Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Turn off DoH, Firefox

ungleich.ch

Post reply on HN
Print view View original

301–310 of 422 posts

Re: Turn off DoH, Firefox

#301

Post by Aissen »

partialrecall wrote: post #277
Aissen wrote: post #156

This is a gross over-simplification. Cloudflare is required by contract to respect your privacy, which is much stronger than even the privacy laws have here in the EU since it addresses everyone, not just the EU population: https://developers.cloudflare.com/1.1.1.1/commitment-to-priv... The people fighting for the status quo probably know how to run their own resolver, even with DoH or DTLS. But Mozilla's conundrum i…

> "This is a gross over-simplification. Cloudflare is required by contract to respect your privacy" How often to corporations take other corporations to court over contract disputes? I think it's pretty often.

It is indeed. We'll see if Mozilla's lawyers are good at writing contracts once the Mozilla vs Oath case resolves:

https://blog.mozilla.org/blog/2017/12/05/mozilla-files-cross...

Re: Turn off DoH, Firefox

#302

Post by diffeomorphism »

tannhaeuser wrote: post #270
jfindley wrote: post #22

This is painful to read. Masses off unfounded FUD - the article deliberately buries that it's trivial to change your DoH provider if you're silly enough to believe that CF is actively logging DoH requests and selling them (CF is involved with serving vast swathes of the internet anyway - if they wanted to go down this route they have far more lucrative avenues open than selling DNS requests by IP). If instead what yo…

Your post is painful to read. Masses of unfounded FUD. > security services, who have very few restrictions on what they are allowed to do with this data. This is especially true in the country the author appears to be based (Germany). The author appears to be from Switzerland, and it's not clear at all why "security services" (who?) in Germany "especially" have few restrictions.

The usual list of security services, BND etc., not sure why adding lists of acronyms is important to you, when "security services" captures the meaning quite well.

> "especially"

That refers to news and new laws in recent years, which extended their surveillance capabilities. Also, it is relevant because Germany both has relative strong data protection against non-state actors, but also quite capable intelligence agencies.

That said, I think arguing about state actors is the wrong threat model for this discussion.

Re: Turn off DoH, Firefox

#303

Post by nullc »

Wow, thats awful that they're sending all user DNS requests to cloudflare without informed consent.

Is this also potentially a violation of federal wiretap law?

My ISP being able to monitor where I connect is not great, but being exposed to my ISP and cloudflare monitoring it is not better-- and is also very unexpected.

There are also at least somewhat clear standards of privacy expected from ISPs, it's entirely unclear to me what duty of care cloudflare has towards users of this service or what position they'd be in to resist further compromise of user data (through either legal or illegal means).

Re: Turn off DoH, Firefox

#304

Post by xorcist »

codedokode wrote: post #225
apexalpha wrote: post #194

Earlier quoted context omitted.

No I mean in my current situation if my ISP is also my DNS provider they will get the requests. But they can already see what sites I visit because they are my ISP and carry my packets. In Mozilla's new default implementation Cloudflare will also see them, without me ever knowing (as an average user).

With TLS1.3, encrypted SNI, encrypted DNS the ISP can only see the IP address you are connecting to, not a domain name. For Google's resources it only sees that you are connecting to Google's network, but is it Youtube or Gmail or Maps, they cannot tell (which is awesome by the way).

SNI isn't super useful to profile customers by itself. Now of course encrypted SNI will be a welcome addition to the protocol, but it won't get rid of traffic profiling.

The destination IP is more than enough to build a customer profile. It's not terribly relevant if you visited Youtube or Maps. Just analyzing netflow logs will give much more information than what services you use, such as for how long you use them and if you stream any media during that time.

Should you wish to have more information than that on your customers you'd have to buy it from someone who runs code in most web pages you visit. There are plenty of those, too.

Re: Turn off DoH, Firefox

#305

Post by the_gipsy »

morpheuskafka wrote: post #252
huhtenberg wrote: post #110

Earlier quoted context omitted.

Don't oversimplify the issue. > it's trivial to change your DoH provider Cloudfare is the default. Cloudfare is the only provider listed. Cloudfare will be On by default, so it will be that for 99.999% of Firefox users. That ain't right no matter how well intended it is.

And for regular DNS, their ISP/employer/school will be the service provider for 99.9999% of users. Regular DNS is not exactly easy to find (on Windows, it's under Settings -> Network -> Change Adapter Options -> Adapter Name -> IPv4 -> Properties), which is arguably as hard as going to about:config. And there is no menu of providers listed--nor does it explain who would choose the "automatic" DNS server options (the…

> So the status quo is no better than this

You're completely missing the point. Users have many different ISPs, and them knowing DNS queries is not a problem because it's the ISP anyway. Now a browser wants to change that behavior, and send ALL queries to one american company.

