Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Mozilla’s DNS over HTTPs

blog.mozilla.org

Post reply on HN
Print view View original

771–777 of 777 posts

Re: Mozilla’s DNS over HTTPs

#771

Post by teknopaul »

Polylactic_acid wrote: post #744
teknopaul wrote: post #743

Earlier quoted context omitted.

That is an issue. Apart from the wait. Spaff hostnames to cloudflare, fail, then try harder. Users expect hosts: files,dns Admins expect dns to work. FireFox should not be fscking with network config. If they do, they should try not to break users first. Firefox is borken. Security is not improved. My DNS requests never leave the LAN.

Half of your comment doesn't make any sense but for the rest of it, its just incorrect. The change in firefox hasn't broken anything, security is certainly improved in combination with other efforts like encrypted SNI. And yes, your dns requests always leave your lan at least once. You can run your own DNS server locally but that dns server has to ask other servers for the data since it can't store a local copy of th…

DoH breaks anything that is going on in your BIND or NSD server. It bypasses them, it has broken that. If it does DNS first, then if that fails does /etc/hosts, its broken that too.

If I, or my company, or ISP has anything special in hosts or DNS, e.g. load balancing, name mapping, breaking facebook.com, things like that get bypassed.

DoH over HTTPS is slower than a lookup to /etc/hosts, and probably slower than a lookup to a locally cached DNS resolver.

Security is not improved by FireFox bypassing my network admins DNS rules.

Most DNS queries do not go over the Internet, unless you have DoH or have set special DNS servers. My ISP provides IP access to the Internet and DNS, like almost all ISPs. It not to do with local caching (which does add security), if I query foo.com that query goes to my ISP, not via the Internet, my ISP knows I asked for foo.com and then then the routes my IP packets there.

My ISP has to lookup DNS on the Internet to resolve them if it is not in caches but that lookup is not associated to me.

When I connect to a corporate network all my DNS goes over VPN if any information is required from the Internet again that is not associated to me.

Cloudflare might be running a more secure DNS resolver at the other end than my ISP, but it might not, its rules have to apply to the whole world so they cannot be tuned for me and my security preferences.

After DoH, all DNS goes over the Internet, even quires that eventually are resolved locally. Cloudflare now know I'm going to foo.com and so does my ISP, or VPN provider, I don't see how security has improved. Its just sending information to a commercial partner of Mozilla's in addition to my ISP. Some informationits getting that before my ISP did not get.

Plus HTTPS is not infallible.

DoH is more secure than DNS in plain text over the Internet, but that is very rarely the case.

DNS is also not a significant risk to browser users. I have never had a DNS response faked, to any HTTPS site it would not work, so why bother.

There isn't much risk, its not more secure, and it breaks stuff.

Re: Mozilla’s DNS over HTTPs

#772

Post by tptacek »

corford wrote: post #766
tptacek wrote: post #731

Earlier quoted context omitted.

DoH mitigates the "ISP selling your DNS data" threat, which practically everyone in the US faces, without forcing all your traffic onto a VPN, which not everyone wants. Meanwhile: practically no important zones are signed, so apart from the fact that DNSSEC does nothing to improve privacy, it's also not useful. DNSSEC is moribund; taking steps to enable it is a waste of time.

DoT would also mitigate it in a similar fashion. In both cases mitigate doesn't really have much meaning since, sans VPN, ISPs that are inclined to do so will quite happily continue to find ways to infer where you're browsing to (IP address and CT log correlation being the obvious choices). Ergo, if last mile privacy is you're issue, the best bet is a VPN or some improved regulation so that consumers have a choice if…

DoT and DoH have virtually identical service models. The practical difference between the two is that DoT deliberately runs on a nonstandard port, so that network operators can filter it. It's not an exaggeration to say that DoT is simply DoH with a network kill switch.

Re: Mozilla’s DNS over HTTPs

#773

Post by newman314 »

lovelearning wrote: post #84

As a resident of a country whose government and ISPs heavily and habitually censor the Internet for political reasons, I for one truly appreciate Firefox's DoH. They should also enable 'network.security.esni.enabled' by default because the censors here have upgraded from DNS to SNI-based blocking. I get it that better solutions are possible, but got to teach people to first walk before teaching them to run. AFAIK, Ch…

My problem with FF's implementation of ESNI is that they tied it to DoH the last time I checked.

