5 ms·

The article doesn't suggest there's something sneaky going on. The article is suggesting that Mozilla are choosing to share your DNS queries with a third party

The article doesn't suggest there's something sneaky going on. The article is suggesting that Mozilla are choosing to share your DNS queries with a third party service by default, which is exactly what they're doing. It's not about them choosing Cloudflare in particular, it's about them choosing any particular service by default. And the article's argument that, if you have to choose somebody to share this data with, it might as well be the people you already share it with, seems pretty valid to me. edit: I have to point out that the article has backed away from the claim that this will be enabled by default in September. Looking at the Mozilla blog, they mention wanting to enable this by default but have no actual plan to do so (and more crucially doesn't discuss at all what sort of form it would have to be in for them to enable it by default, it may look nothing like the cloudflare-default we're discussing here).

Xylakant 8y ago
The default applies currently if you enable an experimental feature. They hammered out a tight privacy agreement for one service and use that as default while this is stabilized. You can pick any other resolver if you prefer. Seems a legit way of handling this. > And the article's argument that, if you have to choose somebody to share this data with, it might as well be the people you already share it with, seems pretty valid to me. The whole point of HTTPS and DNS-over-HTTPS is to not share any data at all with your provider. It’s not entirely working right now due to SNI being plaintext, but work is being done on that, too. So that’s really not a good argument.
- nebulous1 8y ago
  > The whole point of HTTPS and DNS-over-HTTPS is to not share any data at all with your provider. It’s not entirely working right now due to SNI being plaintext, but work is being done on that, too. So that’s really not a good argument. If that was the whole point of https then we wouldn't have plaintext SNI. I can't even begin to understand why you think that there being a draft of an SNI encryption standard makes it 'really not a good argument'.
  - Xylakant 8y ago
    Originally, HTTPS required a dedicated IP address (or at least a dedicated IP/Port pair) for the server. SNI is a tack-on on TLS to fix that, so that TLS can be deployed more widely, allowing to encrypt traffic that was plaintext before. Encrypted SNI is a tack-on to fix that SNI needs to transmitted in plaintext. So yes, the design goal of HTTPS is to hide as much information from all intermediaries as possible. It’s just that you can’t fix everything at once, so gradual improvements are made.
    - nebulous1 8y ago
      Well, I can't get behind saying that hiding the site your visiting from your provider is the "whole point" of https when it specifically doesn't do that. I mean, we both understand what https is aiming to do in general, and I assume you aren't suggesting that https has been an complete failure since SNI was introduced. However, admittedly I'm just reacting to you using the term "whole point" in conjunction with something it's failing to do.
      - Xylakant 8y ago
        I’m not suggesting https is a complete failure. I’m saying that HTTPS hasn’t yet achieved all that it intended to cover. It does the best it can given current real world constraints. That requires tradeoffs. But work is done to improve the situation and I’m generally happy for every feature that pushes the needle in the right direction.
- soziawa 8y ago
  > The whole point of HTTPS and DNS-over-HTTPS is to not share any data at all with your provider. Won't they still see which website you then request?
  - Xylakant 8y ago
    Currently, the provider could read the SNI value from the request, but work is done to encrypt that as well. This would allow them to see which Hostnamen was requested, but they cannot peek into the actual transmission (which is incidentally how domain fronting works: announce a different SNI than the actual requests Host header)
- _Codemonkeyism 8y ago
  Cloudflare is an US company, their privacy statement is worth zero to most Firefox users.
  - Xylakant 8y ago
    Most Firefox users are absolutely unaffected by this. Literally all people that don’t explicitly enable this. All those who do might want to make up their mind if they want to participate in this and if they want CF to be their provider of trust. Keep in mind that CF will see a substantial chunk of the traffic anyways. Mozilla seems to be confident in that agreement and I have a certain amount of trust in Mozilla which factors into my decision. Yours might be different, so don’t enable that feature or use a different provider.
    - _Codemonkeyism 8y ago
      FF will turn this on for everybody and Cloudflare will be the default 2018? Don't know. 2019? For sure. All FF browsing meta data flows into the US, the country with the most spies and no legal framework to go to court. So your argument is an obvious straw man and one wonders about your motivations to support getting all the browsing meta data into the US by default. Moving my data from Germany to the US will not make me more secure in any way. And talking about repressed countries is like "think about the children!" for the rest of us - a nice lever to sell this massive data vacuuming.
