Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Firefox 143 for Android to introduce DoH

blog.mozilla.org

Post reply on HN
Print view View original

21–30 of 121 posts

Re: Firefox 143 for Android to introduce DoH

#21

Post by traceroute66 »

jsheard wrote: post #8
nemomarx wrote: post #3

What's the good DoH provider nowadays? I feel like cloud flare has some downsides in terms of centralization

Mullvad runs a privacy-oriented DoH service, which is free to use regardless of whether you use their VPN service. https://mullvad.net/en/help/dns-over-https-and-dns-over-tls

Mullvad DoH is great, and things like ad-blocking seems to be more effective on Mullvad.

But, and its a BIG BUT ....

Mullvad don't have the geo-coverage that Quad9 has. They are predominantly Northern Europe with very limited server coverage outside (6x Northern Europe, 2xUSA, 1xSingapore)

Which is fine if you spend most of your time in those three places.

But if you are a road-warrior or you live elsewhere, then Quad9 is the better choice as they have global coverage (200 locations, 90 countries).

Avoid Cloudflare. They log traffic. Sure for a short-time period ($n days) but Quad9 still has the better privacy policy.

Quad9 is also Swiss, not US, so they can't be compelled to do anything under PATRIOT or whatever.

Re: Firefox 143 for Android to introduce DoH

#22

Post by grepfru_it »

nemomarx wrote: post #3

What's the good DoH provider nowadays? I feel like cloud flare has some downsides in terms of centralization

For those wanting a bit of privacy, you can run your own DOH server[0]. Be aware that the upstream requests can still be tracked, but additional safety steps can be taken such as hosting your own dns resolver (bind/powerdns), sending dns/doh queries over a vpn or tor connection, or spanning queries over multiple sources. Each has its own security and privacy implications, which is beyond the scope of this comment :)

[0] https://github.com/DNSCrypt/doh-server

Re: Firefox 143 for Android to introduce DoH

#24

Post by noirscape »

LiamPowell wrote: post #2

This doesn't address why this needs to be built in to the browser when Android already does DoH by itself. I assume there's a reason, does anyone know what it is?

Android privacy tools are leaky (which is bad given it's privacy tooling, you don't want that to leak!) Their VPN tools on OS level are pretty notorious for not properly respecting kill switch settings[0].

That alone makes a native browser implementation a better solution than the OS version.

[0]: https://mullvad.net/en/blog/dns-traffic-can-leak-outside-the... is just one example I found on Google (in this case, using the C function getaddrinfo bypasses the tunnel entirely, which Chrome in particular uses for DNS queries - only android API calls respect the tunnel), but you hear about stuff like this every couple years; in that post they also link to a prior incident where connectivity checks and NTP updates were conveniently not using the VPN even when killswitches are active. Neither of these incidents have been fixed as of the time of writing (and Google explicitly doesn't consider conncheck/NTP calls occuring outside of the VPN tunnel to be a bug.)

Re: Firefox 143 for Android to introduce DoH

#25

Post by mrweasel »

grepfru_it wrote: post #22
nemomarx wrote: post #3

What's the good DoH provider nowadays? I feel like cloud flare has some downsides in terms of centralization

For those wanting a bit of privacy, you can run your own DOH server[0]. Be aware that the upstream requests can still be tracked, but additional safety steps can be taken such as hosting your own dns resolver (bind/powerdns), sending dns/doh queries over a vpn or tor connection, or spanning queries over multiple sources. Each has its own security and privacy implications, which is beyond the scope of this comment :)…

Running your own DOH server comes with it's own set of risks, depending on your adversary. If you're the only person using a DOH server, then any requests that server make must belong to you. I'd argue that it's better to use a public server and hide in between the other users.

Re: Firefox 143 for Android to introduce DoH

#30

Post by woodrowbarlow »

ape4 wrote: post #10
seanieb wrote: post #6

Earlier quoted context omitted.

Privacy.

Yeah, Android is Google

does android not allow you to configure a custom DoH resolver? could Mozilla simply offer a public resolver, and encourage users to switch at the OS level (possibly including a first-launch dialog offering to set the configuration for you)?
Post reply on HN