Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

NextDNS Joins Firefox’s Trusted Recursive Resolver

blog.mozilla.org

Post reply on HN
Print view View original

91–100 of 146 posts

Re: NextDNS Joins Firefox’s Trusted Recursive Resolver

#91

Post by 3xblah »

kiwidrew wrote: post #74

This extreme focus on DoH is really concerning me. If you're worried about your recursive DNS resolver spying on you, the correct solution is to run your own recursive resolver. I've been running unbound(8) on my OpenBSD systems at home for most of 2019, and (except for the time that I experimented with turning on strict DNSSEC checking) there hasn't been even one time that it has caused me grief. It was as simple as…

If the user is sitting behind a filtered port 53, e.g., at a hotel, running her own resolver will not solve the problem. This filtering of port 53 may be growing in popularity among ISPs. If it is, then that means users cannot easily choose their own source of DNS data.

It becomes necessary to connect to some remote computer you control that can send traffic on port 53 just to send an authoritative DNS query. It is like having to pay two ISPs now instead of one.

What are the "free" workarounds. There are free-trial DNS "relocator" services and DNSCrypt resolvers running on ports other than 53 (I am not aware of any authoritative servers running behind dnscrypt-wrapper). Now there are also "DOH servers" running on port 443, serving resolver responses via HTTP. One unique feature of DOH -- for those doing bulk lookups -- is that one can query multiple names with a single packet. That is not possible using the DNS protocol.

For folks who are stuck with port 53 filtering, as a temporary solution, I would like to see more remote DNS servers, both recursive and authoritative, running on ports other than 53. They do not have to be "relocator" services, encrypted or served via HTTP. They just need to use ports other than 53.

Then, when running a local resolver, the user can set it to forward queries to a remote one listening on a non-standard port or she can query authoritative servers directly, e.g., root or .com servers, using stub resolvers.

It is every internet user's right to be able to query the authoritative servers for a domain's IP address -- whether from her own local resolver or from a stub, the same way it is to request access to a public zone file. Filtering port 53 is unacceptable. Otherwise, we are allowing third parties to become the absolute gatekeepers to the sources of authority for finding an IP address. Caches are not authoritative sources of DNS data.

Re: NextDNS Joins Firefox’s Trusted Recursive Resolver

#92

Post by zzzcpan »

tptacek wrote: post #89
zzzcpan wrote: post #88

Earlier quoted context omitted.

> The whole point of DoH is that you don't run the DoH recursive cache on the network you don't trust. Nope. There is no point to DoH and you can't actually run "DoH recursive cache" within trusted network, because it communicates with authoritative servers over public internet.

You still don't get it. The threat model of DoH is your local ISP. The mitigation is to move DNS off your untrusted local ISP to a network you trust more . To the extent it's not cached, if you have a shared DoH resolver, yes, the DNS queries you're generating are eventually sent in plaintext. But they're sent in plaintext over a network you trust more than your ISP's. DoH is essentially a DNS-only VPN. It has exactl…

> The threat model of DoH is your local ISP.

There is no threat model for DoH, only ad hoc attempts to justify it. Here's the thing, your ISP sees all of your packets with all the IP addresses and ports and payload size and the exact time they were sent and received. This identifies every website you visited with very high accuracy, I mean just IP addresses alone identify more than 90% of the websites you visited.

> DoH is essentially a DNS-only VPN. It has exactly the security model of a VPN with respect to the DNS protocol.

That "security model" is just integrity in communications with resolver, but it actually sacrifices privacy for that.

> The attack DoH breaks immediately is your US mainstream ISP recording all your DNS queries

This is absolutely useless "attack" to break. Most ISPs in the world record netflow-like data and store it for a long time, which provides more detailed profile on you, than DNS queries. If they store DNS queries, those are just for commercialization, not for snooping.

Re: NextDNS Joins Firefox’s Trusted Recursive Resolver

#93

Post by gpm »

type0 wrote: post #81
gpm wrote: post #64

Earlier quoted context omitted.