      - Xylakant 8y ago
        Why do you believe that this will be default on at any time in the near future without a reasonable configuration UI and without a reasonable set of DoH-capable nameservers? Especially given that this would break a substantial number of existing setupts? If you have this little faith into the FF/Mozilla folks, why do you keep using FF? If you’re not using Firefox, what are you concerned about?
        mrob 8y ago
        If they don't turn it on by default, only a small number of people will use it. If only a small number of people use it, why bother implementing it?
deleted 8y ago
[deleted]
oxymoron 8y ago
That’s simply not true. Mozilla is not sharing DNS queries with Cloudfare by default, nor are they overriding your configured DNS servers per default. This is an experimental opt-in feature, and they are also running an opt-in study. There has been no announcement of an ”on by default” for DOH. If you enable the experimental feature there is no default provided and you have to set your own server, but if you opt in to the study, you’ll get Cloudfare. This is almost pure FUD at this point.
- _Codemonkeyism 8y ago
  Just to be clear, the authors are wrong? There will not be a September patch that overrides my network DNS settings? "With the next Mozilla patch in September any DNS change you configure in your network won't have any effect anymore, at least for browsing with Firefox, because Mozilla has partnered up with Cloudflare and will resolve the domain names from the application itself via a DNS server from Cloudflare based in the United States."
  - orf 8y ago
    Do you seriously believe that Mozilla is issuing a patch in September that will somehow force you to use Cloudflare as a DNS provider? That 'any DNS change you configure in your network won't have any effect anymore'? Do you know many setups that would break? Of course the article is wrong. Classic FUD.
    - xg15 8y ago
      Actually, yes, I do. From their blog: > We believe that negotiating a privacy first operating agreement is something that Firefox can do for people that is just impractical to ask them to do for themselves. Imagine calling up your residential ISP and asking them to agree to an audit that demonstrates they do not log your IP address on their DNS server. And then repeating the process for your favorite coffee shop, library, friend’s house — anywhere you and your browser go to connect. Firefox improves user privacy by default by finding good partners, establishing legal agreements that put privacy first, and eventually shipping a default configuration we believe is best. They know about the power of default settings - and with the current default, they will be unable to roll-out this feature to a meaningful number of users. So at some point, the default will probably change to activate DoH. Technically, this isn't "force" as you'll probably be able to turn it back off via about:config - if you know which options to change, what to change them to and if you are willing to click past the "if you proceed, you may damage your computer" warning. Not every random guest that wants to access your local Nexcloud instance will be willing to do this.
jopsen 8y ago
So.. in some future Mozilla might select a default DNS provider on your behalf. Did you consider the upside? Mozilla can negotiate on your behalf. Mozilla can obtain favorable terms of service, concessions in privacy, third-party reviews. Things you would never be able to negotiate for. If you think of Mozilla as negotiating on your behalf, they have motive to protect you, and they have the leverage to get concessions from 3rd party vendors. Think of Mozilla as using the collective bargaining power of it's user-base to get favorable terms. This could be a game changer.
- Xylakant 8y ago
  It’s already happening: the DoH endpoint that Mozilla defaults to on the CF-Side has a stronger privacy agreement as per https://blog.nightly.mozilla.org/2018/06/01/improving-dns-privacy-in-firefox/ https://blog.nightly.mozilla.org/2018/06/01/improving-dns-pr...
  - kiriakasis 8y ago
    CF is not a default. There is no default. CF is a partner in studying an experimental feature
- nebulous1 8y ago
  I can't see myself ever supporting this as opt-out rather than opt-in.
  - jopsen 8y ago
    Will it not improve security for the majority of Firefox users?
- wvh 8y ago
  This replaces decentralised with centralised in the hope it would be a good idea if the choice is right. I'm sceptical, if nothing else because it would be easier to compromise or DoS one target than a lot of individual DNS providers.
wodenokoto 8y ago
> The article doesn't suggest there's something sneaky going on. The article headline is "Mozilla's new DNS resolution is dangerous", so I guess you are right in saying they are not "suggesting", because they are down right accusing Mozilla of being sneaky.
- nebulous1 8y ago
  Sneaky and dangerous are not the same thing

