Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Turn off DoH, Firefox

ungleich.ch

Post reply on HN
Print view View original

341–350 of 422 posts

Re: Turn off DoH, Firefox

#341

Post by toupeira »

diffeomorphism wrote: post #309
gommm wrote: post #276

As someone who has donated to Mozilla over the years and used Firefox as much as possible, this makes me very unlikely to donate in the future. People say that it's trivial to change. It's trivial to change for us who are technically minded. It's far from obvious and will not be changed by non-technical users. This will only increase the massive amount of data that Cloudflare gets about people's online behavior. I am…

> This will only increase the massive amount of data that Cloudflare gets about people's online behavior No, it explicitly won't. Mozilla has a strong Trusted Recursive Resolver (TRR) policy in place that forbids CloudFlare or any other DoH partner from collecting personal identifying information. To mitigate this risk, our partners are contractually bound to adhere to this policy. https://support.mozilla.org/en-US/k…

Which sounds nice in theory, but there are the usual legal exceptions:

> The resolver must not retain, sell, or transfer to any third party (except as may be required by law) any personal information, IP addresses or other user identifiers, or user query patterns from the DNS queries sent from the Firefox browser.

> Transparency Report. There must be a transparency report published at least yearly that documents the policy for how the party operating the resolver will handle law enforcement requests for user data and that documents the types and number of requests received and answered, except to the extent such disclosure is prohibited by law.

> The party operating the resolver should not by default block or filter domains unless specifically required by law in the jurisdiction in which the resolver operates.

This doesn't really matter if you live in the US, but most of us don't.

Re: Turn off DoH, Firefox

#342

Post by ripdog »

m-p-3 wrote: post #173
isostatic wrote: post #105

> The correct way would be to standardise DoH and DoT and add support into it into automatic address configurations and operating systems. Not in applications! You're right. But so are Mozilla. Here we are 30 years into the web, and we're still using plain old DNS. DNS over TLS should have caught on, but it didn't. Apple and Microsoft had years to ensure it's implemented as standard, but they didn't. The points this…

Agreed, I'd prefer setting up the DNS-over-HTTPS config at the gateway level (and either push the config over DHCP, or have the gateway act as a local resolver, which forwards the new requests over DoH), but we're not there yet.

I use my pfsense router as a DoH recursive resolver, so while DNS is unencrypted inside my local network, all requests are protected when the enter the internet.

Re: Turn off DoH, Firefox

#343

Post by southerntofu »

m-p-3 wrote: post #193
huhtenberg wrote: post #153

Earlier quoted context omitted.

Plaintext doesn't route every god damn request through Google or Cloudfare.

If you have a Chromecast, it's already sending the DNS requests to 8.8.8.8 unless you specifically block the IP.

> If you have a Chromecast

Why the hell would anyone buy hardware from an evil spyware company such as Google?

Of course you can never trust a private corporation to do stuff in the public interest.

Re: Turn off DoH, Firefox

#344

Post by vetinari »

yuft wrote: post #211
vetinari wrote: post #88

Earlier quoted context omitted.

No. The browser has no business in selecting DNS servers; it is a system-wide setting and it should ask the operating system to resolve names. How the operating system resolves names, is up to it. It could use tcp-over-pigeons, if the sysadmin configured it so, and no application should be working around that. If you want to use DoH with Cloudflare, you are free to configure your system to do so. You will also get co…

Maybe if the OS providers were more proactive about DNS over TLS/HTTPS, Mozilla wouldn't have needed to do this to keep users secure.

Android does support DNS-over-TLS, and it does it in a way that does not break networks - whatever it gets from DHCP, it tries the same server with DoT first. Users can also configure their preferred DoT server.

Linux, or at least the glibc-based distributions, have a concept of nss_modules; you can configure whatever mechanism you want, some people are using DNSCrypt or nss-tls, for example. Systemd-resolved, with all the hate it gets, does support DoT. So do other local caching resolvers, like Knot.

