Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Turn off DoH, Firefox

ungleich.ch

Post reply on HN
Print view View original

211–220 of 422 posts

Re: Turn off DoH, Firefox

#211

Post by yuft »

vetinari wrote: post #88
Crinus wrote: post #12

If the single DoH 'server' is the issue, wouldn't having a list of several 'servers' around the globe (hopefully in places where there isn't any form of censorship and preferably though non-commercial institutions) that the browser selects randomly solve this?

No. The browser has no business in selecting DNS servers; it is a system-wide setting and it should ask the operating system to resolve names. How the operating system resolves names, is up to it. It could use tcp-over-pigeons, if the sysadmin configured it so, and no application should be working around that. If you want to use DoH with Cloudflare, you are free to configure your system to do so. You will also get co…

Maybe if the OS providers were more proactive about DNS over TLS/HTTPS, Mozilla wouldn't have needed to do this to keep users secure.

Re: Turn off DoH, Firefox

#212

Post by fulafel »

zzzcpan wrote: post #80
jfindley wrote: post #22

This is painful to read. Masses off unfounded FUD - the article deliberately buries that it's trivial to change your DoH provider if you're silly enough to believe that CF is actively logging DoH requests and selling them (CF is involved with serving vast swathes of the internet anyway - if they wanted to go down this route they have far more lucrative avenues open than selling DNS requests by IP). If instead what yo…

> DNS requests are routinely intercepted and monitored by ISPs in many countries, with the information available to the security services Not true. ISPs typically record and store netflow-like data, very rarely DNS-data (I'd say storing DNS data is even unusual). If ISPs are in a position to get more detailed than netflow data on you they resort to things like deep packet inspection (DPI), which doesn't rely on DNS,…

You might look into "passive DNS" services that collect and provide servies based on DNS data collected by ISPs and carriers. It's often more or less anonymized, and often used for good things too - but not wholly harmless.

Re: Turn off DoH, Firefox

#213

Post by Kim_Bruning »

jfindley wrote: post #22

This is painful to read. Masses off unfounded FUD - the article deliberately buries that it's trivial to change your DoH provider if you're silly enough to believe that CF is actively logging DoH requests and selling them (CF is involved with serving vast swathes of the internet anyway - if they wanted to go down this route they have far more lucrative avenues open than selling DNS requests by IP). If instead what yo…

A minor quibble, but the url ends in .ch, and the company address is in Switzerland. Why do you say the author is in Germany? (Am I missing something?)

Re: Turn off DoH, Firefox

#214

Post by unethical_ban »

seszett wrote: post #31
roblabla wrote: post #18

Earlier quoted context omitted.

> I trust my ISP and government more than a US company I have no formal contract with and the US government. And every single intermediary and whoever else might be listening in? This is an unencrypted plaintext connection. Which is the main point here. The whole "we trust ISP more" thing is completely beside the point. The point is DNS is horribly insecure nowadays, and it is about damn time we switch to something b…

If you use your ISP's DNS servers, there is no intermediary between you and them.

If you use wi-fi without a VPN, you have the coffee shop and the coffee shop's ISP. And anyone listening there. Of course there is cleartext SNI even for SSL connections... but alas.

Re: Turn off DoH, Firefox

#215

Post by Youden »

m-p-3 wrote: post #141
ndidi wrote: post #139

Earlier quoted context omitted.

No, the other viable option is not enabling DoH by default.

privacy-wise, plaintext is the worst option possible.

I disagree, at least in my situation.

My DNS requests traverse my ISP's network to my ISP's DNS server (or my employer's ISP's DNS server if I'm at work).

I live in a country where I have very strong privacy protections and what my ISP can and can't do with my DNS requests is extremely limited.

If my DNS requests are sent to CloudFlare or Google instead, my DNS requests are under American jurisdiction, where I have no rights and both American businesses and the American government can do whatever they please with no real recourse.

Re: Turn off DoH, Firefox

#216

Post by Gaelan »

isostatic wrote: post #116
jamespo wrote: post #103

Earlier quoted context omitted.

Corporations concerned about that should be blocking DoH anyway

Any device at home an go to http://nas and get on my nas, " http://desktop" , " http://router" , and " http://shed" and get on those. How does that work in this bold new future? I'll have to register a domain name and add a bunch of A records for 192.168.0.1, but then it still won't work -- I'll have to do " http://desktop.mydomain.com" . Worse, while going to "shed" will work in chrome, it will fail in firefox. My g…

Firefox claims they will detect this situation and disable DoH.

Re: Turn off DoH, Firefox

#217

Post by stefantalpalaru »

jfindley wrote: post #22

This is painful to read. Masses off unfounded FUD - the article deliberately buries that it's trivial to change your DoH provider if you're silly enough to believe that CF is actively logging DoH requests and selling them (CF is involved with serving vast swathes of the internet anyway - if they wanted to go down this route they have far more lucrative avenues open than selling DNS requests by IP). If instead what yo…

> CF is involved with serving vast swathes of the internet anyway

Too involved. Cloudflare also single-handedly killed web browsing over Tor with extremely frequent and hard CAPTCHAS, until users install a browser extension that sets a cookie encrypted using NSA's favourite elliptic curve flavour.

Just a coincidence, I'm sure. Much like their ability to offer free MITM CDN services to so many web sites.

Re: Turn off DoH, Firefox

#218

Post by tssva »

I think this is a horrible idea and applications should respect the OS DNS configuration. I have already configured the instance of dnsmasq on my router at home to return NXDOMAIN for the canary domain.

That being said I am a little confused by those that are concerned because this change would mean their DNS queries will be sent to a US company and they don't trust US companies. Firefox is developed and distributed by a US corporation and is just a susceptible to being forced to follow US government directives as Cloudflare.

Re: Turn off DoH, Firefox

#219

Post by o-__-o »

Youden wrote: post #215
m-p-3 wrote: post #141

Earlier quoted context omitted.

privacy-wise, plaintext is the worst option possible.

I disagree, at least in my situation. My DNS requests traverse my ISP's network to my ISP's DNS server (or my employer's ISP's DNS server if I'm at work). I live in a country where I have very strong privacy protections and what my ISP can and can't do with my DNS requests is extremely limited. If my DNS requests are sent to CloudFlare or Google instead, my DNS requests are under American jurisdiction, where I have n…

Couldn’t your isp watch traffic to pull out SNI information?

Re: Turn off DoH, Firefox

#220

Post by codedokode »

> It is clear what Mozilla needs to do: Mozilla can and should revert the change and allow users to easily opt-in.

I think it should be on by default. In my country encrypted DNS makes it more difficult for the government to track what people watch and to block sites.

> And to select or enter the DoH provider instead of defaulting to Cloudflare.

You can enter any DNS server address in Firefox.

While I agree, that it is bad to concentrate all the world's DNS queries in the hands of an entity under US jurisdiction, not encrypting DNS is much worse currently. So Cloudflare and US government are the lesser evil for me.

Also, if there were volunteers running free DoH servers then Mozilla could choose one of them randomly instead of sending all queries to USA.

Post reply on HN