Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

NextDNS Joins Firefox’s Trusted Recursive Resolver

blog.mozilla.org

Post reply on HN
Print view View original

81–90 of 146 posts

Re: NextDNS Joins Firefox’s Trusted Recursive Resolver

#81

Post by type0 »

gpm wrote: post #64
fiysp wrote: post #63

Earlier quoted context omitted.

My ISP, since I have a contract with them, I can switch to another ISP anytime, and they are bound to lots of data protection laws. On the other hand, the Mozilla Corporation clearly is desperate to find alternate sources of funding.

Often, I don't have a contract with my ISP. Since my ISP is a random coffee shop, the public transit provider, or so on.

You should be using a VPN in a random coffee shop anyway, not that I particularly like how falsely advertised those are, and their security (Nord cough cough), still it's usually better than nothing.

Re: NextDNS Joins Firefox’s Trusted Recursive Resolver

#82

Post by zzzcpan »

tptacek wrote: post #78
kiwidrew wrote: post #74

This extreme focus on DoH is really concerning me. If you're worried about your recursive DNS resolver spying on you, the correct solution is to run your own recursive resolver. I've been running unbound(8) on my OpenBSD systems at home for most of 2019, and (except for the time that I experimented with turning on strict DNSSEC checking) there hasn't been even one time that it has caused me grief. It was as simple as…

Running your own non-DOH recursive server does absolutely nothing to protect your queries from snooping; in fact, it increases your exposure, because every single step in the recursive queries you run are now in plaintext on the wire and each attributable to your server. Running your own recursive DOH server is a fine idea, and easy to do, but then you have little to be angry at Mozilla about, because they're the one…

You are saying nonsense. Your own DoH server is the same recursive resolver with queries in plaintext on the wire each attributable to your server by whoever is looking. In fact, if you move your DoH server outside of your home, you are roughly doubling amount of parties involved in looking at your metadata, because pretty much none of the metadata is hidden when you just remove DNS queries from your wire and replace it with TLS, but now a whole set of other parties get to see your queries and your TLS connection towards your DoH server with identifiable IP address, likely even recorded and stored for years by more parties.

There are no "wins" with DoH no matter how you look at it.

Re: NextDNS Joins Firefox’s Trusted Recursive Resolver

#83

Post by stiray »

fabrice_d wrote: post #35
3xblah wrote: post #29

“For most users, it’s very hard to know where their DNS requests go and what the resolver is doing with them.” said Eric Rescorla, Firefox CTO. “Firefox’s Trusted Recursive Resolver program allows Mozilla to negotiate with providers on your behalf and require that they have strong privacy policies before handling your DNS data. We’re excited to have NextDNS partner with us in our work to put people back in control of…

It's about trust: would you rather trust your ISP, or Mozilla's choice of DoH partners? Users never really had a reasonable (ie. non geek) opportunity to be in charge of their DNS privacy, and for most it's not something they can be bothered with.

I am mozillas diehard fan as firefox goes but I DO NOT trust them. I still remember some company with best search engine that got vapirised over the years and I am not prepared to trust anyone. Mozilla has some shady practices with their "research add-ons" and I am blocking their domains from firefox and using another browser to download addons.

And I will surely not allow some firm in a country with vague laws allow to do all my name resolution. Not to mozilla, not to google, not to cloudflare or anyone else (currently running unbind with caching on huge list of DNSs all over EU in random order).

ISP? They are obligated to follow the law in my country. Spying on its user would make it a criminal offense investigation, potentionally bringing their management behind bars. No, they wont even try, it is too dangerous for them.

I trust my ISP way more than mozilla. Based on law in my country. It is not DNS system to change (actually it is but convincing me that adding ssl layer on top of highly efficient protocol is worse than rolling everything trough https and changing all existing systems? I'll pass, sounds like a complex solution for simple non-problem, I am sick of looking on those in last decade), it is a law in YOUR country that allows your ISPs to spy on users and this is something that needs to change.

Re: NextDNS Joins Firefox’s Trusted Recursive Resolver

#84

Post by strbean »

zzzcpan wrote: post #82
tptacek wrote: post #78

Earlier quoted context omitted.

Running your own non-DOH recursive server does absolutely nothing to protect your queries from snooping; in fact, it increases your exposure, because every single step in the recursive queries you run are now in plaintext on the wire and each attributable to your server. Running your own recursive DOH server is a fine idea, and easy to do, but then you have little to be angry at Mozilla about, because they're the one…

You are saying nonsense. Your own DoH server is the same recursive resolver with queries in plaintext on the wire each attributable to your server by whoever is looking. In fact, if you move your DoH server outside of your home, you are roughly doubling amount of parties involved in looking at your metadata, because pretty much none of the metadata is hidden when you just remove DNS queries from your wire and replace…

You could host your DoH server somewhere and use a different IP for inbound vs. outbound requests. Then the only point of failure is the cloud host, no?

Re: NextDNS Joins Firefox’s Trusted Recursive Resolver

#85

Post by slenk »

heavyset_go wrote: post #67
slenk wrote: post #33

Earlier quoted context omitted.

