Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Turn off DoH, Firefox

ungleich.ch

Post reply on HN
Print view View original

241–250 of 422 posts

Re: Turn off DoH, Firefox

#241

Post by brians »

codedokode wrote: post #221
huhtenberg wrote: post #110

Earlier quoted context omitted.

Don't oversimplify the issue. > it's trivial to change your DoH provider Cloudfare is the default. Cloudfare is the only provider listed. Cloudfare will be On by default, so it will be that for 99.999% of Firefox users. That ain't right no matter how well intended it is.

So the solution could be to make it so that there are many DoH providers and a browser would choose one of them randomly (or by user's choice).

Tor has some nice papers about what happens if you try that: the NSA and KGB each run a server and content themselves with getting a sample of the population.

Re: Turn off DoH, Firefox

#242

Post by yjftsjthsd-h »

avmich wrote: post #237
codedokode wrote: post #225

Earlier quoted context omitted.

With TLS1.3, encrypted SNI, encrypted DNS the ISP can only see the IP address you are connecting to, not a domain name. For Google's resources it only sees that you are connecting to Google's network, but is it Youtube or Gmail or Maps, they cannot tell (which is awesome by the way).

With Tor ISP can't even see the final address, but maybe Tor has its own solutions for DNS?

Onion sites use a keypair as their "name"

Re: Turn off DoH, Firefox

#243

Post by enraged_camel »

userbinator wrote: post #230
gnode wrote: post #120

Earlier quoted context omitted.

> the only thing [browsers] should do is fetch exactly the page URL that was entered and display it. I strongly disagree. Browsers deal with a hostile environment that poses countless threats to their users, and need to be safe. Arguing that browsers should be minimal and not protect privacy is like arguing that cars should be minimal and not have seat belts. There is an argument that ensuring privacy in DNS could be…

I strongly disagree. Browsers deal with a hostile environment that poses countless threats to their users, and need to be safe. Arguing that browsers should be minimal and not protect privacy is like arguing that cars should be minimal and not have seat belts. I strongly disagree. A browser has one job, and that is to follow and render URLs. Secure connections and such are services provided by other components of the…

>> It's really the principle of "do one thing and do it well".

This sounds good on the surface, but falls apart at the smallest level of logical scrutiny.

It's akin to saying, "a car should only accelerate, decelerate and make turns!" After all, that's a car's main purpose.

Whereas the fact of the matter is that modern cars are built to be able to handle all kinds of hostile environments and have numerous defense and safety mechanisms in order to keep their passengers safe.

The same applies to Internet browsers.

Re: Turn off DoH, Firefox

#244

Post by yjftsjthsd-h »

ldng wrote: post #240
codedokode wrote: post #225

Earlier quoted context omitted.

With TLS1.3, encrypted SNI, encrypted DNS the ISP can only see the IP address you are connecting to, not a domain name. For Google's resources it only sees that you are connecting to Google's network, but is it Youtube or Gmail or Maps, they cannot tell (which is awesome by the way).

And down the toilet goes the (distributing and caching) Inter-Net. Long live to the new Cloud-Net. Cloudfare and Google are achieving what Compuserve and AOL could not. Exaggerating slightly ... but not that much really. And all in the good name of privacy and security. It is also amazing how people (Americans ?) are not willing to admit I want MY jurisdiction to apply. Not an American one. I want the choice.

Caching died with insecure HTTP, and that's okay.

> I want the choice.

Then turn it off. But the default protects more people than it harms.

Re: Turn off DoH, Firefox

#245

Post by bzbarsky »

Aaargh20318 wrote: post #14
akerro wrote: post #3

Of course, I'd rather trust unecncrypted plaintext DNS queries that go to my ISP and government! If you don't like CF just switch to different provider https://github.com/curl/curl/wiki/DNS-over-HTTPS

> I'd rather trust unecncrypted plaintext DNS queries that go to my ISP and government! I trust my ISP and government more than a US company I have no formal contract with and the US government. Also, there's the whole 'applications should not override system level settings' thing. My DHCP pushes a local (caching) DNS server that also does name resolution for internal services. This change would break that for all Fi…

Do you ever use wifi in a coffeeshop or hotel?

Because if you do, at that point they are your "ISP" for purposes of this discussion. Do you still trust them more than Cloudflare?

(For a desktop machine, obviously this is not an issue, but for pretty much anyone with a laptop this is something that needs to be worried about.)

As far as internal services, is this a split-horizon setup? As far as I understand, the plan is to detect those and fall back from DoH to normal DNS as needed.

Re: Turn off DoH, Firefox

#246

Post by dreamcompiler »

I had no idea this was going to be the default. It's massively wrong. I use a Pihole DNS server, which means after a lot of debugging I'd have discovered Firefox had unilaterally decided to stop abiding by internet protocols. It's always one step forward and two back with these Moz guys. I guess that's better than every step back like Chrome, but jeez Moz, get a clue.

Re: Turn off DoH, Firefox

#247

Post by AgentME »

falcolas wrote: post #135

It's worth noting that CloudFlare has already proven itself to not be a neutral party - they have proven willing to take sites offline for both legal and social pressure reasons. This will greatly impact the internet's ability to route around censorship as if it were damage.

I agree, only somewhere that hosts neo-nazi websites would be trustworthy enough for this. /s

Re: Turn off DoH, Firefox

#248

Post by dreamcompiler »

codedokode wrote: post #221
huhtenberg wrote: post #110

Earlier quoted context omitted.

Don't oversimplify the issue. > it's trivial to change your DoH provider Cloudfare is the default. Cloudfare is the only provider listed. Cloudfare will be On by default, so it will be that for 99.999% of Firefox users. That ain't right no matter how well intended it is.

So the solution could be to make it so that there are many DoH providers and a browser would choose one of them randomly (or by user's choice).

Or -- much better -- use DoT instead of DoH so port 443 isn't getting misused for DNS.

Re: Turn off DoH, Firefox

#249

Post by comex »

zzzcpan wrote: post #100
akerro wrote: post #3

Of course, I'd rather trust unecncrypted plaintext DNS queries that go to my ISP and government! If you don't like CF just switch to different provider https://github.com/curl/curl/wiki/DNS-over-HTTPS

> I'd rather trust unecncrypted plaintext DNS queries that go to my ISP and government! Your ISP has access to more detailed data on you than DNS queries. Also CF servers are typically located in the same jurisdiction as your government and send unencrypted DNS queries from there. Now instead of dealing with every ISP your government has to deal with just one company in one location, no need to even ask that company…

They can log unencrypted DNS queries coming from Cloudflare, yes. But they can't correlate those with the incoming encrypted queries, not when the amount of traffic coming in is as vast as it will be. It doesn't help much to know "some Firefox user somewhere tried to resolve such-and-such domain".

Re: Turn off DoH, Firefox

#250

Post by methou »

The stated problem is that there are few providers, as for the offending party - Firefox, it's they've defaulted to a company based in the US or a 14 Eyes member.

It doesn't feel right to address the issue by blaming the DoH, or Firefox, as they are not defaulting to the prime evil - Google.

I believe the better suggestion here to say is to set up own DoH servers, urge related parties to opensource their own implementation if there's none.

Post reply on HN