4 ms·

I love Mozilla, but it's difficult to take this seriously while they're still partnering with Cloudflare on in-browser resolvers that bypass my local DNS resolv

I love Mozilla, but it's difficult to take this seriously while they're still partnering with Cloudflare on in-browser resolvers that bypass my local DNS resolver and expose my lookups to Cloudflare: https://blog.mozilla.org/futurereleases/2019/04/02/dns-over-https-doh-update-recent-testing-results-and-next-steps/ https://blog.mozilla.org/futurereleases/2019/04/02/dns-over-...

josteink 7y ago
I mean... I’m fine with Cloudflare DoH being an option. But being the default? That’s just crazy.
- afiori 7y ago
  As far as I remember having a predefined default was never actually considered.
  - josteink 7y ago
    I don't know what the default is now, but the intention was always to make it the default: https://securityonline.info/doh-encrypted-networking/ https://securityonline.info/doh-encrypted-networking/
    - acdha 7y ago
      Whoever wrote that blog post made several claims which are contradicted by the linked blog post. I'm wondering whether that's just being confused on the different between enabling the DoH code behind a disabled default setting and changing the default configuration to use a particular server. Here's what Mozilla said: > Firefox does not yet use DoH by default. See the end of this post for instructions on how you can configure Nightly to use (or not use) any DoH server. > Our second effort focuses on building a default configuration for DoH servers that puts privacy first. https://blog.nightly.mozilla.org/2018/06/01/improving-dns-privacy-in-firefox/ https://blog.nightly.mozilla.org/2018/06/01/improving-dns-pr...
Kalium 7y ago
Do you think there are users for whom this might be a valuable feature that protects them from snooping ISPs? Any such feature, of course, must be something configurable such that any user wishing to use their own DNS provider can do so.
- autoexec 7y ago
  Maybe, but no one is forced to use their ISPs DNS either. Giving user's data to one snoop to protect them from another doesn't sound like a win to me either way.
  - Kalium 7y ago
    The nice thing about Firefox is that you can configure it to use any DNS resolver you please! It may perhaps be worth considering privacy-enhancing settings in the context of a mass-market product, where the vast majority of users do not know what DNS is and do not run their own resolvers. In such a context, do you think it might be possible that most users might be better off with privacy-first defaults? With, of course, all the appropriate configuration options for more sophisticated users.
captn3m0 7y ago
Mozilla has published a DoH resolver policy[0], which should hopefully allow more resolvers to be added to the default list, and let Firefox pick as per latency. My personal resolver gives me better latency than both CF and Google, and I plan to get it added to the list[1]. [0]: https://wiki.mozilla.org/Security/DOH-resolver-policy https://wiki.mozilla.org/Security/DOH-resolver-policy [1]: https://captnemo.in/dns/privacy/ https://captnemo.in/dns/privacy/, https://captnemo.in/doh/ https://captnemo.in/doh/
seieste 7y ago
DOH makes Pihole ineffective.
- sjwright 7y ago
  Pihole is redundant in Firefox with uBlock Origin.
  - Proven 7y ago
    It isn't redundant because it blocks crap LAN-wide regardless of the app used.
- zaarn 7y ago
  PiHole just needs to implement DoH as both client and server.
sjwright 7y ago
What makes you think your local DNS resolver is more secure? Does it have a secure connection to all of its upstream sources?
pbhjpbhj 7y ago
Um, wtf? So, they're now bypassing user choice on DNS in order to send your domain lookups to Cloudflare and this is supposed to be security? From https://bugzilla.mozilla.org/show_bug.cgi?id=1529437 https://bugzilla.mozilla.org/show_bug.cgi?id=1529437 it says "[QA:] We have finished testing ... GREEN - SHIP IT" and "signed version [...] for release". Does that mean it went mainstream and is now a browser default? I see a preference name "network.trr.uri" with a cloudflare URL used for "dns-query" ... that looks bad? Edit: just found this from Mozilla "We are currently exploring what the right testing approach should be with users who have opted to participate by using Firefox Nightly." (from Senior Dir. for Eng., https://www.theregister.co.uk/2018/03/20/mozilla_firefox_test_of_privacy_mechanism_prompts_privacy_worries/ https://www.theregister.co.uk/2018/03/20/mozilla_firefox_tes...) Mozilla's official line is that they consider using nightly as an opt in to send all your DNS requests to a third-party. Now come on, no-one at Mozilla believes that is true to users expectations.

