Comcast, Mozilla strike privacy deal to encrypt DNS lookups in Firefox • Hacker News Board

Re: Comcast, Mozilla strike privacy deal to encrypt DNS lookups in Firefox

#41

Post by csharptwdec19 » Thu, Jun 25, 2020, 5:40 PM UTC

NelsonMinar wrote: post #27

Washuu wrote: post #2

Considering that Comcast sniffs, intercepts, and injects into HTTP web sites for their customer notification system(data cap overages and such) this just screams suspicious to me even if it seems like it is meant to be a good announcement. I am not sure how I am supposed to trust that they will do the right thing for their customers.

I'm very suspicious of Comcast too. They've had hostile policies in their Internet management for as long as I can remember, going back to the days they'd forge RST packets because they didn't like customers using BitTorrent. OTOH as the article says, 'Joining Mozilla's program means that Comcast agreed that it won't "retain, sell, or transfer to any third party (except as may be required by law) any personal informa…

>I assume Mozilla will audit and keep Comcast honest here, or at least try. I just am left wondering what loophole Comcast has found.

HAHAHAHAHAHA OH YOU ARE FUNNY.

Sorry.

Comcast will use the same loophole they use with everyone else. Kafkaesque policies aren't just for their customers, they exist throughout the organization.

Took me 6 months to get a Secure VPN link that -they- insisted we use to set up their files. And 3 months of that was just getting the password reset. The account was locked because it wasn't being used (first 3 months was them fighting with firewall configs)...

But then we were in this loop of they would reset the password, but the person who had to TELL us the password was reset would take so long to do so that it expired again by the time we got it.

So, extrapolating to here, my guess is that any sort of audit will take forever to get data, probably incomplete sets... you get the picture.

Re: Comcast, Mozilla strike privacy deal to encrypt DNS lookups in Firefox

#42

Post by jefftk » Thu, Jun 25, 2020, 5:56 PM UTC

deeter72 wrote: post #35

yjftsjthsd-h wrote: post #24

Earlier quoted context omitted.

Don't you just set a canary domain - https://support.mozilla.org/en-US/kb/canary-domain-use-appli... - and then it's disabled for your network?

Again not the most ideal way to do things and Mozilla is doing a different approach to Chrome and Edge. and also a concern is that malware can use DoH to retrieve data without logging suspicious DNS queries on Firewall DNS logs which are monitored to highlight of new domains that have not been pre-approved. DNS should be something that is handled by the OS. I favor DoT which is secure and practical over DoH.

> malware can use DoH to retrieve data without logging suspicious DNS queries on Firewall DNS logs

Malware can already query IPs of its choice to learn about other IPs it should contact. DoH doesn't let it do anything new.

Re: Comcast, Mozilla strike privacy deal to encrypt DNS lookups in Firefox

#43

Post by threw23434 » Thu, Jun 25, 2020, 6:02 PM UTC

Washuu wrote: post #2

Considering that Comcast sniffs, intercepts, and injects into HTTP web sites for their customer notification system(data cap overages and such) this just screams suspicious to me even if it seems like it is meant to be a good announcement. I am not sure how I am supposed to trust that they will do the right thing for their customers.

> Considering that Comcast sniffs, intercepts, and injects into HTTP web sites

You think that is bad ? If you get a connection from India's 'premier' public telco BSNL, you'll be treated to ad-injections for random malware straight into your HTTP page.

"Your govt. welcomes your appreciation for its 'top-notch' services."

Re: Comcast, Mozilla strike privacy deal to encrypt DNS lookups in Firefox

#44

Post by willcipriano » Thu, Jun 25, 2020, 6:04 PM UTC

rydre wrote: post #25

presumably wrote: post #18

Earlier quoted context omitted.

What you're claiming is false. Cloudflare has over 200 PoPs; in your own name servers, you can use the Cloudflare Resolver's IP (which will be a "close to the user" IP, not 1.1.1.1) to do geotargeting and serve from your closest IP address/server.

>What you're claiming is false. Cloudflare has over 200 PoPs; in your own name servers, you can use the Cloudflare Resolver's IP (which will be a "close to the user" IP, not 1.1.1.1) to do geotargeting and serve from your closest IP address/server. What if my server is closer than cloudflare? Why is cloudflare artificially limiting?

I use cloudflare precisely because I don't want clients hitting the server directly. That's its entire purpose. For both caching and anti-ddos reasons.

Re: Comcast, Mozilla strike privacy deal to encrypt DNS lookups in Firefox

#45

Post by the8472 » Thu, Jun 25, 2020, 6:09 PM UTC

SAI_Peregrinus wrote: post #37

solarkraft wrote: post #23

Earlier quoted context omitted.

