What's the point. All the Firefox extensions know ever site you visit. you're just denying it one but allowing others, sort of a gate keeper on who gets to pry
Mozilla’s DNS over HTTPs
381–390 of 777 posts
Re: Mozilla’s DNS over HTTPs
#382I'm so sad to see Mozilla move forward with this massive attack on user privacy. Firefox DoH is snake oil, plain and simple. It sends all the users DNS queries to Cloudflare, adding a new party which can surveil the user's traffic (and can be legally compelled to do so and not disclose this fact)-- providing a convenient choke point to save spies and hackers the trouble and exposure of extracting the data from tens o…
It's a balance. Do you want your plaintext DNS request sent to starbucks or your local unsecured public wifi, or do you want it sent encrypted to your DoH server of choice?
I can use a VPN when browsing on those kind of networks.
Re: Mozilla’s DNS over HTTPs
#383If you are a network administrator and want none of this, look at that: https://support.mozilla.org/en-US/kb/canary-domain-use-appli... Basically, make use-application-dns.net. return an error (any kind will do). Filter it in your recursor for example. Having the browser change a fundamental behaviour that used to stand for decades is highly problematic. If nothing else, it is the network administrator who should hav…
I'd guess that the overwhelming majority of Mozilla's users do not have a "network administrator" looking after issues like this for them. All they have is an ISP, and the ISP is not on the user's side.
Everyone who uses DNS-based content filtering (OpenDNS, a "Pi Hole", etc) to do filtering on a home network is a "network administrator".
Re: Mozilla’s DNS over HTTPs
#384Earlier quoted context omitted.
Marketers using hardcoded private servers are the easiest thing to defend against: just block those servers. That fact is one of the big reasons why marketers and other spies don't do that -- they use DNS lookups to find the mother ship. However, now marketers can use DoH, combined with public servers that would cause disruption to block, to be able to engage in lookups without a means of detecting or blocking them s…
If you are going to that level of effort then why not just block the IPs of the marketing servers themselves?
That is an ineffective approach for a number of reasons. This is essentially a blacklist approach, and blacklist approaches are very weak.
The number of such servers is in the several thousands, at least. They also move and new ones spin up, requiring constant updating of the blacklist.
It's much more effective to take a whitelist approach or, what I do, just block the DNS lookups for them all.
(That said, I do keep such a blacklist, as one small part of my multilayered security approach.)
Re: Mozilla’s DNS over HTTPs
#385What difference does it make? Even if the DNS queries are completely encrypted, subsequent HTTPS requests made after domain resolution will contain the destination domain (but not the path or request body) in the clear. What makes you assume that ISPs aren't already collecting this information?
The Host header is encrypted when using HTTPS and the SNI is encrypted when using ESNI. In the best scenario (DoH + HTTPS + ESNI), ISPs only get the destination IP, not the destination domain.
The how many IP does pornhub.com have?
Re: Mozilla’s DNS over HTTPs
#386If you're about to comment on how dumb this is because SNI isn't encrypted please halt and search "ESNI"
Draft only. OpenSSL doesn't support it - because it's still a draft. So as of now, ESNI does not provide anything.
Re: Mozilla’s DNS over HTTPs
#387I predict that DoH will break many enterprise infrastructures that rely on custom DNS servers. Unwary sysadmins that update Firefox will be in a lot of trouble when they switch this on by default. We ourselves have a custom DNS setup with an only internally resolvable TLD as a security measure, so this change will break our infra for all Firefox users (thankfully we’re in the EU so we’re spared, for now). Good thing…
There is already support for enterprise situations like you describe: https://support.mozilla.org/en-US/kb/canary-domain-use-appli...
Re: Mozilla’s DNS over HTTPs
#388Seems very marginal for privacy when people in the middle can still see the IP you're connecting to, just not which DNS record you may have retrieved the IP with.
Run wireshark on an ssl connection. The server certificate is sent in plaintext. It includes the DNS name of the server you connected to. DoH would make sense in a world where that was fixed. (Though DNS over TLS is also a thing, and makes strictly more sense than DoH from what I can tell...)
[deleted]
Re: Mozilla’s DNS over HTTPs
#389Earlier quoted context omitted.
I still don't trust them. Clouldflare is simply way too big and has done a lot of shady controversial stuff. I also feel like this is breaking something fundamental about the operating system. DNS queries are now going to be different between your browser and ... the rest of your operating system. How does Firefox deal with corporate installations and internal DNS?
> How does Firefox deal with corporate installations and internal DNS? Everything is configurable and there are canaries to override that.
> Everything is configurable
But how many people are going to change it from the default?
Re: Mozilla’s DNS over HTTPs
#390Earlier quoted context omitted.
Mozilla claims that Cloudflare is not paying them, and claims that they have a contract with cloudflare which prohibits them from selling the data. I don't think that this improves the situation substantially. The history of internet privacy failures is full of empty and unrealized promises, and no amount of contracts or promises can trump a court order or a NSL. "Has no ability to collect" is the gold standard, and…
ISPs can and do sell your information, and can also be served a warrant or NSL. Cloudflare, by contract, is prohibited from doing the former, which is a net improvement even if they're still subject to the latter. It's an incremental improvement, but a positive one. I would certainly love to see an even better protocol for Internet name resolution that prevents anyone from having name-lookup information, but in the m…
Your ISP, however, is not prevented from collecting and selling your data by DoH. So the addition of default DoH in cloudflare adds an extra party that can intercept your traffic but does not remove any.
> DoH seems like a huge step forward in ensuring that no unencrypted traffic is visible to the ISP or local network
It does not do this.