Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Turn off DoH, Firefox

ungleich.ch

Post reply on HN
Print view View original

171–180 of 422 posts

Re: Turn off DoH, Firefox

#171

Post by bennyp101 »

magashna wrote: post #160
cesarb wrote: post #102

Earlier quoted context omitted.

The default (which the majority of people will be using) is not Google, it's their ISP. And in the vast majority of cases, their ISP is under the jurisdiction of their country, while Google and Cloudflare have to obey the laws of a foreign country. Said foreign country might one day decide that for instance Google and Cloudflare now have to log the IP address of everyone who does a DNS lookup for news.ycombinator.com…

Mozilla is only applying this in the US.

To start with

Re: Turn off DoH, Firefox

#172

Post by vetinari »

m-p-3 wrote: post #167
vetinari wrote: post #66

Earlier quoted context omitted.

And there are intermediaries between Cloudflare/other DoH providers and the respective authoritative nameservers anyway.

But unless they have the private key for CloudFlare certs, they can't snoop in so it doesn't matter if there are intermediaries in between.

The traffic between Clouflare and the authoritative nameservers will be good old 53/udp.

The only thing the snooper won't be sure with is, which Cloudflare client asked for that record.

Re: Turn off DoH, Firefox

#173

Post by m-p-3 »

isostatic wrote: post #105

> The correct way would be to standardise DoH and DoT and add support into it into automatic address configurations and operating systems. Not in applications! You're right. But so are Mozilla. Here we are 30 years into the web, and we're still using plain old DNS. DNS over TLS should have caught on, but it didn't. Apple and Microsoft had years to ensure it's implemented as standard, but they didn't. The points this…

Agreed, I'd prefer setting up the DNS-over-HTTPS config at the gateway level (and either push the config over DHCP, or have the gateway act as a local resolver, which forwards the new requests over DoH), but we're not there yet.

Re: Turn off DoH, Firefox

#174

Post by apexalpha »

Grimm665 wrote: post #157
ndidi wrote: post #144

Earlier quoted context omitted.

I can think of something worse: sending all your DNS queries to an unregulated third party.

This is already what happens. Your DNS queries have to go somewhere, and unless you control the DNS servers, there's a third party in the loop somewhere.

Not really, my DNS requests go to my ISP's DNS server. And the ISP sees the requests anyway since they are the one forwarding all the packets.

Now, Cloudfare will see them too. (if this would come to my country).

Re: Turn off DoH, Firefox

#175

Post by garganzol »

auslander wrote: post #145

How decisions are made in Mozilla? By whom? Is there public discussion beforehand?

Decisions are made by Google and then handed to Mozilla through a shady process called collusion.

The aim of this process is to play a two-step game in which:

    1. A controversial change is made by either party (be it Google or Mozilla)
    2. Another party does the same, thus cementing the planned direction
In this way, it becomes a weapon of mass control because most people do not know that both parties participate in a shady scheme backed by millions of dollars.

Re: Turn off DoH, Firefox

#176

Post by m-p-3 »

cremp wrote: post #78
userbinator wrote: post #50

Earlier quoted context omitted.

...and a local HOSTS file. So now it will, by default, contact all the ad/tracking hosts that you configured to be blocked. "But now your DNS queries to those ad/tracking hosts are encrypted!" No. I don't care. I didn't want to connect to those hosts in the first place.

Even worse, corporate intranet addresses get leaked. Everyone on this article saying it's FUD is either a framework junky, isn't seeing the bigger picture, or just focus on one wrong thing in the article.

It's actually FUD, because it's missing some important points

> For starters, Mozilla said that after it turns on DoH by default for US users, Firefox will contain a mechanism to detect the presence of any local parental control software or enterprise configurations.

> Additionally, Mozilla is also working with ISPs to make sure users won't use DoH as a way to bypass legally-set blocklists.

> The organization said it's been asking ISPs and providers of network-based parental control solutions to add a "canary domain" to their blocklists. When Firefox will detect that this canary domain is blocked, it will disable DoH to prevent the feature to be used as a filter-bypassing solution.

https://www.zdnet.com/article/mozilla-to-gradually-enable-dn...

Re: Turn off DoH, Firefox

#177

Post by jm4 »

taneq wrote: post #39
Chirael wrote: post #16

It seems like this change by Firefox would bypass a pi-hole. Am I understanding it correctly?

Would it be hard to make pi-hole into a DoH provider so you could just point your browser at it? Or does that defeat the "just works" factor of the pi-hole?

I don’t imagine it would. It might be there already. The real problem was mentioned above. We risk a situation where each app has its own doh config and not all of them allow you to change it. There’s nothing necessarily wrong with doh. It’s that app developers are baking it into apps instead of the OS where it belongs.

Re: Turn off DoH, Firefox

#178

Post by gcp »

askmike wrote: post #57
jfindley wrote: post #47

Earlier quoted context omitted.

You do not have to point your DNS queries to a US company, this is completely false. You can point your DNS queries at whichever DoH provider you want - you can even run your own DoH provider if you want to.

I should have worded that differently: the default is a US company. Which applies to everyone who doesn't change it specifically for Firefox (the vast majority of users).

...users in the US.

Quite an important detail.

Re: Turn off DoH, Firefox

#179

Post by unionpivo »

kbumsik wrote: post #58
coleifer wrote: post #28

There are two points: 1. centralization of all dns lookups is worrisome 2. Dns should not be handled by applications. It should be handled by the operating system. I see a lot of people conflating the two in the comments.

> 2. Dns should not be handled by applications. It should be handled by the operating system. I agree with #1 but why it should be managed by the OS?

Because in most cases you don't want different applications to use different settings.

If you are currently using private DNS server with internal domains and don't know about changes firefox is going to make, firefox will resolve you domains incorectly while all your tools like nslookup and dig will show correct information.

And then when you do figure it out, you will have to go to every single user and help them fix firefox setup. (because most of such small businesses don't have their own AD)

I first though about blocking it at companies firewall level, but thats tricky, because you don't want to break everything else that uses cloudflare.

Re: Turn off DoH, Firefox

#180

Post by [deleted] »

jfindley wrote: post #22

This is painful to read. Masses off unfounded FUD - the article deliberately buries that it's trivial to change your DoH provider if you're silly enough to believe that CF is actively logging DoH requests and selling them (CF is involved with serving vast swathes of the internet anyway - if they wanted to go down this route they have far more lucrative avenues open than selling DNS requests by IP). If instead what yo…

[deleted]
Post reply on HN