Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

What’s Next in Making Encrypted DNS-over-HTTPS the Default

blog.mozilla.org

Post reply on HN
Print view View original

51–60 of 191 posts

Re: What’s Next in Making Encrypted DNS-over-HTTPS the Default

#51

Post by EvanAnderson »

Can somebody point me to the place in the Firefox code where the "use-application-dns.net" canary domain is actually checked? I've tried searching the mozilla-central Mercurial repository and I'm not finding it. I'm clearly inept here.

I'm looking at what my Windows DNS servers return when I put in an empty zone for "use-application-dns.net" and I'd like to see exactly what Firefox is testing for. Windows 2012 R2, at least, returns the SOA and no NXDOMAIN for an "A" query to "use-application-dns.net" with an empty zone. If they're explicitly looking for NXDOMAIN then blocking DOH behavior with Windows DNS servers probably isn't going to work. >sigh<

Re: What’s Next in Making Encrypted DNS-over-HTTPS the Default

#52

Post by rnhmjoj »

zajio1am wrote: post #39
Jonnax wrote: post #19

There's a lot of negativity here. But this is a win overall for privacy. DNS is used by ISPs to sell user's data and is one way that oppressive regimes track what their users do. If you're technical enough to understand DNS then you are smart enough to change what the default is. If you're a system administrator for a company. You should be able to push a profile down to the user's computer to configure DNS how you w…

Not if one trusts more his/her ISP more than Cloudflare. At least, an ISP is a contractual partner and under the same jurisdiction, in Europe including GDPR.

Or if you run your own resolver and don't want a completely unrelated third party like Cloudflare siphoning your traffic.

Re: What’s Next in Making Encrypted DNS-over-HTTPS the Default

#53

Post by antpls »

I tried forced-mode DoH in Firefox 68 and 69, on Debian 9 and 10. In all cases, it worked for a while then stopped to work after a few hours (at random it seems). The only way for me to make it work again was to disable DoH.

I guess a more long term solution is to have a local proxy dns-to-doh, but we are falling back in the solution that only a technical user can setup :

https://developers.cloudflare.com/1.1.1.1/dns-over-https/clo...

https://facebookexperimental.github.io/doh-proxy/

And it means setting up firewall routing and filters, as some softwares don't have settings to add DNS proxy, or even bypass them (Google Chrome for example)

Re: What’s Next in Making Encrypted DNS-over-HTTPS the Default

#54

Post by tannhaeuser »

Same story as always with Google "innovations": "hey, we're preventing DNS queries to go to your ISP who is selling it" (to go to our service instead so we can profit from it).

It's scary that Moz sides with monopolies like Google and Cloudflare on this one.

Re: What’s Next in Making Encrypted DNS-over-HTTPS the Default

#55

Post by mtsr »

rnhmjoj wrote: post #52
zajio1am wrote: post #39

Earlier quoted context omitted.

Not if one trusts more his/her ISP more than Cloudflare. At least, an ISP is a contractual partner and under the same jurisdiction, in Europe including GDPR.

Or if you run your own resolver and don't want a completely unrelated third party like Cloudflare siphoning your traffic.

This. And I already have to deal with smart appliances that try to contact their own DNS (I’m looking at you, Samsung) and that break if I force their requests through my own resolver.

This will just allow all applications and appliances to bypass my privacy measures.

Re: What’s Next in Making Encrypted DNS-over-HTTPS the Default

#56

Post by tinus_hn »

z3t4 wrote: post #45
jlgaddis wrote: post #7

Earlier quoted context omitted.

That's exactly what their plan is -- and if you have experiments enabled, they may have already started sending your DNS queries to Cloudflare.

I guess thats Mozillas new monetizing strategy, sell user data to cloudflare, and market it as privacy. If you want privacy you better firewall everything your computer want to send to Cloudflare, Akamai, et.al.

Good luck with blocking Cloudflare and Akamai and still using the internet.

Re: What’s Next in Making Encrypted DNS-over-HTTPS the Default

#57

Post by redder2 »

Its great what Mozilla is doing but I would like them to push for this to be made system wide and provide the tools to set it up rather then doing it in the Browser only, and I say that as a lifetime Firefox user.

In systemd there is currently only DNS over TLS and there is a security issue open about that. Also not sure if there forced setting has made it into stable.

What I want to do it just a easy setting to set up up on my Linux (And windows gaming partition) and never think about it again.

And for those concerned about selling data to Google or CF, just use some of the privacy organizations servers for it!

Re: What’s Next in Making Encrypted DNS-over-HTTPS the Default

#58

Post by throawayeu45556 »

I am wondering, does DNS-over-HTTPS really helps since the way I understand it, after the domain name is resolved to an IP address, the client contacts the IP address so the ISP could still know the website visited especially since many if not most websites have dedicated IP addresses. So ISP could simply crawl the web and map domain names to IP addresses.

Is there anything in DoH mitigating this? Or maybe is this attack vector negligible in practice because most servers typically host multiple websites? At least this adds plausible deniability in a wide range of situations I guess. But is it really true? And for example, would it really help in a country where a website like Facebook is censored? (Since their IP addresses are dedicated).

Post reply on HN