Re: Turn off DoH, Firefox

#306

Post by diffeomorphism »

cesarb wrote: post #102
magashna wrote: post #72

Earlier quoted context omitted.

And? Those same people are likely using their ISP or Google for DNS right now. How is this worse?

The default (which the majority of people will be using) is not Google, it's their ISP. And in the vast majority of cases, their ISP is under the jurisdiction of their country, while Google and Cloudflare have to obey the laws of a foreign country. Said foreign country might one day decide that for instance Google and Cloudflare now have to log the IP address of everyone who does a DNS lookup for news.ycombinator.com…

Wrong way around.

Said own country might one day decide to restrict access/log visits to controversial site X (e.g. Tibet, government critical news, piratebay etc.), which does not affect your DNS based in foreign country

Re: Turn off DoH, Firefox

#307

Post by nullc »

Aissen wrote: post #156

This is a gross over-simplification. Cloudflare is required by contract to respect your privacy, which is much stronger than even the privacy laws have here in the EU since it addresses everyone, not just the EU population: https://developers.cloudflare.com/1.1.1.1/commitment-to-priv... The people fighting for the status quo probably know how to run their own resolver, even with DoH or DTLS. But Mozilla's conundrum i…

A contract where cloudflare receives no consideration isn't particularly comforting, as such agreements are routinely ignored by courts (or equivalently by capping damages at nothing).

> Mozilla's conundrum is how to protect everyone 's privacy

And exactly how does this protect user's privacy? Instead of the user's ISP being able to see where the user connects now both cloudflare AND the user's ISP (via seeing the connection itself) can tell.

Re: Turn off DoH, Firefox

#308

Post by diffeomorphism »

yosamino wrote: post #184
jfindley wrote: post #22

This is painful to read. Masses off unfounded FUD - the article deliberately buries that it's trivial to change your DoH provider if you're silly enough to believe that CF is actively logging DoH requests and selling them (CF is involved with serving vast swathes of the internet anyway - if they wanted to go down this route they have far more lucrative avenues open than selling DNS requests by IP). If instead what yo…

There's nothing that makes Cloudflare the more "privacy friendly" 3rd party. "Privacy friendly" would be a mechanism by which my desire to communicate with "example.com" involved my computer and the computer at example.com with no third party in between. As it stands Mozilla is switching out our local ISP for CloudFlare without asking our consent which means my traffic data is now spread around one more company - tha…

> that seems like less privacy.

Seems obvious, but is wrong. If there is a really obvious obstacle to anything, which immediately comes to mind, chances are people addressed this already.

In the US, Firefox by default directs DoH queries to DNS servers that are operated by CloudFlare, meaning that CloudFlare has the ability to see users' queries. Mozilla has a strong Trusted Recursive Resolver (TRR) policy in place that forbids CloudFlare or any other DoH partner from collecting personal identifying information. To mitigate this risk, our partners are contractually bound to adhere to this policy.

https://support.mozilla.org/en-US/kb/firefox-dns-over-https

Re: Turn off DoH, Firefox

#309

Post by diffeomorphism »

gommm wrote: post #276

As someone who has donated to Mozilla over the years and used Firefox as much as possible, this makes me very unlikely to donate in the future. People say that it's trivial to change. It's trivial to change for us who are technically minded. It's far from obvious and will not be changed by non-technical users. This will only increase the massive amount of data that Cloudflare gets about people's online behavior. I am…

> This will only increase the massive amount of data that Cloudflare gets about people's online behavior

No, it explicitly won't.

Mozilla has a strong Trusted Recursive Resolver (TRR) policy in place that forbids CloudFlare or any other DoH partner from collecting personal identifying information. To mitigate this risk, our partners are contractually bound to adhere to this policy.

https://support.mozilla.org/en-US/kb/firefox-dns-over-https

Re: Turn off DoH, Firefox

#310

Post by codedokode »

dreamcompiler wrote: post #248
codedokode wrote: post #221

Earlier quoted context omitted.

So the solution could be to make it so that there are many DoH providers and a browser would choose one of them randomly (or by user's choice).

Or -- much better -- use DoT instead of DoH so port 443 isn't getting misused for DNS.

Then it would be easier for an ISP to block encrypted DNS (by port number). It is better to masquerade everything as normal HTTPS to make blocking more difficult.
Post reply on HN