6 ms·

Why would I want my browser to do this? My browser should use the DNS configured by my OS -- in my case, a local, caching resolving NS. If I want to use some ki

Why would I want my browser to do this? My browser should use the DNS configured by my OS -- in my case, a local, caching resolving NS. If I want to use some kind of DNS-over-HTTP I'll tell my OS to do it. I don't want my browser making DNS decisions for me. What am I missing?

Proven 8y ago
You’re missing the BS PR - Mozilla is trying to “stay relevant”. While they harvest and aggregate user data. Your actual privacy is of secondary concern.
cerberusss 8y ago
Because at the moment, no major OS supports it.
- j605 8y ago
  dnscrypt-proxy (https://github.com/jedisct1/dnscrypt-proxy https://github.com/jedisct1/dnscrypt-proxy) supports all major platforms and checkout https://dnscrypt.info https://dnscrypt.info for more options.
  - nly 8y ago
    It's worth noting that this is from the principle developer of libsodium as well.
dao- 8y ago
You're missing that you can still configure the browser to your needs? You seem to be a power user so you can do this. Mozilla cares about average users too, and doesn't have control over OS defaults that may not be optimal for average users' privacy.
andrewaylett 8y ago
I, too, have a local caching resolver. And I'm unlikely to turn this on at the browser level, although I'm occasionally tempted to play with it in the resolver. But I strongly suspect we're in the minority and that something like this is the easiest -- and quite possibly the only -- way for many users to avoid DNS poisoning by ISPs.
- cremp 8y ago
  Not just ISPs; those using DNS-based adblockers (pi-hole and the like) will be impacted too (from my understanding.)
  - rovr138 8y ago
    You're right.
  - zamadatix 8y ago
    I think you missed the point of the parent comment, it wasn't that only ISPs poisoning DNS are impacted it was that this solves that problem for the vast majority who have no clue, excepting those who do the exact thing you describe and understand how to point it at their pi-hole.
felipelemos 8y ago
As long it is opt in I don't see this as a decision issue.
orf 8y ago
Your OS does not support it.
- 0xffff2 8y ago
  That doesn't mean it's suddenly in scope for a browser. The solution would be for the OS to support it, not for the browser to do an end-run around the OS's DNS settings.
  - orf 8y ago
    It is exactly in scope for a browser. The whole point is to stop your ISP getting your browsing history. Sure, would be nice for the OS to support it, but until that future point why wait.
    - 0xffff2 8y ago
      >Sure, would be nice for the OS to support it, but until that future point why wait. Because with the current system I can configure my DNS to my liking at my router and it propagates to all devices. Replacing that with a system where after every Firefox update I have to double check whether Firefox is still doing what I want on all devices is a total pain in the ass by comparison.
gnode 8y ago
You're missing that you're a technically skilled individual, and most browser users are not. The design decisions must cater to the unskilled, because they will not opt in manually. By default most OSes will use their ISP's DNS, and this will very often be insecure and compromised in some way.
megous 8y ago
Hmm, I have a feeling this feature will be opt out one day. One more thing to remember to turn off in Firefox, if you're running your own DNS over TLS with more elaborate config than what will be in Firefox. One thing I like about this DNS over TLS is that now it should be possible to route DNS requests over tor safely to a more trusted DNS resolving endpoint. Though I haven't yet checked how it would work with Cloudflare. Will I have to solve google captacha per handful of DNS requests if I try to access 1.1.1.1 from tor? Anyone tried?
LudoA 8y ago
I used this at some point on my Fedora laptop. I had issues on some hotel APs where it didn't allow me to see the 'login page' of the AP. What's the way to circumvent this problem? I'm frequently on public wifi's, so I need to access AP login pages without issue.
- bouke 8y ago
  Such captive portals are a pain anyway, even more reasons for providers to stop doing this — hijacking DNS requests.
- phicoh 8y ago
  The real solution is for the captive portal is to signal that there is a captive portal. Unfortunately that has turned into an arms race: some operating systems switch to a different browser when they detect a captive portal. So captive portals try to avoid detection, etc. Basically what you want is package that tries to detect a captive portal and when it detects one alerts the user and offer to start a browser that uses the DHCP-supplied DNS resolvers to interact with the portal.
- claudius 8y ago
  Trying to access any IP directly also typically works, e.g. 8.8.8.8. The redirect to that IP following the login is then of course broken/timing out, but that’s not really a problem.
- sanxiyn 8y ago
  Firefox tries to detect captive portals.
Seipaho8 8y ago
Because browsers follow a pattern of reinventing the wheel with different tradeoffs, primarily focusing on "secure" execution of untrusted code from the web. Just look at the stack of web technologies, they provide an ever-expanding set of abstractions and reinventions of what OSes already provide.

