Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Comcast, Mozilla strike privacy deal to encrypt DNS lookups in Firefox

arstechnica.com

Post reply on HN
Print view View original

121–130 of 211 posts

Re: Comcast, Mozilla strike privacy deal to encrypt DNS lookups in Firefox

#121

Post by grishka »

solarkraft wrote: post #23
Skunkleton wrote: post #21

Earlier quoted context omitted.

> Route DNS to trusted non-profit entities. I'm sure you know this, but some readers might not. DNS is totally insecure. Even if you change your DNS server from the default to 1.1.1.1 or whatever, your ISP can and does still read and/or intercept these requests. This sort of interference is absolutely trivial to implement, even at scale. Don't think it isn't happening to you.

... which is exactly why DoH is gaining attention. But I keep wondering: Can't the ISP trivially correlate the accessed IP addresses with their corresponding sites even without DNS query data?

Also don't forget about SNI. This exposes the domain you're connecting to over TLS. Yes, I know eSNI is a thing, but it's new and so unlikely to be deployed much.

Re: Comcast, Mozilla strike privacy deal to encrypt DNS lookups in Firefox

#122

Post by gsich »

jlgaddis wrote: post #46

Let me make sure I've got this right: * Comcast sniffs / records / tracks their user's DNS traffic * Mozilla announced they would enable DoH by default, to protect end user's DNS data from shady ISPs like Comcast * Comcast then raised hell about Mozilla's decision (presumably because they would no longer have access to this data) * Now, Comcast and Mozilla come to some sort of agreement which effectively restores Com…

>Now, Comcast and Mozilla come to some sort of agreement which effectively restores Comcast's access to their customer's DNS traffic?

They could (and can) do that regardless of DNS. Most websites and other services are uniquely identifiable by their IP(-range).

Encrypted SNI is still a draft so not applicable here.

Re: Comcast, Mozilla strike privacy deal to encrypt DNS lookups in Firefox

#123

Post by gsich »

jlgaddis wrote: post #67
Paul-ish wrote: post #60

Earlier quoted context omitted.

If Comcast sells DNS data now, they open themselves up to penalties from the both FTC and Mozilla. FTC because they enforce privacy policies, and Mozilla because of the contract they have. I would say this Mozilla changing the overall ecosystem for the better.

Do we know what the actual penalties are? I have trouble believing that they are of any substance. Additionally, I think it's safe to say that Comcast has years and years of experience in finding "loopholes" and/or other "workarounds" in its agreements. > I would say this Mozilla changing the overall ecosystem for the better. You obviously have much more faith in Comcast than I do. Let's hope you're right.

No. And Mozilla can't verify it either.

Re: Comcast, Mozilla strike privacy deal to encrypt DNS lookups in Firefox

#124

Post by bad_user »

ohnope wrote: post #111

I'm confused. For me, a major selling point of DoH is it hides DNS queries from your ISP, which has detailed personal information about you. And if you're locked into Comcast, you're operating with completely eroded trust from the get-go. Clearly, DNS statistics are extremely valuable to Comcast, or they would not have engaged with Mozilla to get back the data, nor would they have raised hell with Congress. I would n…

Mozilla cannot enable one provider by default. People already complained that Cloudflare was initially the only choice.

Users at the moment are expected to choose their provider anyway.

This deal is about Mozilla picking Comcast by default for Comcast customers. This is essentially as if they'd be using the network's default, because Comcast is the network's default already, being what people get via DHCP.

They can always choose a different provider. And Mozilla apparently struck a privacy deal with them too.

Re: Comcast, Mozilla strike privacy deal to encrypt DNS lookups in Firefox

#125

Post by proverbialbunny »

sprayk wrote: post #106
entropicdrifter wrote: post #70

Earlier quoted context omitted.

HTTPS Everywhere + encrypted DNS blocks a huge chunk of what they can see without expending effort on you in particular

that is not what I was asking. GP claimed that encrypted DNS would stop comcast from injecting notifications into HTTP traffic, I want to know how that would work, in the hopes that my assumptions about the system are wrong.

You make a good point. I worked on the code before encrypted DNS was a thing (or anything I knew about) so I'm going off of theory, not first hand experience.

When a request is sent for a http web page it is ran through the layer 4 proxy. In there is a user profile where http injection can occur. It works by injecting JavaScript into the end of the web page.

If the dns request is encrypted all of the handshaking goes through tls bypassing the proxy's view of this data for everything except disconnected http body data. However, it could be that as years have gone by it's been updated to take in http data without any sort of head and then it would work again. It's probably as simple as running some regex looking for .