Xylakant 8y ago

The default applies currently if you enable an experimental feature. They hammered out a tight privacy agreement for one service and use that as default while this is stabilized. You can pick any other resolver if you prefer. Seems a legit way of handling this. > And the article's argument that, if you have to choose somebody to share this data with, it might as well be the people you already share it with, seems pretty valid to me. The whole point of HTTPS and DNS-over-HTTPS is to not share any data at all with your provider. It’s not entirely working right now due to SNI being plaintext, but work is being done on that, too. So that’s really not a good argument.

nebulous1 8y ago
> The whole point of HTTPS and DNS-over-HTTPS is to not share any data at all with your provider. It’s not entirely working right now due to SNI being plaintext, but work is being done on that, too. So that’s really not a good argument. If that was the whole point of https then we wouldn't have plaintext SNI. I can't even begin to understand why you think that there being a draft of an SNI encryption standard makes it 'really not a good argument'.
- Xylakant 8y ago
  Originally, HTTPS required a dedicated IP address (or at least a dedicated IP/Port pair) for the server. SNI is a tack-on on TLS to fix that, so that TLS can be deployed more widely, allowing to encrypt traffic that was plaintext before. Encrypted SNI is a tack-on to fix that SNI needs to transmitted in plaintext. So yes, the design goal of HTTPS is to hide as much information from all intermediaries as possible. It’s just that you can’t fix everything at once, so gradual improvements are made.
  - nebulous1 8y ago
    Well, I can't get behind saying that hiding the site your visiting from your provider is the "whole point" of https when it specifically doesn't do that. I mean, we both understand what https is aiming to do in general, and I assume you aren't suggesting that https has been an complete failure since SNI was introduced. However, admittedly I'm just reacting to you using the term "whole point" in conjunction with something it's failing to do.
    - Xylakant 8y ago
      I’m not suggesting https is a complete failure. I’m saying that HTTPS hasn’t yet achieved all that it intended to cover. It does the best it can given current real world constraints. That requires tradeoffs. But work is done to improve the situation and I’m generally happy for every feature that pushes the needle in the right direction.
soziawa 8y ago
> The whole point of HTTPS and DNS-over-HTTPS is to not share any data at all with your provider. Won't they still see which website you then request?
- Xylakant 8y ago
  Currently, the provider could read the SNI value from the request, but work is done to encrypt that as well. This would allow them to see which Hostnamen was requested, but they cannot peek into the actual transmission (which is incidentally how domain fronting works: announce a different SNI than the actual requests Host header)
_Codemonkeyism 8y ago
Cloudflare is an US company, their privacy statement is worth zero to most Firefox users.
- Xylakant 8y ago
  Most Firefox users are absolutely unaffected by this. Literally all people that don’t explicitly enable this. All those who do might want to make up their mind if they want to participate in this and if they want CF to be their provider of trust. Keep in mind that CF will see a substantial chunk of the traffic anyways. Mozilla seems to be confident in that agreement and I have a certain amount of trust in Mozilla which factors into my decision. Yours might be different, so don’t enable that feature or use a different provider.
  - _Codemonkeyism 8y ago
    FF will turn this on for everybody and Cloudflare will be the default 2018? Don't know. 2019? For sure. All FF browsing meta data flows into the US, the country with the most spies and no legal framework to go to court. So your argument is an obvious straw man and one wonders about your motivations to support getting all the browsing meta data into the US by default. Moving my data from Germany to the US will not make me more secure in any way. And talking about repressed countries is like "think about the children!" for the rest of us - a nice lever to sell this massive data vacuuming.
    - Xylakant 8y ago
      Why do you believe that this will be default on at any time in the near future without a reasonable configuration UI and without a reasonable set of DoH-capable nameservers? Especially given that this would break a substantial number of existing setupts? If you have this little faith into the FF/Mozilla folks, why do you keep using FF? If you’re not using Firefox, what are you concerned about?
      - mrob 8y ago
        If they don't turn it on by default, only a small number of people will use it. If only a small number of people use it, why bother implementing it?