Proven 8y ago

You’re missing the BS PR - Mozilla is trying to “stay relevant”. While they harvest and aggregate user data. Your actual privacy is of secondary concern.

cerberusss 8y ago

Because at the moment, no major OS supports it.

j605 8y ago
dnscrypt-proxy (https://github.com/jedisct1/dnscrypt-proxy https://github.com/jedisct1/dnscrypt-proxy) supports all major platforms and checkout https://dnscrypt.info https://dnscrypt.info for more options.
- nly 8y ago
  It's worth noting that this is from the principle developer of libsodium as well.

dao- 8y ago

You're missing that you can still configure the browser to your needs? You seem to be a power user so you can do this. Mozilla cares about average users too, and doesn't have control over OS defaults that may not be optimal for average users' privacy.

andrewaylett 8y ago

I, too, have a local caching resolver. And I'm unlikely to turn this on at the browser level, although I'm occasionally tempted to play with it in the resolver. But I strongly suspect we're in the minority and that something like this is the easiest -- and quite possibly the only -- way for many users to avoid DNS poisoning by ISPs.

cremp 8y ago
Not just ISPs; those using DNS-based adblockers (pi-hole and the like) will be impacted too (from my understanding.)
- rovr138 8y ago
  You're right.
- zamadatix 8y ago
  I think you missed the point of the parent comment, it wasn't that only ISPs poisoning DNS are impacted it was that this solves that problem for the vast majority who have no clue, excepting those who do the exact thing you describe and understand how to point it at their pi-hole.

felipelemos 8y ago

As long it is opt in I don't see this as a decision issue.

orf 8y ago

Your OS does not support it.

0xffff2 8y ago
That doesn't mean it's suddenly in scope for a browser. The solution would be for the OS to support it, not for the browser to do an end-run around the OS's DNS settings.
- orf 8y ago
  It is exactly in scope for a browser. The whole point is to stop your ISP getting your browsing history. Sure, would be nice for the OS to support it, but until that future point why wait.
  - 0xffff2 8y ago
    >Sure, would be nice for the OS to support it, but until that future point why wait. Because with the current system I can configure my DNS to my liking at my router and it propagates to all devices. Replacing that with a system where after every Firefox update I have to double check whether Firefox is still doing what I want on all devices is a total pain in the ass by comparison.

gnode 8y ago

You're missing that you're a technically skilled individual, and most browser users are not. The design decisions must cater to the unskilled, because they will not opt in manually. By default most OSes will use their ISP's DNS, and this will very often be insecure and compromised in some way.

megous 8y ago

Hmm, I have a feeling this feature will be opt out one day. One more thing to remember to turn off in Firefox, if you're running your own DNS over TLS with more elaborate config than what will be in Firefox. One thing I like about this DNS over TLS is that now it should be possible to route DNS requests over tor safely to a more trusted DNS resolving endpoint. Though I haven't yet checked how it would work with Cloudflare. Will I have to solve google captacha per handful of DNS requests if I try to access 1.1.1.1 from tor? Anyone tried?

LudoA 8y ago

I used this at some point on my Fedora laptop. I had issues on some hotel APs where it didn't allow me to see the 'login page' of the AP. What's the way to circumvent this problem? I'm frequently on public wifi's, so I need to access AP login pages without issue.

bouke 8y ago
Such captive portals are a pain anyway, even more reasons for providers to stop doing this — hijacking DNS requests.
phicoh 8y ago
The real solution is for the captive portal is to signal that there is a captive portal. Unfortunately that has turned into an arms race: some operating systems switch to a different browser when they detect a captive portal. So captive portals try to avoid detection, etc. Basically what you want is package that tries to detect a captive portal and when it detects one alerts the user and offer to start a browser that uses the DHCP-supplied DNS resolvers to interact with the portal.
claudius 8y ago
Trying to access any IP directly also typically works, e.g. 8.8.8.8. The redirect to that IP following the login is then of course broken/timing out, but that’s not really a problem.
sanxiyn 8y ago
Firefox tries to detect captive portals.

Seipaho8 8y ago

Because browsers follow a pattern of reinventing the wheel with different tradeoffs, primarily focusing on "secure" execution of untrusted code from the web. Just look at the stack of web technologies, they provide an ever-expanding set of abstractions and reinventions of what OSes already provide.