Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Turn off DoH, Firefox

ungleich.ch

Post reply on HN
Print view View original

41–50 of 422 posts

Re: Turn off DoH, Firefox

#41

Post by dao- »

lima wrote: post #19
akerro wrote: post #3

Of course, I'd rather trust unecncrypted plaintext DNS queries that go to my ISP and government! If you don't like CF just switch to different provider https://github.com/curl/curl/wiki/DNS-over-HTTPS

I live in Europe and I do trust my ISP (and government, which has a decent track record at enforcing GDPR). Even with DoH, my ISP already sees all of my network traffic. My DNS queries will effectively be anonymized by their recursive name servers.

> I live in Europe and I do trust my ISP (and government, which has a decent track record at enforcing GDPR).

I believe the GP comment was referring to government surveillance. This is a thing in Europe and GDPR won't protect you from it.

Also, good news for you: Since you live in Europe, the announced switch to DoH with Cloudflare as the default for Firefox users in the US won't affect you.

Re: Turn off DoH, Firefox

#42

Post by chopin »

mantap wrote: post #23

This misses the forest for the trees. In the UK ISPs are already legally mandated to log your web requests and provide them to the government. Those who live under free regimes should not deny those of us who live under oppressive governments the right to privacy of our communications. The fact that cloudflare is a US entity and thus not subject to UK law is the whole point.

As far as I understood the OP is that it shouldn't be the default.

If you worry for your government, you should use a VPN anyway (where possible which is the case for UK afaik).

Re: Turn off DoH, Firefox

#43

Post by m-p-3 »

jfindley wrote: post #22

This is painful to read. Masses off unfounded FUD - the article deliberately buries that it's trivial to change your DoH provider if you're silly enough to believe that CF is actively logging DoH requests and selling them (CF is involved with serving vast swathes of the internet anyway - if they wanted to go down this route they have far more lucrative avenues open than selling DNS requests by IP). If instead what yo…

So far I'm using NextDns.io at home, which is DoH and also applies ad-filtering. I haven't heard of any security concerns yet

Disclaimer: I do not work or have any financial connection to that service

Re: Turn off DoH, Firefox

#44

Post by kadoban »

Chirael wrote: post #16

It seems like this change by Firefox would bypass a pi-hole. Am I understanding it correctly?

Yes, Pi-hole works via setting it as a DNS server, which this will bypass by default.

You will have to turn it off manually, in Firefox.

Not a great direction for DNS to be going for things like Pi-hole. If DoH becomes a thing on say smart TVs and gaming consoles, I fear it will be baked in and not configurable. Also going to be annoying on PCs/phones if each individual application is going to get its own DNS config now.

Re: Turn off DoH, Firefox

#45

Post by userbinator »

Avamander wrote: post #7
fimdomeio wrote: post #5

Does anyone knows why does mozilla think this is a good idea? Between each user sharing dns queries with their isps and everyone sharing dns queries with cloudflare it appears that it's obviously more secure the first approach even if none of them is really that great.

ISPs have proven themselves untrustworthy repeatedly, CloudFlare yet really hasn't. Not that I like the control they have, but it's honestly the fault of ISP's this has happened.

some ISPs.

The problem is that Mozilla is taking a very US-centric view of a product that is used worldwide.

Re: Turn off DoH, Firefox

#46

Post by matharmin »

taneq wrote: post #34
jfindley wrote: post #22

This is painful to read. Masses off unfounded FUD - the article deliberately buries that it's trivial to change your DoH provider if you're silly enough to believe that CF is actively logging DoH requests and selling them (CF is involved with serving vast swathes of the internet anyway - if they wanted to go down this route they have far more lucrative avenues open than selling DNS requests by IP). If instead what yo…

> There has to be SOME default chosen It seems trivial to select a half a dozen likely candidates and let the user choose between them on install. Honestly I'd like them to do the same with the search engine. Yes, it's simple enough to change the default, but it'd be nice to choose up-front.

Yes, it's trivial. It's also very annoying to the probably 99% of users who don't care about it at all, especially if this becomes just one of many settings that needs to be configured on startup.

Re: Turn off DoH, Firefox

#47

Post by jfindley »

askmike wrote: post #36
jfindley wrote: post #22

This is painful to read. Masses off unfounded FUD - the article deliberately buries that it's trivial to change your DoH provider if you're silly enough to believe that CF is actively logging DoH requests and selling them (CF is involved with serving vast swathes of the internet anyway - if they wanted to go down this route they have far more lucrative avenues open than selling DNS requests by IP). If instead what yo…

> if you're silly enough to believe that CF is actively logging DoH requests and selling them (CF is involved with serving vast swathes of the internet anyway - if they wanted to go down this route they have far more lucrative avenues open than selling DNS requests by IP). I don't think anyone believes CF will start selling data, that's not what the article argues. Regardless, it's opt-out not opt-in. Which is agains…

You do not have to point your DNS queries to a US company, this is completely false. You can point your DNS queries at whichever DoH provider you want - you can even run your own DoH provider if you want to.

Re: Turn off DoH, Firefox

#48

Post by antientropic »

paulcarroty wrote: post #26

DoH and DoT are very interested technologies, disabling them 'cause Cloudflare is ... strange. From another side, DoH/DoT prevents ISPs/government from DNS modifying/rerouting.

Why is that strange? It seems rather obvious to me why people are reluctant to route all their DNS queries through a for-profit company in a country with no real privacy laws (and one that you have to assume is backdoored by the NSA).

Re: Turn off DoH, Firefox

#49

Post by tomxor »

askmike wrote: post #36
jfindley wrote: post #22

This is painful to read. Masses off unfounded FUD - the article deliberately buries that it's trivial to change your DoH provider if you're silly enough to believe that CF is actively logging DoH requests and selling them (CF is involved with serving vast swathes of the internet anyway - if they wanted to go down this route they have far more lucrative avenues open than selling DNS requests by IP). If instead what yo…

> if you're silly enough to believe that CF is actively logging DoH requests and selling them (CF is involved with serving vast swathes of the internet anyway - if they wanted to go down this route they have far more lucrative avenues open than selling DNS requests by IP). I don't think anyone believes CF will start selling data, that's not what the article argues. Regardless, it's opt-out not opt-in. Which is agains…

> I don't think anyone believes CF will start selling data, that's not what the article argues.

> Regardless, it's opt-out not opt-in. Which is against newer consumer protection laws such as GDPR.

I understand the argument in theory.. but the reality is CF is a more trustworthy DNS provider than basically any consumer ISP in the EU.

Re: Turn off DoH, Firefox

#50

Post by userbinator »

Chirael wrote: post #16

It seems like this change by Firefox would bypass a pi-hole. Am I understanding it correctly?

...and a local HOSTS file.

So now it will, by default, contact all the ad/tracking hosts that you configured to be blocked.

"But now your DNS queries to those ad/tracking hosts are encrypted!"

No. I don't care. I didn't want to connect to those hosts in the first place.

Post reply on HN