3 ms·

This seems well-intentioned but incredibly dangerous. There's no promise CF can make that justifies trusting them to receive a stream of every request from eve

by brians 8y ago

This seems well-intentioned but incredibly dangerous. There's no promise CF can make that justifies trusting them to receive a stream of every request from every FF browser, with all this trackable metadata. In particular, I think it would be unsurprising if CF's lines were tapped upstream. CF and Mozilla staff have a history of treating TLS as if it protects all content, rather than as a tool for keeping narrowly defined secrets. I explain further at https://weblog.evenmere.org/posts/2014-05-16-tls-is-not-for-privacy.html https://weblog.evenmere.org/posts/2014-05-16-tls-is-not-for-... .

partiallypro 8y ago
Does Google do this with their own DNS service in Chrome...or would this open the door for them to do so? I don't like the implications.
sp332 8y ago
But since there's already a high risk of ISPs sniffing or even redirecting this traffic, you'd have to show that the risk for the average user is higher with CF.
- Coding_Cat 8y ago
  It funnels all _firefox_ requests through CF, as opposed to all _$ISP_ requests. Which one is worse for the user I find hard to say, but they'd definetely generate two completely different datasets. (for example, CF's set would be international).
Xylakant 8y ago
At the moment, this is an A/B test to see if DNS over HTTPS can keep up with regular DNS in term of performance in a real-world setting. It’s an opt-in study. That’s about the extend of it. You can explicitly enable DNS over HTTPs on recent FF versions if you want to, then you need to pick a provider. There are a few available choices out there. There’s a list on the cURL docs IIRC. Due to the standard being finalized right now, the list is understandably quite short, by there’s no particular reason you ISP shouldn’t offer a suitable DNS server in the future.
fasafsafsf 8y ago
>This seems well-intentioned but incredibly dangerous. Like many of the things the Mozilla Corporation has been doing these last years.

by brians 8y ago

partiallypro 8y ago

Does Google do this with their own DNS service in Chrome...or would this open the door for them to do so? I don't like the implications.

sp332 8y ago

But since there's already a high risk of ISPs sniffing or even redirecting this traffic, you'd have to show that the risk for the average user is higher with CF.

Coding_Cat 8y ago
It funnels all _firefox_ requests through CF, as opposed to all _$ISP_ requests. Which one is worse for the user I find hard to say, but they'd definetely generate two completely different datasets. (for example, CF's set would be international).

Xylakant 8y ago

At the moment, this is an A/B test to see if DNS over HTTPS can keep up with regular DNS in term of performance in a real-world setting. It’s an opt-in study. That’s about the extend of it. You can explicitly enable DNS over HTTPs on recent FF versions if you want to, then you need to pick a provider. There are a few available choices out there. There’s a list on the cURL docs IIRC. Due to the standard being finalized right now, the list is understandably quite short, by there’s no particular reason you ISP shouldn’t offer a suitable DNS server in the future.

fasafsafsf 8y ago

>This seems well-intentioned but incredibly dangerous. Like many of the things the Mozilla Corporation has been doing these last years.