Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Firefox 143 for Android to introduce DoH

blog.mozilla.org

Post reply on HN
Print view View original

71–80 of 121 posts

Re: Firefox 143 for Android to introduce DoH

#71

Post by SoftTalker »

veyh wrote: post #46
dbcooper wrote: post #39

Firefox for Android is some of the worst software I've ever used. A lot of extensions won't work in it, and even Edge Canary is far better with them. It is extremely slow, and the UI is horrible. I'm running it on a device with a Qualcomm SM8635 Snapdragon 8s Gen 3 chipset, and it just crawls. The UI is very unresponsive, and page load times are terrible. It also has to reload the page if it was running in the backgr…

That's pretty harsh. It works fine for me. But even if it didn't, I'd still use it just for uBlock Origin.

Yes. The web, and especially the web on mobile, is unusable without an ad blocker.

Re: Firefox 143 for Android to introduce DoH

#72

Post by ekr____ »

divbzero wrote: post #66

Why did Firefox choose to implement DNS over HTTPS (DoH) instead of DNS over TLS (DoT)? Doesn’t HTTPS add an extra layer for DNS queries?

Firefox is a browser and so (1) people at Mozilla are comfortable with HTTP and (2) there has been a lot of investment in making the HTTP stack good. You will also notice that the lead author of DNS over HTTPS [0] was a Mozilla employee.

[0] https://datatracker.ietf.org/doc/html/rfc8484

Re: Firefox 143 for Android to introduce DoH

#73

Post by wander_forever »

ekr____ wrote: post #49
LiamPowell wrote: post #2

This doesn't address why this needs to be built in to the browser when Android already does DoH by itself. I assume there's a reason, does anyone know what it is?

Android does same-provider auto-upgrade if it determines that the recursive supports DoH (last I checked, if it's on Google's list). However, this means that unless you configure your own resolver, you're vulnerable to whoever controls the network substituting their own resolver. Firefox uses a set of vetted and pre-specified resolvers ("trusted recursive resolvers"), so is less vulnerable to this form of attack. I s…

Yes, this. AND while Firefox is providing you the control to choose when to enable or disable DoH, you don't get that control at OS-level, or even the visibility of what the OS is choosing on your behalf for each such query.

Re: Firefox 143 for Android to introduce DoH

#74

Post by martinald »

temp0826 wrote: post #56
MrAlex94 wrote: post #32

Not sure why it took so long for Mozilla to expose the setting on Android, it's been a 'secret' setting for a long time. In fact, sometimes they let features ride the rails for a little bit too long IMO. For Waterfox for Android I exposed the setting by default and also added an addition DNS over Oblivious HTTP setting (DoOH) which uses Fastly as the relay (they host and control it, for privacy sanitisation) and Clou…

> DoOH How is the latency?

In theory could be as low as single digit ms overhead, assuming fastly and cloudflares PoPs being used are very close to each other. In reality it seems higher than that but I'm sure a lot of optimisations can be done.

Re: Firefox 143 for Android to introduce DoH

#75

Post by wander_forever »

LiamPowell wrote: post #2

This doesn't address why this needs to be built in to the browser when Android already does DoH by itself. I assume there's a reason, does anyone know what it is?

DoH in Firefox provides you the control to choose when to enable or disable and which DNS provider to choose, while Android does not provide any such choice or even make it known to the user when DoH is used or not. In addition, Firefox only partners with DNS providers that have legally-binding agreements for strongest privacy guarantees - see https://wiki.mozilla.org/Security/doh-resolver-policy .

Re: Firefox 143 for Android to introduce DoH

#77

Post by wander_forever »

afh1 wrote: post #33

>DNS query [...] in the clear. [...] (DoH) plugs this privacy leak [...] no one on the network, not your internet service provider [...] can eavesdrop on your browsing Whoever could see DNS traffic can still see the target you're connecting to...

Correct - that would be visible via ClientHello. But Firefox also enabled ECH (when DoH is enabled) a while back - https://support.mozilla.org/en-US/kb/faq-encrypted-client-he... .

Re: Firefox 143 for Android to introduce DoH

#78

Post by noirscape »

izacus wrote: post #37
noirscape wrote: post #24

Earlier quoted context omitted.

Android privacy tools are leaky (which is bad given it's privacy tooling, you don't want that to leak!) Their VPN tools on OS level are pretty notorious for not properly respecting kill switch settings[0]. That alone makes a native browser implementation a better solution than the OS version. [0]: https://mullvad.net/en/blog/dns-traffic-can-leak-outside-the... is just one example I found on Google (in this case, usin…

What does your post have to do with DoH though?

Moreso giving a reason why you'd want an app to force DoH instead of trusting the OS to do it "correctly".

Google has already shown to have a habit of not properly respecting privacy focused settings, and DoH is intended to be primarily privacy focused. (As it's used to prevent DNS tampering.)

Re: Firefox 143 for Android to introduce DoH

#79

Post by christophilus »

NdMAND wrote: post #70

Single-handedly, Firefox (independently from how crappy it can be at times) is what is keeping me on Android. Its full extension support (i.e.: uBlock Origin support) is something that I can't really do without. I do wonder if the crowd here knows of other good alternatives though - specifically, Android and/or iOS browsers with "full" uBlock Origin support (no uBlock origin lite, no other blocker, ...). I would love…

Brave on iOS is fine. Works roughly like my old Android Firefox did.

Re: Firefox 143 for Android to introduce DoH

#80

Post by AlgebraFox »

nemomarx wrote: post #3

What's the good DoH provider nowadays? I feel like cloud flare has some downsides in terms of centralization

Quad9 (supports DoH,DoT,Dnscrypt) and Mullvad are both good secure DNS services.

Choose Quad9 if you want better security and Mullvad for it's adblocking options.

Post reply on HN