I believe you are referencing possibly old data. I have a Chromecast. I also redirect all port 53 traffic (DNS) back through my own DNS server at the firewall level (does not go to Google DNS). It works perfectly fine wihtout directly using Google DNS. Yes, they do ignore the DNS set by DHCP, but that can be worked around.

Which model Chromecast do you have?

2nd gen

Re: NextDNS Joins Firefox’s Trusted Recursive Resolver

#86

Post by tptacek »

zzzcpan wrote: post #82
tptacek wrote: post #78

Earlier quoted context omitted.

Running your own non-DOH recursive server does absolutely nothing to protect your queries from snooping; in fact, it increases your exposure, because every single step in the recursive queries you run are now in plaintext on the wire and each attributable to your server. Running your own recursive DOH server is a fine idea, and easy to do, but then you have little to be angry at Mozilla about, because they're the one…

You are saying nonsense. Your own DoH server is the same recursive resolver with queries in plaintext on the wire each attributable to your server by whoever is looking. In fact, if you move your DoH server outside of your home, you are roughly doubling amount of parties involved in looking at your metadata, because pretty much none of the metadata is hidden when you just remove DNS queries from your wire and replace…

The whole point of DoH is that you don't run the DoH recursive cache on the network you don't trust. Before you use words like "nonsense", you should spend some time understanding what DoH is.

Re: NextDNS Joins Firefox’s Trusted Recursive Resolver

#87

Post by incompatible »

stock_toaster wrote: post #62
Eiriksmal wrote: post #59

Earlier quoted context omitted.

I could never think of why Mozilla and friends are so aggressively pushing DoH, but I think you nailed it when you pointed out they can tie a specific device's DNS requests to its other data. I run Unbound and Pi-Hole to do my own recursive resolving. Like a normal wireless router doing all the DNS lookups for its DHCP clients, Mozilla has no idea which particular device on my network is accessing duckduckgo.com. Onc…

> For all the commenters here who think that Google and the other major tech companies are somehow less trustworthy than your ISP? Yeah, I just can't agree with those opinions. Additionally, at least my ISP is doing business in my state/country, so there may be _some_ legal recourse if they screw me too hard.

Your country can also put other obligations on your ISP, such as censorship and data logging.

Re: NextDNS Joins Firefox’s Trusted Recursive Resolver

#88

Post by zzzcpan »

tptacek wrote: post #86
zzzcpan wrote: post #82

Earlier quoted context omitted.

You are saying nonsense. Your own DoH server is the same recursive resolver with queries in plaintext on the wire each attributable to your server by whoever is looking. In fact, if you move your DoH server outside of your home, you are roughly doubling amount of parties involved in looking at your metadata, because pretty much none of the metadata is hidden when you just remove DNS queries from your wire and replace…

The whole point of DoH is that you don't run the DoH recursive cache on the network you don't trust. Before you use words like "nonsense", you should spend some time understanding what DoH is.

> The whole point of DoH is that you don't run the DoH recursive cache on the network you don't trust.

Nope. There is no point to DoH and you can't actually run "DoH recursive cache" within trusted network, because it communicates with authoritative servers over public internet.

Re: NextDNS Joins Firefox’s Trusted Recursive Resolver

#89

Post by tptacek »

zzzcpan wrote: post #88
tptacek wrote: post #86

Earlier quoted context omitted.

The whole point of DoH is that you don't run the DoH recursive cache on the network you don't trust. Before you use words like "nonsense", you should spend some time understanding what DoH is.

> The whole point of DoH is that you don't run the DoH recursive cache on the network you don't trust. Nope. There is no point to DoH and you can't actually run "DoH recursive cache" within trusted network, because it communicates with authoritative servers over public internet.

You still don't get it. The threat model of DoH is your local ISP. The mitigation is to move DNS off your untrusted local ISP to a network you trust more. To the extent it's not cached, if you have a shared DoH resolver, yes, the DNS queries you're generating are eventually sent in plaintext. But they're sent in plaintext over a network you trust more than your ISP's.

DoH is essentially a DNS-only VPN. It has exactly the security model of a VPN with respect to the DNS protocol.

The attack DoH breaks immediately is your US mainstream ISP recording all your DNS queries, which is something that is happening today. I really don't understand how people rationalize around this. It's not an exotic attack, like the cache-corruption attacks DNSSEC attempts to defend against; it's something that's happening constantly, all day, every day.

Re: NextDNS Joins Firefox’s Trusted Recursive Resolver

#90

Post by kasey_junk »

fiddlerwoaroof wrote: post #70
Aaargh20318 wrote: post #69

Earlier quoted context omitted.

> You have a contract with your ISP not to collect and monetize your DNS queries to their DNS servers? You don’t ? Why would you sign up with such an ISP ? My ISP has a very clear privacy policy, and they obviously have to comply with the GDPR as well.

In America, at least, there are only one or two high speed ISPs in any area: and so, unless you want to use DSL or satellite or something and deal with latency/speed issues, you basically pick whoever is fastest for the best price

The DSL & satellites are also monetizing your DNS traffic in most cases.
Post reply on HN