Often, I don't have a contract with my ISP. Since my ISP is a random coffee shop, the public transit provider, or so on.

You should be using a VPN in a random coffee shop anyway, not that I particularly like how falsely advertised those are, and their security (Nord cough cough), still it's usually better than nothing.

It doesn't matter what I should do, it matters what a random firefox user who finds themselves in a coffee shop is doing.

Some of the public transit I've been on disagrees strongly with VPNs because they do heavy traffic shaping and VPNs fall into the "make this really slow" category. Reasonably so.

I also disagree with this advice. For myself and the vast majority of people $5/month is not worth it for the negligible difference in security and privacy over https, and DNS over https. This becomes even more true with encrypted SNI.

In fact, a VPN is largely worse privacy wise because "random coffee shop internet with random MAC address" is pretty anonymous unless you sign into anything over http.

Re: NextDNS Joins Firefox’s Trusted Recursive Resolver

#94

Post by chrysoprace »

kick wrote: post #73
stock_toaster wrote: post #62

Earlier quoted context omitted.

> For all the commenters here who think that Google and the other major tech companies are somehow less trustworthy than your ISP? Yeah, I just can't agree with those opinions. Additionally, at least my ISP is doing business in my state/country, so there may be _some_ legal recourse if they screw me too hard.

DoH is only available in the U.S. for Firefox users as far as I'm aware, so all of the people who might be "screwed too hard" have legal recourse.

It's available everywhere; it's just only enabled by default in the U.S.

Re: NextDNS Joins Firefox’s Trusted Recursive Resolver

#95

Post by threatofrain »

core-questions wrote: post #72
cookiecaper wrote: post #30

Earlier quoted context omitted.

One of the positives of DNS-level blocking is that it's relatively rough-grained. You can block pornhub.com, but you can't block out every mention of homosexuality at the DNS level without blocking any site that may potentially mention it, which would include any news site, discussion forum, social media, etc. We should be skeptical of aggresively-enforced DoH. In most cases, the vendor's interest in stopping ad bloc…

Technology should not be inserting itself into the private lives of people and determining the values they can raise their children with. This is something parents should have as a tool. If you don't like it, tough; go raise your kids the way you want to. There's no reason why someone with traditional values shouldn't be afforded the ability to selectively block things they find obscene.

Nobody is fighting over whether you're going to be doing site-by-site blocking, because that's too exhausting and people know that.

That's why companies have to exercise moral taste when they do a blanket ban on moral obscenity, and that's precisely the kind of product that people mean to purchase -- curation and tastefulness. It's also why it's interesting for people to fight over this, because they're fighting over a policy of scale as opposed to what goes on in one single home.

And presumably this company would later be interested in dealing with schools and other big institutions, which means their product takes on yet another critical dimension, which is the re-allocation of responsibility for making morally tasteful decisions.

In both B2C and B2B, the refusal to exercise moral perspective, taste, and curation is missing the soul of the product. But of course not all areas of tech is for everyone; some people don't wish to work with advertising companies, and that's fine too, but advertising companies likewise make policies of scale and must exercise moral and political taste.

Re: NextDNS Joins Firefox’s Trusted Recursive Resolver

#96

Post by tptacek »

zzzcpan wrote: post #92
tptacek wrote: post #89

Earlier quoted context omitted.

You still don't get it. The threat model of DoH is your local ISP. The mitigation is to move DNS off your untrusted local ISP to a network you trust more . To the extent it's not cached, if you have a shared DoH resolver, yes, the DNS queries you're generating are eventually sent in plaintext. But they're sent in plaintext over a network you trust more than your ISP's. DoH is essentially a DNS-only VPN. It has exactl…

> The threat model of DoH is your local ISP. There is no threat model for DoH, only ad hoc attempts to justify it. Here's the thing, your ISP sees all of your packets with all the IP addresses and ports and payload size and the exact time they were sent and received. This identifies every website you visited with very high accuracy, I mean just IP addresses alone identify more than 90% of the websites you visited. >…

If you don't believe that DNS query data has any value, then you shouldn't have any opinion about where you send it. Your argument doesn't make any sense.