... which is exactly why DoH is gaining attention. But I keep wondering: Can't the ISP trivially correlate the accessed IP addresses with their corresponding sites even without DNS query data?

Only for sites with dedicated IPs. If they're hosted on some sort of cloud service then the ISP has to sniff the SNI data. And with ESNI coming to encrypt it that hole will be plugged soon.

That just means moving from the ISP in a prime position for snooping to various CDNs being in that prime position.

You traded one master for another.

Re: Comcast, Mozilla strike privacy deal to encrypt DNS lookups in Firefox

#46

Post by jlgaddis » Thu, Jun 25, 2020, 6:16 PM UTC

Let me make sure I've got this right:

* Comcast sniffs / records / tracks their user's DNS traffic

* Mozilla announced they would enable DoH by default, to protect end user's DNS data from shady ISPs like Comcast

* Comcast then raised hell about Mozilla's decision (presumably because they would no longer have access to this data)

* Now, Comcast and Mozilla come to some sort of agreement which effectively restores Comcast's access to their customer's DNS traffic?

---

I'm really confused why Mozilla would agree to this. I really hope this isn't one of the ways they're exploring to "diversify" their revenue streams but, in the last few years, Mozilla has made a lot of decisions that I don't agree with so I suppose I really wouldn't be all that surprised.

Re: Comcast, Mozilla strike privacy deal to encrypt DNS lookups in Firefox

#47

Post by sprayk » Thu, Jun 25, 2020, 6:16 PM UTC

proverbialbunny wrote: post #29

Washuu wrote: post #2

Considering that Comcast sniffs, intercepts, and injects into HTTP web sites for their customer notification system(data cap overages and such) this just screams suspicious to me even if it seems like it is meant to be a good announcement. I am not sure how I am supposed to trust that they will do the right thing for their customers.

I hit commit on that feature. Sorry. It's not just Comcast. Every ISP that uses Akamai's software to power their ISP has this ability and possibly uses it, just not in obvious ways. And given that almost every ISP in the US, let alone the world, uses this software, well.. that's just how it is. Though, it's http only. You can always switch to https and they can not do anything. There is no key injection or anything g…

How would encrypting DNS help me avoid Comcast MITMing my HTTP traffic to inject bandwidth cap notifications? Doesn't the system just inject a script tag into the appropriate place in the HTTP response?

Re: Comcast, Mozilla strike privacy deal to encrypt DNS lookups in Firefox

#48

Post by MINIMAN10000 » Thu, Jun 25, 2020, 6:33 PM UTC

Washuu wrote: post #2

Considering that Comcast sniffs, intercepts, and injects into HTTP web sites for their customer notification system(data cap overages and such) this just screams suspicious to me even if it seems like it is meant to be a good announcement. I am not sure how I am supposed to trust that they will do the right thing for their customers.

I don't care what their intent is. Interception and injection from a third party is bad.

With technology there are many ways to achieve the goal of notifying a customer without foul play.

Re: Comcast, Mozilla strike privacy deal to encrypt DNS lookups in Firefox

#49

Post by jlgaddis » Thu, Jun 25, 2020, 6:34 PM UTC

deeter72 wrote: post #35

yjftsjthsd-h wrote: post #24

Earlier quoted context omitted.

Don't you just set a canary domain - https://support.mozilla.org/en-US/kb/canary-domain-use-appli... - and then it's disabled for your network?

Again not the most ideal way to do things and Mozilla is doing a different approach to Chrome and Edge. and also a concern is that malware can use DoH to retrieve data without logging suspicious DNS queries on Firewall DNS logs which are monitored to highlight of new domains that have not been pre-approved. DNS should be something that is handled by the OS. I favor DoT which is secure and practical over DoH.

Actually, in that case, adding the canary domain to your existing Microsoft DNS servers probably IS the most ideal way to disable Firefox's DoH support.

Alternatively, you can roll out a Group Policy or use Mozilla's "Enterprise" policies to do it.

Hopefully you're also blocking 53/TCP and 53/UDP outbound (except from your internal DNS servers).

Re: Comcast, Mozilla strike privacy deal to encrypt DNS lookups in Firefox

#50

Post by nfoz » Thu, Jun 25, 2020, 6:35 PM UTC

> "Adding ISPs in the TRR program paves the way for providing customers with the security of trusted DNS resolution, while also offering the benefits of a resolver provided by their ISP such as parental control services and better optimized, localized results," the announcement said.

What? No! Why would DNS have "optimized, localized results"?