deleted 8y ago

[deleted]

oxymoron 8y ago

That’s simply not true. Mozilla is not sharing DNS queries with Cloudfare by default, nor are they overriding your configured DNS servers per default. This is an experimental opt-in feature, and they are also running an opt-in study. There has been no announcement of an ”on by default” for DOH. If you enable the experimental feature there is no default provided and you have to set your own server, but if you opt in to the study, you’ll get Cloudfare. This is almost pure FUD at this point.

_Codemonkeyism 8y ago
Just to be clear, the authors are wrong? There will not be a September patch that overrides my network DNS settings? "With the next Mozilla patch in September any DNS change you configure in your network won't have any effect anymore, at least for browsing with Firefox, because Mozilla has partnered up with Cloudflare and will resolve the domain names from the application itself via a DNS server from Cloudflare based in the United States."
- orf 8y ago
  Do you seriously believe that Mozilla is issuing a patch in September that will somehow force you to use Cloudflare as a DNS provider? That 'any DNS change you configure in your network won't have any effect anymore'? Do you know many setups that would break? Of course the article is wrong. Classic FUD.
  - xg15 8y ago
    Actually, yes, I do. From their blog: > We believe that negotiating a privacy first operating agreement is something that Firefox can do for people that is just impractical to ask them to do for themselves. Imagine calling up your residential ISP and asking them to agree to an audit that demonstrates they do not log your IP address on their DNS server. And then repeating the process for your favorite coffee shop, library, friend’s house — anywhere you and your browser go to connect. Firefox improves user privacy by default by finding good partners, establishing legal agreements that put privacy first, and eventually shipping a default configuration we believe is best. They know about the power of default settings - and with the current default, they will be unable to roll-out this feature to a meaningful number of users. So at some point, the default will probably change to activate DoH. Technically, this isn't "force" as you'll probably be able to turn it back off via about:config - if you know which options to change, what to change them to and if you are willing to click past the "if you proceed, you may damage your computer" warning. Not every random guest that wants to access your local Nexcloud instance will be willing to do this.

jopsen 8y ago

So.. in some future Mozilla might select a default DNS provider on your behalf. Did you consider the upside? Mozilla can negotiate on your behalf. Mozilla can obtain favorable terms of service, concessions in privacy, third-party reviews. Things you would never be able to negotiate for. If you think of Mozilla as negotiating on your behalf, they have motive to protect you, and they have the leverage to get concessions from 3rd party vendors. Think of Mozilla as using the collective bargaining power of it's user-base to get favorable terms. This could be a game changer.

Xylakant 8y ago
It’s already happening: the DoH endpoint that Mozilla defaults to on the CF-Side has a stronger privacy agreement as per https://blog.nightly.mozilla.org/2018/06/01/improving-dns-privacy-in-firefox/ https://blog.nightly.mozilla.org/2018/06/01/improving-dns-pr...
- kiriakasis 8y ago
  CF is not a default. There is no default. CF is a partner in studying an experimental feature
nebulous1 8y ago
I can't see myself ever supporting this as opt-out rather than opt-in.
- jopsen 8y ago
  Will it not improve security for the majority of Firefox users?
wvh 8y ago
This replaces decentralised with centralised in the hope it would be a good idea if the choice is right. I'm sceptical, if nothing else because it would be easier to compromise or DoS one target than a lot of individual DNS providers.

wodenokoto 8y ago

> The article doesn't suggest there's something sneaky going on. The article headline is "Mozilla's new DNS resolution is dangerous", so I guess you are right in saying they are not "suggesting", because they are down right accusing Mozilla of being sneaky.

nebulous1 8y ago
Sneaky and dangerous are not the same thing