I'm not sure what you think NetFlow records contain.

Re: NextDNS Joins Firefox’s Trusted Recursive Resolver

#97

Post by zzzcpan »

tptacek wrote: post #96
zzzcpan wrote: post #92

Earlier quoted context omitted.

> The threat model of DoH is your local ISP. There is no threat model for DoH, only ad hoc attempts to justify it. Here's the thing, your ISP sees all of your packets with all the IP addresses and ports and payload size and the exact time they were sent and received. This identifies every website you visited with very high accuracy, I mean just IP addresses alone identify more than 90% of the websites you visited. >…

If you don't believe that DNS query data has any value, then you shouldn't have any opinion about where you send it. Your argument doesn't make any sense. I'm not sure what you think NetFlow records contain.

Luckily, I do believe that DNS query data has value, that's the reason I'm arguing against anti-privacy crap like DoH and have been since the beginning. If my arguments don't make sense to you, it's either because you lack understanding or have an agenda to push DoH.

> I'm not sure what you think NetFlow records contain.

I don't need to think what they contain, I implemented a netflow collector or two in the past.

Re: NextDNS Joins Firefox’s Trusted Recursive Resolver

#98

Post by tialaramex »

kick wrote: post #73
stock_toaster wrote: post #62

Earlier quoted context omitted.

> For all the commenters here who think that Google and the other major tech companies are somehow less trustworthy than your ISP? Yeah, I just can't agree with those opinions. Additionally, at least my ISP is doing business in my state/country, so there may be _some_ legal recourse if they screw me too hard.

DoH is only available in the U.S. for Firefox users as far as I'm aware, so all of the people who might be "screwed too hard" have legal recourse.

No it's available everywhere. It's a pref. The default if you haven't set the pref differs in the US.

Re: NextDNS Joins Firefox’s Trusted Recursive Resolver

#99

Post by autoexec »

icebraining wrote: post #51
core-questions wrote: post #19

Earlier quoted context omitted.

I assume every single DNS provider is logging and, if possible, selling my data. Why wouldn't I? This is actually why I use my own DNS server and resolve against the root, like anyone else who cares about privacy ought to be doing. Still, if your goal is to block your kids' access to things, DNS is a good place to do it. Works across all your devices and doesn't require any install.

> This is actually why I use my own DNS server and resolve against the root, like anyone else who cares about privacy ought to be doing. How do you prevent the ISP from logging those requests to the root?

Unless you're connected to a VPN 100% of the time wouldn't your ISP already have access to see every domain you browse to?

Re: NextDNS Joins Firefox’s Trusted Recursive Resolver

#100

Post by tptacek »

zzzcpan wrote: post #97
tptacek wrote: post #96

Earlier quoted context omitted.

If you don't believe that DNS query data has any value, then you shouldn't have any opinion about where you send it. Your argument doesn't make any sense. I'm not sure what you think NetFlow records contain.

Luckily, I do believe that DNS query data has value, that's the reason I'm arguing against anti-privacy crap like DoH and have been since the beginning. If my arguments don't make sense to you, it's either because you lack understanding or have an agenda to push DoH. > I'm not sure what you think NetFlow records contain. I don't need to think what they contain, I implemented a netflow collector or two in the past.

Same! I was the product lead on Arbor Networks DOS product. How exactly is it that you think that a heavily sampled collection of IP addresses is equivalent to the exact names you type into a URL bar?

The rest of your argument is just motte-and-bailey message board stuff. You started out saying that running your own local recurser is privacy-enhancing (it's the opposite) and that ISPs can see your DNS queries when you run DoH (they can't) and retreated to a position of "other things leak". That's true, other things do leak! We'll fix them too; we'll have ESNI soon enough, for instance. Make a coherent argument, please.

Post reply on HN