So, me in my half awake state this morning didn't really think it through. In previous versions of the software this wouldn't be supported, but in hindsight it's not a terribly difficult problem to fix, so Comcast probably does support HTTP injection even when using encrypted DNS by now. My apologies.

Re: Comcast, Mozilla strike privacy deal to encrypt DNS lookups in Firefox

#126

Post by beezle »

floatingatoll wrote: post #105
surround wrote: post #96

I’ve never understood the purpose of DOH. It doesn’t really hide your traffic from any party, does it?

It encrypts your DNS traffic over the public wire in a way that only the DOH endpoint operator can decrypt, preventing plaintext interception/modification attacks by unauthorized malicious actors positioned between you and the DOH endpoint It represents your DNS traffic over the wire as encrypted HTTPS traffic, which decreases the effectiveness of deep packet inspection and traffic shaping systems operated by some ne…

OK sure but what good is that when my next TCP/UDP activity after a dns lookup is to actually connect to that host? The upstream ISP knows exactly where you are going right? They can store and reverse that info and do with it as they wish.

Re: Comcast, Mozilla strike privacy deal to encrypt DNS lookups in Firefox

#127

Post by WatchDog »

sprayk wrote: post #116
parliament32 wrote: post #74

Earlier quoted context omitted.

You should just use anycast for that instead of trying to shoehorn it in with DNS trickery.

It's interesting that the DNS-based solution is considered "trickery", when I don't really know anyone except for very networking-focused people who can explain how anycast works to achieve the same thing. While BGP is definitely not magic, it feels way more magic to me than DNS. The DNS-based solution, in comparison, seems way simpler to explain: get general location of IP of requester, send back the IP of a server…

Running any connection/TCP based service on an anycast IP seems to require a large and effective network operations team.

Dealing with BGP route flapping, single connection traffic being split between different servers, is a difficult problem that requires extensive relationships among other network operators.

Implementing EDNS Client Subnet, on the other hand is pretty simple.

Re: Comcast, Mozilla strike privacy deal to encrypt DNS lookups in Firefox

#128

Post by mantap »

pbhjpbhj wrote: post #103
ta576248_743568 wrote: post #15

Earlier quoted context omitted.

My understanding is that Comcast signs a legally-binding contract with Mozilla which imposes the requirements on them [0]. This obviously isn't perfect protection, but it substantially increases the risk of failing to adhere to the requirements. Mozilla claims "We intend to publicly document violations of this Policy and take additional actions if necessary." [1]. Presumably the additional actions include suing for d…

Surely damages will be approximately zero? There has to be something else to sway Comcast's executives to abide by the contract, surely. Like the CEO agrees to forfeit an amount equal to their previous years total earnings, from all sources, ... that would be an interesting contract!

If Comcast breaks the contract then Mozilla will simply change the default back to Cloudflare DNS.

Re: Comcast, Mozilla strike privacy deal to encrypt DNS lookups in Firefox

#129

Post by ohnope »

bad_user wrote: post #124
ohnope wrote: post #111

I'm confused. For me, a major selling point of DoH is it hides DNS queries from your ISP, which has detailed personal information about you. And if you're locked into Comcast, you're operating with completely eroded trust from the get-go. Clearly, DNS statistics are extremely valuable to Comcast, or they would not have engaged with Mozilla to get back the data, nor would they have raised hell with Congress. I would n…

Mozilla cannot enable one provider by default. People already complained that Cloudflare was initially the only choice. Users at the moment are expected to choose their provider anyway. This deal is about Mozilla picking Comcast by default for Comcast customers. This is essentially as if they'd be using the network's default, because Comcast is the network's default already, being what people get via DHCP. They can a…

I understand the arrangement. From a Comcast user’s perspective, very little has changed, depending on how much trust you assign to a “we promise” privacy agreement. Are Comcast users better off than default? Yes. But decoupling DNS from ISPs which sit in such a privileged position is, for me, 85% of the threat model.

I’d like to read more about how the choice will be presented to users, beyond about:config. I’d also like to understand more the community’s reaction to Cloudflare default.

What if there was a round robin setup between neutral operators? Pairing Comcast users to Comcast just seems like a wtf move.

Re: Comcast, Mozilla strike privacy deal to encrypt DNS lookups in Firefox

#130

Post by topranks »

CWuestefeld wrote: post #4

At home I've got a pihole handling my DNS, including using DoH to Cloudflare. I assume that this configuration is superior to whatever FF is doing natively, and I should disable FF's DoH support?

It’s basically the same minus the filtering.

Cloudflare are getting all your browsing info from DNS.

Your ISP from SNI.

Post reply on HN