Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Mozilla’s DNS over HTTPs

blog.mozilla.org

Post reply on HN
Print view View original

401–410 of 777 posts

Re: Mozilla’s DNS over HTTPs

#401

Post by extra88 »

qmarchi wrote: post #377
dmd wrote: post #360

How does this work with hosts that are not resolvable outside your own network? If I tell firefox to go to internalsite.mycompany.com - which resolves internally, but not outside our network - how is firefox going to resolve it, if it's not using our DNS servers?

Correct. In order to preserve compatibility, Firefox's implementation has a "fallback" where if it sees that it can't resolve a domain, then it will fail back to using the system-configured DNS provider.

You can also exclude specific domains but at this point they have to be written in about:config.

https://support.mozilla.org/en-US/kb/firefox-dns-over-https#...

It looks like Firefox Policies can be used to enable, disable, or specify the DoH provider but cannot yet specify excluded domains.

https://github.com/mozilla/policy-templates

Re: Mozilla’s DNS over HTTPs

#402

Post by ThePhysicist »

snek wrote: post #387
ThePhysicist wrote: post #372

I predict that DoH will break many enterprise infrastructures that rely on custom DNS servers. Unwary sysadmins that update Firefox will be in a lot of trouble when they switch this on by default. We ourselves have a custom DNS setup with an only internally resolvable TLD as a security measure, so this change will break our infra for all Firefox users (thankfully we’re in the EU so we’re spared, for now). Good thing…

There is already support for enterprise situations like you describe: https://support.mozilla.org/en-US/kb/canary-domain-use-appli...

Well, ok, but this requires updating all company DNS servers so it’s still far from ideal I would say. They should have done it the other way around: if the DNS returns a specific response enable DoH, otherwise leave it alone.

Re: Mozilla’s DNS over HTTPs

#403

Post by fortran77 »

6d6b73 wrote: post #315

So now just one company will have access to all the data from 99% of firefox users? I don't see how giving so much power to just one entity is better for our privacy. Previously if I used my computer at home, coffee shop, work, hotel etc it would be very hard if not impossible for one company to get all of my browsing history. And giving it all to one company is a better idea?

And many routers also cache local DNS requests. So unless someone can see every router that you were served by at every airport, hotel, coffeeshop, they really can't see where you've been browsing by examining DNS requests.

We're _much_ less safe having cloudflare know all.

Re: Mozilla’s DNS over HTTPs

#404

Post by nullc »

Karunamon wrote: post #338
nullc wrote: post #326

Earlier quoted context omitted.

Mozilla claims that Cloudflare is not paying them, and claims that they have a contract with cloudflare which prohibits them from selling the data. I don't think that this improves the situation substantially. The history of internet privacy failures is full of empty and unrealized promises, and no amount of contracts or promises can trump a court order or a NSL. "Has no ability to collect" is the gold standard, and…

Agreed. Unless that contract includes heavy penalties for selling and/or losing that data, its toothless nonsense. The fact that the contract hasn't been published is also problematic. If everything is above board, why hide?

To be fair, publishing contracts like that isn't a standard practice. That alone is a sufficient explanation. It still would be better if it were.

Re: Mozilla’s DNS over HTTPs

#405

Post by noident »

Arkanosis wrote: post #332
noident wrote: post #321

What difference does it make? Even if the DNS queries are completely encrypted, subsequent HTTPS requests made after domain resolution will contain the destination domain (but not the path or request body) in the clear. What makes you assume that ISPs aren't already collecting this information?

The Host header is encrypted when using HTTPS and the SNI is encrypted when using ESNI. In the best scenario (DoH + HTTPS + ESNI), ISPs only get the destination IP, not the destination domain.

That's not so great for a best case scenario, because destination IPs rarely change, and anyone can resolve any domain themselves, making it easy to associate a timestamped IP with a DNS record. I could walk the whole HSTS preload list to find domains.

Re: Mozilla’s DNS over HTTPs

#406

Post by raesene9 »

My feeling on this is that it's a pretty imperfect solution but unsurprising that the browser manufacturers are pushing it forward given ISPs dragging their heels on DoT.

We saw the same problem with TLS. Until the browser makers started pushing it and Let's encrypt made it simple/free the take up of TLS was patchy at best.

This will have negative effects on tools that use DNS for blocking/monitoring, but then those were a hack at best. If you want to understand the traffic flowing over your network, you need to invest in interception and parsing.

Re: Mozilla’s DNS over HTTPs

#407

Post by djsumdog »

ThePhysicist wrote: post #362
andyjohnson0 wrote: post #331

Earlier quoted context omitted.

> Formerly, I "opted out" of having a browser that phoned home my browsing traffic by using Firefox. Formerly your browser still "phoned home" to your default DNS provider, using an insecure protocol. I appreciate your concerns but, unless you run your own DNS server, you have to trust someone at some point.

I trust my own DNS provider much more than I trust Cloudflare to be honest. Also, most DNS requests over that “insecure protocol” happened over a single network hop or two and never left the infrastructure of the ISP. Cloudflare is now a public company and they need to aggressively monetize their services. Selling browsing data is a lucrative business and becoming “the” DNS provider for most users (while locking out…

American ISPs can and do sell your data legally. I don't really trust my ISP (I run my own DNS server at home and tunnel its requests over to a cloud VM), but I trust Cloudflare even less.

Re: Mozilla’s DNS over HTTPs

#408

Post by sp332 »

ryanisnan wrote: post #351
alwillis wrote: post #263

The underlying issue is that a DoH provider can craft the DNS answers individual users get if it wants to. Think about it: a Firefox DoH user could get different DNS answers than other apps get on the same machine using standard DNS on port 53, if Google or Cloudflare wanted to, because they’re essentially talking to different versions of the internet. Remember, all of the properties that allows HTTPS to be trackable…

> Think about it: a Firefox DoH user could get different DNS answers than other apps get on the same machine using standard DNS on port 53, if Google or Cloudflare wanted to, because they’re essentially talking to different versions of the internet. How is that different than existing DNS servers?

There's no difference that a DNS server can see between a browser on your computer making a DNS request vs. any other app. But if the browser is using DoH and other apps don't, then it can tell.

Re: Mozilla’s DNS over HTTPs

#409

Post by andyjohnson0 »

ThePhysicist wrote: post #362
andyjohnson0 wrote: post #331

Earlier quoted context omitted.

> Formerly, I "opted out" of having a browser that phoned home my browsing traffic by using Firefox. Formerly your browser still "phoned home" to your default DNS provider, using an insecure protocol. I appreciate your concerns but, unless you run your own DNS server, you have to trust someone at some point.

I trust my own DNS provider much more than I trust Cloudflare to be honest. Also, most DNS requests over that “insecure protocol” happened over a single network hop or two and never left the infrastructure of the ISP. Cloudflare is now a public company and they need to aggressively monetize their services. Selling browsing data is a lucrative business and becoming “the” DNS provider for most users (while locking out…

My domestic IPS is owned by a public company and I'm sure they need to aggressively monetize their services too. My point was just that you ultimately have to trust someone. Not trusting CloudFlare is a perfectly legitimate position to take.

Re: Mozilla’s DNS over HTTPs

#410

Post by sp332 »

alwillis wrote: post #263

The underlying issue is that a DoH provider can craft the DNS answers individual users get if it wants to. Think about it: a Firefox DoH user could get different DNS answers than other apps get on the same machine using standard DNS on port 53, if Google or Cloudflare wanted to, because they’re essentially talking to different versions of the internet. Remember, all of the properties that allows HTTPS to be trackable…

What DoH implementation sends cookies?
Post reply on HN