josteink 7y ago

I mean... I’m fine with Cloudflare DoH being an option. But being the default? That’s just crazy.

afiori 7y ago
As far as I remember having a predefined default was never actually considered.
- josteink 7y ago
  I don't know what the default is now, but the intention was always to make it the default: https://securityonline.info/doh-encrypted-networking/ https://securityonline.info/doh-encrypted-networking/
  - acdha 7y ago
    Whoever wrote that blog post made several claims which are contradicted by the linked blog post. I'm wondering whether that's just being confused on the different between enabling the DoH code behind a disabled default setting and changing the default configuration to use a particular server. Here's what Mozilla said: > Firefox does not yet use DoH by default. See the end of this post for instructions on how you can configure Nightly to use (or not use) any DoH server. > Our second effort focuses on building a default configuration for DoH servers that puts privacy first. https://blog.nightly.mozilla.org/2018/06/01/improving-dns-privacy-in-firefox/ https://blog.nightly.mozilla.org/2018/06/01/improving-dns-pr...

Kalium 7y ago

Do you think there are users for whom this might be a valuable feature that protects them from snooping ISPs? Any such feature, of course, must be something configurable such that any user wishing to use their own DNS provider can do so.

autoexec 7y ago
Maybe, but no one is forced to use their ISPs DNS either. Giving user's data to one snoop to protect them from another doesn't sound like a win to me either way.
- Kalium 7y ago
  The nice thing about Firefox is that you can configure it to use any DNS resolver you please! It may perhaps be worth considering privacy-enhancing settings in the context of a mass-market product, where the vast majority of users do not know what DNS is and do not run their own resolvers. In such a context, do you think it might be possible that most users might be better off with privacy-first defaults? With, of course, all the appropriate configuration options for more sophisticated users.

captn3m0 7y ago

Mozilla has published a DoH resolver policy[0], which should hopefully allow more resolvers to be added to the default list, and let Firefox pick as per latency. My personal resolver gives me better latency than both CF and Google, and I plan to get it added to the list[1]. [0]: https://wiki.mozilla.org/Security/DOH-resolver-policy https://wiki.mozilla.org/Security/DOH-resolver-policy [1]: https://captnemo.in/dns/privacy/ https://captnemo.in/dns/privacy/, https://captnemo.in/doh/ https://captnemo.in/doh/

seieste 7y ago

DOH makes Pihole ineffective.

sjwright 7y ago
Pihole is redundant in Firefox with uBlock Origin.
- Proven 7y ago
  It isn't redundant because it blocks crap LAN-wide regardless of the app used.
zaarn 7y ago
PiHole just needs to implement DoH as both client and server.

sjwright 7y ago

What makes you think your local DNS resolver is more secure? Does it have a secure connection to all of its upstream sources?

pbhjpbhj 7y ago

Um, wtf? So, they're now bypassing user choice on DNS in order to send your domain lookups to Cloudflare and this is supposed to be security? From https://bugzilla.mozilla.org/show_bug.cgi?id=1529437 https://bugzilla.mozilla.org/show_bug.cgi?id=1529437 it says "[QA:] We have finished testing ... GREEN - SHIP IT" and "signed version [...] for release". Does that mean it went mainstream and is now a browser default? I see a preference name "network.trr.uri" with a cloudflare URL used for "dns-query" ... that looks bad? Edit: just found this from Mozilla "We are currently exploring what the right testing approach should be with users who have opted to participate by using Firefox Nightly." (from Senior Dir. for Eng., https://www.theregister.co.uk/2018/03/20/mozilla_firefox_test_of_privacy_mechanism_prompts_privacy_worries/ https://www.theregister.co.uk/2018/03/20/mozilla_firefox_tes...) Mozilla's official line is that they consider using nightly as an opt in to send all your DNS requests to a third-party. Now come on, no-one at Mozilla believes that is true to users expectations.