s DNS over HTTPs
#118Can someone at Mozilla explain why they present what is purely textual content as a PNG? I mean, this is ridiculous: https://ffp4g1ylyit3jdyti1hqcvtb-wpengine.netdna-ssl.com/net...
I noticed that too. Totally inaccessible. Very un-Mozilla like.
Re: Mozilla’s DNS over HTTPs
#119I run my own DNS server. So I trust my own DNS way more than I trust Cloudflare. Is there a way to stop Firefox from using DNS over HTTP?
Re: Mozilla’s DNS over HTTPs
#120Earlier quoted context omitted.
>* People just run a local resolver that supports these things.* How many people do you know that running local resolvers? How would this even work on Windows? The world doesn’t need another encrypted dns solution that only works on Linux
How would this even work on iOS?
You write a network extension, which is what Cloudflare did for their 1.1.1.1 app.