Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Turn off DoH, Firefox

ungleich.ch

Post reply on HN
Print view View original

191–200 of 422 posts

Re: Turn off DoH, Firefox

#191

Post by Crinus »

m-p-3 wrote: post #176
cremp wrote: post #78

Earlier quoted context omitted.

Even worse, corporate intranet addresses get leaked. Everyone on this article saying it's FUD is either a framework junky, isn't seeing the bigger picture, or just focus on one wrong thing in the article.

It's actually FUD, because it's missing some important points > For starters, Mozilla said that after it turns on DoH by default for US users, Firefox will contain a mechanism to detect the presence of any local parental control software or enterprise configurations. > Additionally, Mozilla is also working with ISPs to make sure users won't use DoH as a way to bypass legally-set blocklists. > The organization said it…

> When Firefox will detect that this canary domain is blocked, it will disable DoH to prevent the feature to be used as a filter-bypassing solution.

...then what is the point of having DoH in the first place? Anyone who wants to intercept your DNS traffic will use the canary domain and force Firefox to disable DoH.

Re: Turn off DoH, Firefox

#192

Post by akerro »

Aaargh20318 wrote: post #14
akerro wrote: post #3

Of course, I'd rather trust unecncrypted plaintext DNS queries that go to my ISP and government! If you don't like CF just switch to different provider https://github.com/curl/curl/wiki/DNS-over-HTTPS

> I'd rather trust unecncrypted plaintext DNS queries that go to my ISP and government! I trust my ISP and government more than a US company I have no formal contract with and the US government. Also, there's the whole 'applications should not override system level settings' thing. My DHCP pushes a local (caching) DNS server that also does name resolution for internal services. This change would break that for all Fi…

You can use different DoH server, you can setup your own, that's not a problem

https://www.ghacks.net/2018/04/02/configure-dns-over-https-i...

I use https://odvr.nic.cz/doh

Re: Turn off DoH, Firefox

#193

Post by m-p-3 »

huhtenberg wrote: post #153
m-p-3 wrote: post #141

Earlier quoted context omitted.

privacy-wise, plaintext is the worst option possible.

Plaintext doesn't route every god damn request through Google or Cloudfare.

If you have a Chromecast, it's already sending the DNS requests to 8.8.8.8 unless you specifically block the IP.

Re: Turn off DoH, Firefox

#194

Post by apexalpha »

SAI_Peregrinus wrote: post #189
apexalpha wrote: post #174

Earlier quoted context omitted.

Not really, my DNS requests go to my ISP's DNS server. And the ISP sees the requests anyway since they are the one forwarding all the packets. Now, Cloudfare will see them too. (if this would come to my country).

But your ISP won't see them. They'll see that some requests are being made to Cloudflare, but not anything about the content.

No I mean in my current situation if my ISP is also my DNS provider they will get the requests.

But they can already see what sites I visit because they are my ISP and carry my packets.

In Mozilla's new default implementation Cloudflare will also see them, without me ever knowing (as an average user).

Re: Turn off DoH, Firefox

#195

Post by isostatic »

m-p-3 wrote: post #173
isostatic wrote: post #105

> The correct way would be to standardise DoH and DoT and add support into it into automatic address configurations and operating systems. Not in applications! You're right. But so are Mozilla. Here we are 30 years into the web, and we're still using plain old DNS. DNS over TLS should have caught on, but it didn't. Apple and Microsoft had years to ensure it's implemented as standard, but they didn't. The points this…

Agreed, I'd prefer setting up the DNS-over-HTTPS config at the gateway level (and either push the config over DHCP, or have the gateway act as a local resolver, which forwards the new requests over DoH), but we're not there yet.

In theory isn't it "just" a matter of agreeing a DHCP option number, then having the DHCP client (or vpn client or whatever) be responsible for passing it to applications that want it (including the system resolver, be that mDNSResponder, systemd, glibc, whatever windows uses)

Anyone who wants to can configure their dhcp client to ignore it, or use a different service, you could even have applications doing that too, but this would allow a network operator to tell people where the recommended resource is.

Likewise if you want to change your DNS provider yourself you would have a single location on your machine to do it for the entire OS, rather than having to change 50 different applications.

Re: Turn off DoH, Firefox

#196

Post by paulcarroty »

antientropic wrote: post #48
paulcarroty wrote: post #26

DoH and DoT are very interested technologies, disabling them 'cause Cloudflare is ... strange. From another side, DoH/DoT prevents ISPs/government from DNS modifying/rerouting.

Why is that strange? It seems rather obvious to me why people are reluctant to route all their DNS queries through a for-profit company in a country with no real privacy laws (and one that you have to assume is backdoored by the NSA).

'Cause it not vendor-locked to Cloudflare, you can use your own server.

Re: Turn off DoH, Firefox

#198

Post by dao- »

telmich wrote: post #113
dao- wrote: post #20

Earlier quoted context omitted.

> I trust my ISP and government more than a US company I have no formal contract with and the US government. You're not affected then, because the DoH rollout w/ Cloudflare as the default is only planned for the US.

That is not an argument, it is clear that this is supposed to be deployed by default.

... only for users in the US. Are you aware of other plans?

Re: Turn off DoH, Firefox

#199

Post by cremp »

m-p-3 wrote: post #176
cremp wrote: post #78

Earlier quoted context omitted.

Even worse, corporate intranet addresses get leaked. Everyone on this article saying it's FUD is either a framework junky, isn't seeing the bigger picture, or just focus on one wrong thing in the article.

It's actually FUD, because it's missing some important points > For starters, Mozilla said that after it turns on DoH by default for US users, Firefox will contain a mechanism to detect the presence of any local parental control software or enterprise configurations. > Additionally, Mozilla is also working with ISPs to make sure users won't use DoH as a way to bypass legally-set blocklists. > The organization said it…

I hardly see how the OP is FUD. What the article states is true; just because you can opt-out doesn't mean it's wrong.

Where you are drawing the line is the opt-out to disable it, as opposed to the convention of opt-in.

Think about companies in the 50-200 employee range; As a sysadmin, I have to purposefully go out of my way to put that domain (use-application-dns.net)[1] in my root resolver, and point it to NXDOMAIN.

I can't do it if another provider is managing my DNS (ISP, cloud service...); it also doesn't actually guarantee that it is off.

> If a user has chosen to manually enable DoH, the signal from the network will be ignored and the user’s preference will be honored.

The basic IT mantra has been 'If it aint broke, don't fix it.' Mozilla itself is moving fast and breaking things; which is why we have standards in the first place.

For god sake, there isn't even a proper RFC to select yes or no to DoH.

I, as a sysadmin, must not only implement the domain in my resolver, but I also must keep in my mind that if a user is using Firefox, that there are things it does internally that are not right, and it is easier for me to have my users on Chrome, because it is less of a headache for me.

[1] https://support.mozilla.org/en-US/kb/configuring-networks-di...

Re: Turn off DoH, Firefox

#200

Post by parliament32 »

kbumsik wrote: post #58
coleifer wrote: post #28

There are two points: 1. centralization of all dns lookups is worrisome 2. Dns should not be handled by applications. It should be handled by the operating system. I see a lot of people conflating the two in the comments.

> 2. Dns should not be handled by applications. It should be handled by the operating system. I agree with #1 but why it should be managed by the OS?

Same reason applications use syscalls instead of writing low level code to write directly to your HDD. The entire point of an OS is to abstract away low-level crap, and DNS is (imo) part of that.
Post reply on HN