Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

NextDNS Joins Firefox’s Trusted Recursive Resolver

blog.mozilla.org

Post reply on HN
Print view View original

121–130 of 146 posts

Re: NextDNS Joins Firefox’s Trusted Recursive Resolver

#121

Post by zrm »

pvg wrote: post #120
zrm wrote: post #119

Earlier quoted context omitted.

You're naming some things that have notoriously bad performance. Being slow doesn't guarantee failure but it sure isn't a feature. And the problem isn't the protocol here, it's the choice of resolver. If the resolver on your LAN made queries using DoH instead of the application itself then your ISP still couldn't read them, but you would regain the benefits of local caching.

They don't have 'notoriously bad performance' because of DNS or lack of some sort of global DNS caching. That just isn't the case. Firefox also didn't honour systemwide proxy settings for a decade+, nobody really cared because it fundamentally didn't matter. If the DNS thing was that important, somebody would have complained about it before. Nobody (statistically) ever did, any more than they did about the proxy thin…

Sure, they had notoriously bad performance for a plurality of reasons. Which also explains the lack of specific complaints. People can tell you that it's slow, that doesn't mean they can tell you every reason why.

Firefox historically being slower than Chrome was for a long time one of main reasons cited by people who switched from Firefox to Chrome. DNS/proxy defaults were certainly not the only reason it was slower but all the little things add up.

And we shouldn't need to use user complaints to gauge performance impact when we can do so directly by measuring page load times etc.

Re: NextDNS Joins Firefox’s Trusted Recursive Resolver

#122

Post by kiwidrew »

tptacek wrote: post #78
kiwidrew wrote: post #74

This extreme focus on DoH is really concerning me. If you're worried about your recursive DNS resolver spying on you, the correct solution is to run your own recursive resolver. I've been running unbound(8) on my OpenBSD systems at home for most of 2019, and (except for the time that I experimented with turning on strict DNSSEC checking) there hasn't been even one time that it has caused me grief. It was as simple as…

Running your own non-DOH recursive server does absolutely nothing to protect your queries from snooping; in fact, it increases your exposure, because every single step in the recursive queries you run are now in plaintext on the wire and each attributable to your server. Running your own recursive DOH server is a fine idea, and easy to do, but then you have little to be angry at Mozilla about, because they're the one…

Running a recursive resolver does protect against one very specific kind of threat: a malicious recursive resolver that has decided to log all of my queries. DoH absolutely does not protect against this specific threat, because it's just a different protocol for speaking to a third-party recursive resolver.

A properly-configured resolver (i.e. one that is doing QNAME minimisation) only reveals a very limited amount of information to each DNS server that it queries. It's akin to the fact that browsing a web site reveals my activity to that site's origin server. I'm not overly concerned about it.

The only threat that DoH protects against is the situation where an adversary is able to observe all of my outbound DNS query traffic. In this very specific scenario (essentially a compromised ISP), then yes, DoH offers better privacy protection. But it's a rather Faustian bargain to make, because in order to receive protection against a malicious ISP, I must instead put my full trust in whomever is operating the DoH resolver. Out of the kettle and into the frying pan, isn't it?

So DoH doesn't solve the problem. It merely lets users transfer their trust from their ISP (with whom they have a legal contractual relationship governed under the laws of their home country) to a large third-party organisation (with whom they do not have a legal contractual relationship).

If it came down to a matter of holding someone to account for a breach of my privacy, I'd sure rather be up against my local ISP as opposed to a faceless global entity such as Google, Cloudflare, or even the Mozilla Foundation.

Re: NextDNS Joins Firefox’s Trusted Recursive Resolver

#123

Post by kiwidrew »

3xblah wrote: post #91
kiwidrew wrote: post #74

This extreme focus on DoH is really concerning me. If you're worried about your recursive DNS resolver spying on you, the correct solution is to run your own recursive resolver. I've been running unbound(8) on my OpenBSD systems at home for most of 2019, and (except for the time that I experimented with turning on strict DNSSEC checking) there hasn't been even one time that it has caused me grief. It was as simple as…

If the user is sitting behind a filtered port 53, e.g., at a hotel, running her own resolver will not solve the problem. This filtering of port 53 may be growing in popularity among ISPs. If it is, then that means users cannot easily choose their own source of DNS data. It becomes necessary to connect to some remote computer you control that can send traffic on port 53 just to send an authoritative DNS query. It is l…

> Otherwise, we are allowing third parties to become the absolute gatekeepers to the sources of authority for finding an IP address. Caches are not authoritative sources of DNS data.

In theory this is what DNSSEC is meant to provide: cryptographic proof that the cache is giving you unmodified data from the zone's authoritative server(s). Unfortunately... it's still very difficult to run a recursive resolver in a "hardened" configuration that strictly enforces DNSSEC validity, and that's without having a potentially-malicious cache in your query path.

The reality is that most networks blocking port 53 are also entirely unaware of DNSSEC, and in such a situation there's really no hope aside from a full-fledged VPN -- or DoH.