These are separate features and should be decoupled accordingly.

https://bugzilla.mozilla.org/show_bug.cgi?id=1500289

Re: Mozilla’s DNS over HTTPs

#774

Post by corford »

tptacek wrote: post #772
corford wrote: post #766

Earlier quoted context omitted.

DoT would also mitigate it in a similar fashion. In both cases mitigate doesn't really have much meaning since, sans VPN, ISPs that are inclined to do so will quite happily continue to find ways to infer where you're browsing to (IP address and CT log correlation being the obvious choices). Ergo, if last mile privacy is you're issue, the best bet is a VPN or some improved regulation so that consumers have a choice if…

DoT and DoH have virtually identical service models. The practical difference between the two is that DoT deliberately runs on a nonstandard port, so that network operators can filter it. It's not an exaggeration to say that DoT is simply DoH with a network kill switch.

When was the last time port 995 or 993 were blocked? If the same adoption happened with DoT, ISPs wouldn't have the option - customers wouldn't accept it.

Re: Mozilla’s DNS over HTTPs

#775

Post by kzrdude »

coribuci wrote: post #748
afiori wrote: post #695

Earlier quoted context omitted.

From my point of view translated software often just means that googling errors is harder

It's worse than that. Some words did not exist in the target language (the computers are relatively new compared to the age of the language) so they had to be created. Nothing is more annoying than to search for words which make no sense.

Why do you think english is any different? Silly words were created for new concepts in computing (as in other fields) in English too.

You just don't notice how silly all the new words are (like bit and byte, and "gigaflop" and so on) because english is a prestige language and that it is a foreign language.

Re: Mozilla’s DNS over HTTPs

#776

Post by rovr138 »

qw3rty01 wrote: post #579
rovr138 wrote: post #436

Earlier quoted context omitted.

That was an issue with .dev and then google acquired the TLD.

.dev isn't an rfc2606 reserved TLD, so it shouldn't have been used for internal domains in the first place

Replying to the part about ‘something that isn’t routable’

Not because something is not routable means that there won’t be issues.

Re: Mozilla’s DNS over HTTPs

#777

Post by freeAgent »

nullc wrote: post #646
freeAgent wrote: post #610

Earlier quoted context omitted.

I think his point is about the default behavior pointing to Cloudflare. Unless the user changes the DNS provider setting, everyone will be on Cloudflare. With that said, I think this is pretty over-the-top. Part of the reason Cloudflare is the default (and NextDNS is an option) is because they are abiding by Mozilla's Trusted Recursive Resolver policy: https://wiki.mozilla.org/Security/DOH-resolver-policy The only wa…

The mozilla policy allows cloudflare to permanently store and exploit per-domain-name but not per user data. So even going by the letter of the policy and considering cloudflare alone there is still a privacy loss. Moreover, the current legal standard in the US is that users have no expectation of privacy for data that third parties have stored about their activity. As a result there is potentially limited to no due…

> Could you elaborate on that? I see this as massively centralizing DNS request data (onto cloudflare) and this change is the most problematic part of the whole thing.

1. Firefox's browser marketshare is around 10%. This moves roughly 10% of DNS requests off ISP DNS providers to Cloudflare. Each of the major ISPs controls more than 10% of the broadband market.

2. It's only impacting Firefox browsers. To get an overall picture of the DNS request landscape and privacy, one has to include every DNS request made by a computing device that doesn't go through a Firefox browser. Even for Firefox users, the vast majority of their DNS requests probably don't come from web browsing in Firefox.

3. Firefox also makes it very easy to switch DNS providers to DHCP default or NextDNS. Of course users can still use custom options as well. Many Firefox users are probably savvy enough to exercise these options.

Based on what I've laid out above, I would guess that this change by Firefox might be redirecting a low-single-digits percent (very possibly less than 1%) of DNS request traffic to Cloudflare vs. where it went previously. That sounds like decentralization to me.

Post reply on HN