With other systems, you would have to discuss that with the respective vendors. Vendors also discuss these issues with customers, and very few customers are fond of breaking their systems. Activism, as Mozilla has shown, is a good way to irritate a good chunk of your user base. The change would have to be gradual, and allow the local admins to be in control (like Android and Linux distributions do).

Re: Turn off DoH, Firefox

#345

Post by southerntofu »

bennyp101 wrote: post #171
magashna wrote: post #160

Earlier quoted context omitted.

Mozilla is only applying this in the US.

To start with

According to a CCC talk about DNS security, Mozilla is going to enable providers on a regional-basis by partnering with privacy-friendly non-profits.

DigitalCourage was one of the names mentioned as a potential EU-based DoH provider.

Re: Turn off DoH, Firefox

#346

Post by cookie_monsta »

comex wrote: post #253
cookie_monsta wrote: post #94

Earlier quoted context omitted.

> The fact that cloudflare is a US entity and thus not subject to UK law is the whole point. As a fellow citizen of a Five Eyes country, I assume that if any of those 5 have info about me that one of the other four wants it won't even be a question of paperwork for it to be shared.

Then it's a good thing that if you use DNS over HTTPS, none of those countries will have the info, since the connection is encrypted to Cloudflare and they will not be logging queries.

Agreed. The connection is indeed encrypted and they are not currently logging queries.

Re: Turn off DoH, Firefox

#347

Post by ripdog »

userbinator wrote: post #50
Chirael wrote: post #16

It seems like this change by Firefox would bypass a pi-hole. Am I understanding it correctly?

...and a local HOSTS file. So now it will, by default, contact all the ad/tracking hosts that you configured to be blocked. "But now your DNS queries to those ad/tracking hosts are encrypted!" No. I don't care. I didn't want to connect to those hosts in the first place.

What's wrong with uBlock Origin?

Re: Turn off DoH, Firefox

#348

Post by ripdog »

Tharkun wrote: post #292
Gaelan wrote: post #216

Earlier quoted context omitted.

Firefox claims they will detect this situation and disable DoH.

Detect it, how? By forwarding the request to a local resolver after DoH fails, and thus leaking information?

Do you... really care if someone outside you network knows the domain you chose for an internal network service?

That's not sensitive information. Also, there's basically no way for cloudflare, even if they were being malicious about it, to collect and use that information. What would they do with it?

Re: Turn off DoH, Firefox

#349

Post by ripdog »

kkarakk wrote: post #128
seanhunter wrote: post #108

Earlier quoted context omitted.

...unless you disable it. However you can configure firefox to use your pi-hole if you can get it serving dns over https. If that's not supported now I would expect it becomes supported very soon.

then some "brave" company like apple/mozilla removes the option to disable it

There is no conceivable reason as to why anyone would remove the ability to configure DNS servers. DNS server options are present in almost all internet-facing applications and devices, from locked-down ecosystems like iOS to touchscreen printers and game consoles. You're just spreading FUD.

Re: Turn off DoH, Firefox

#350

Post by throw0101a »

raxxorrax wrote: post #131
throw0101a wrote: post #97

Earlier quoted context omitted.

> This is especially true in the country the author appears to be based (Germany). Of all the governments to worry about, the ones in the EU (as well as US, CA, AU, NZ), are the ones I'd least be concerned with, relatively speaking. They're enabling this in the US, and yet even with all its problems, it's the one country that the average web surfer would have to worry least about when visiting "inappropriate" sites.…

> Of all the governments to worry about, the ones in the EU (as well as US, CA, AU, NZ), are the ones I'd least be concerned with, relatively speaking. Completely wrong threat assesment in my opinion. You should always be concerned about your own government. It isn't only the axis of evil that imprisons people with leaks about heavy privacy invasions. Russia and China have anything about you and you are a citizen of…

> ... * concerned about your own government.*

Who says I'm not? But I have recourse with government. What recourse do I have with a private corporation that's based in a country with such law privacy laws.

Post reply on HN