So I think DoH absolutely does have some use cases, such as clients using broken hotel/conference networks and laptops that are temporarily using insecure public WiFi access points. But it doesn't belong anywhere near my own, properly-configured home and work networks.

Re: NextDNS Joins Firefox’s Trusted Recursive Resolver

#124

Post by pvg »

zrm wrote: post #121
pvg wrote: post #120

Earlier quoted context omitted.

They don't have 'notoriously bad performance' because of DNS or lack of some sort of global DNS caching. That just isn't the case. Firefox also didn't honour systemwide proxy settings for a decade+, nobody really cared because it fundamentally didn't matter. If the DNS thing was that important, somebody would have complained about it before. Nobody (statistically) ever did, any more than they did about the proxy thin…

Sure, they had notoriously bad performance for a plurality of reasons. Which also explains the lack of specific complaints. People can tell you that it's slow, that doesn't mean they can tell you every reason why. Firefox historically being slower than Chrome was for a long time one of main reasons cited by people who switched from Firefox to Chrome. DNS/proxy defaults were certainly not the only reason it was slower…

I mean, we started with 'does DoH break caching' to which the answer I think is quite clearly 'no' and we're now on to 'do apps doing their own resolving break anything materially important' to which the answer I think is also 'no' and yours is a pretty unspecific 'maybe'. I don't think these are bad or unwarranted questions (a lot of the anti-DoH arguments are significantly worse) but I'm fairly confident they have a straightforward, empirically-supported negative answer.

Re: NextDNS Joins Firefox’s Trusted Recursive Resolver

#125

Post by chaz6 »

afiori wrote: post #32
thayne wrote: post #15

Earlier quoted context omitted.

the monitoring and blocking features are not enabled by default. The pricing model is certainly troubling though.

> Completely free during the beta, then free up until about 300,000 DNS queries/month — $1.99/month for unlimited queries. > We may adjust this later on based on actual costs at scale, but it will follow this logic. >We will accept credit, debit and prepaid cards, PayPal, cryptocurrencies and other popular payment platforms. In what sense is it troubling? I have never looked at a DNS pricing page before today, but th…

Firefox will need a new error page ERR_DNS_NEEDS_PAYMENT

Re: NextDNS Joins Firefox’s Trusted Recursive Resolver

#126

Post by icebraining »

autoexec wrote: post #99
icebraining wrote: post #51

Earlier quoted context omitted.

> This is actually why I use my own DNS server and resolve against the root, like anyone else who cares about privacy ought to be doing. How do you prevent the ISP from logging those requests to the root?

Unless you're connected to a VPN 100% of the time wouldn't your ISP already have access to see every domain you browse to?

They do via the SNI header, but Firefox already includes support for encrypted SNI. So if the server supports that, all the ISP gets is the IP of the server you're connecting to. If that IP only hosts a single domain, then they can still tell, but in other cases (think sites behind Cloudflare, or using shared load balancers), they can't.

Or actually, they might still, using side-channel attacks, but it's significantly harder to accomplish, especially at scale.

Re: NextDNS Joins Firefox’s Trusted Recursive Resolver

#127

Post by afiori »

chaz6 wrote: post #125
afiori wrote: post #32

Earlier quoted context omitted.

> Completely free during the beta, then free up until about 300,000 DNS queries/month — $1.99/month for unlimited queries. > We may adjust this later on based on actual costs at scale, but it will follow this logic. >We will accept credit, debit and prepaid cards, PayPal, cryptocurrencies and other popular payment platforms. In what sense is it troubling? I have never looked at a DNS pricing page before today, but th…

Firefox will need a new error page ERR_DNS_NEEDS_PAYMENT

Do you think that it could be possible to fix their monetization strategy?

Also I suspect that in that case NextDNS would just send you to their own page a la WIFI login page.

Re: NextDNS Joins Firefox’s Trusted Recursive Resolver

#128

Post by cassianoleal »

fiddlerwoaroof wrote: post #70
Aaargh20318 wrote: post #69

Earlier quoted context omitted.

> You have a contract with your ISP not to collect and monetize your DNS queries to their DNS servers? You don’t ? Why would you sign up with such an ISP ? My ISP has a very clear privacy policy, and they obviously have to comply with the GDPR as well.

In America, at least, there are only one or two high speed ISPs in any area: and so, unless you want to use DSL or satellite or something and deal with latency/speed issues, you basically pick whoever is fastest for the best price

s/America/the USA/.

In America there is a vast number of countries with varied service providers, and Internet and data protection laws.

Re: NextDNS Joins Firefox’s Trusted Recursive Resolver

#129

Post by vetinari »

incompatible wrote: post #87
stock_toaster wrote: post #62

Earlier quoted context omitted.

> For all the commenters here who think that Google and the other major tech companies are somehow less trustworthy than your ISP? Yeah, I just can't agree with those opinions. Additionally, at least my ISP is doing business in my state/country, so there may be _some_ legal recourse if they screw me too hard.

Your country can also put other obligations on your ISP, such as censorship and data logging.

My country, as most democracies, do that because we the people want them to do it.

Otherwise, you have much bigger problems than DNS.

Post reply on HN