16 ms·

How to Enable DNS-over-HTTPS in Firefox

269 points by smacktoward 7y ago

plg 7y ago
My Pi-hole is set up to do encrypted DNS. Advantage: every device on my home network automatically benefits from this.
- kodachi 7y ago
  I was thinking for a while to do more networking security at home, from basic stuff like a guest's wifi, to white-listing content and ports. How much time did it take you to set up Pi-hole to your liking?
  - ahipple 7y ago
    I set it up a couple of months ago as well and as I recall I went from zero to "up and running" in an hour or two — I usually wake up a little earlier than my wife and I'd finished setting it up by the time we were ready to make breakfast. The ArchWiki page (https://wiki.archlinux.org/index.php/Pi-hole https://wiki.archlinux.org/index.php/Pi-hole) was a useful reference for the few snags I encountered.
    - theWheez 7y ago
      I’ll second this. Pi-Hole was very easy to set up and gives me some good peace of mind. Love seeing query trends too.
  - plg 7y ago
    Not long at all for the basic setup. For encrypted DNS setup I used this guide which worked: https://scotthelme.co.uk/securing-dns-across-all-of-my-devices-with-pihole-dns-over-https-1-1-1-1/ https://scotthelme.co.uk/securing-dns-across-all-of-my-devic...
  - kodachi 7y ago
    Thanks all. Of course the arch wiki is a good place to go. I will definitely give it a try.
  - StreamBright 7y ago
    It is pretty simple to set up. You can do it in 1 hour.
- noncoml 7y ago
  So instead of getting spied, blocked, tampered, etc. by your ISP you are getting spied by Cloudflare? We didn’t solve the problem, just shifted it..
  - satokema 7y ago
    What DNS provider is actually trustworthy and how can you prove it?
  - greenyoda 7y ago
    My ISP knows my real-world identity: name, address, phone number and credit card information. Cloudflare knows none of these things about me, so there's much less they can do with my browsing information.
    - tinus_hn 7y ago
      Cloudflare has access to many of the sites you browse. They have the SSL keys, they host the services. They (potentially) know a lot more about you than your ISP. If you ever bought something from a web shop hosted on Cloudflare they have access to your billing address, credit card info and what you are buying. They may not collect it but they do have access.
  - celsoazevedo 7y ago
    Set up your own server then?
  - BlackRing 7y ago
    Who said he was using cloudflare as his upstream DNS? There are far more choices than cloudflare, google, or your ISP.
  - snek 7y ago
    Cloudflare has a list of all data they collect from firefox DoH here: https://developers.cloudflare.com/1.1.1.1/commitment-to-privacy/privacy-policy/firefox/ https://developers.cloudflare.com/1.1.1.1/commitment-to-priv...
- xjay 7y ago
  That is, until software on any of these devices start running their DNS queries through DoH directly, circumventing any DNS filtering at the perimeter. This is what browsers, like Firefox, are likely to do as it stands today.
  - StreamBright 7y ago
    Then there can be a browser that does not do that and this is what I will use.
    - andrerm 7y ago
      Until you're minority, the browser don't receives funds enough and dies
  - tinus_hn 7y ago
    And then you change the setting from the default to make it do what you want. The sky is not falling.
    - TeMPOraL 7y ago
      Until they take that setting away from you, "because security". Not to mention that where DNS was centrally managed before, now you have to change settings in each and every application that uses DoH to resolve names on the Internet. (And then Google decides to do cert pinning on DoH, and suddenly you can only ever use 8.8.8.8 and 1.1.1.1, and if you want to change it, you need to buy Enterprise version of Chrome.)
      - andrerm 7y ago
        I do think you're right. And I also think that DoH will legitimate MITM because if application developers can break an long standing contract like DNS on OS well... "why can't we"
    - andrerm 7y ago
      Until you can't any more
- plg 7y ago
  tried this (installing unbound) — seems to work well, easy install https://docs.pi-hole.net/guides/unbound/#setting-up-pi-hole-as-a-recursive-dns-server-solution https://docs.pi-hole.net/guides/unbound/#setting-up-pi-hole-...
krispbyte 7y ago
Why is this supported at the application level instead of the OS? So other tools like ping or nslookup can use it too.
- the_angry_angel 7y ago
  This is my beef with (my understanding maybe incomplete, in which case I apologise) the implementation. Internal DNS, split brain DNS aren’t catered for without disabling support? I don’t want my internal names leaking to the internet, nor necessarily are they the same for external resolvers. Now yes the latter is a hack, but it’s one widely used still today. The idea is laudable. But it feels hostile. I can disable support, but for how long?
  - tssva 7y ago
    Once Firefox starts to ignore DNS resolvers configured at the OS level other apps are sure to look at it and think it must be a good idea because Firefox is doing it. Soon there will be a multitude of applications needing this disabled in their own unique way. If the Mozilla Foundation see this as an issue they should instead be developing a separate solution to provide this system wide. If you must bundle it with Firefox and offer to install it at browser installation or upgrade time. Don't install it by default and certainly don't enable it without user permission.
  - krispbyte 7y ago
    I guess it would be possible to run my own local DNS server that connects to these DoH servers. Does any DNS server support DoH? This could also allow the user to override domains using their /etc/hosts file in case DoH on Firefox doesn't support it.
    - uponcoffee 7y ago
      I use pihole + dnscrypt-proxy 2.* A fair number of resolvers support DoH and dnscrypt-proxy also supports DoT. It's fairly feature rich, you can configure a hosts file and then some. [0] https://github.com/jedisct1/dnscrypt-proxy https://github.com/jedisct1/dnscrypt-proxy
monsterbash506 7y ago
DNS over HTTPS is a requirement for ESNI. You should enable that too if you want to stay up to date on the latest privacy features.
redder2 7y ago
TLTR: Question: To what do I set network.trr.bootstrapAddress for https://doh.appliedprivacy.net/query https://doh.appliedprivacy.net/query? I am confused. The guide tell me to set: network.trr.uri But Foundation for Applied Privacy sounds nice and I want to force DNS over HTTPS. The site specifically tells me to use the the Firfeox setting page https://appliedprivacy.net/services/dns/ https://appliedprivacy.net/services/dns/ but that sets network.trr.custom_uri not network.trr.uri so whats the diffrence? And it also tells that I have to set the network.trr.bootstrapAddress but does not tell you to what in case I missed something.
mlrhazi 7y ago
I saw somewhere that this can be enabled in Chrome from chrome://flags/, but I can't seem to find it in mine, v75 on Mac. Was it removed from recent versions?
- judge2020 7y ago
  A chromium project called Bromite exposes this flag[0], but I don't think it's ever been available on Desktop versions of Chrome (probably due to the likelihood of Schools, Enterprises, etc. getting mad if a user uses it to circumvent DNS blocks). As per a comment by Eric [unknown surname] at Microsoft here[1], you can enable it on desktop chrome by adding the following to your chrome launch options: --enable-features="dns-over-https<DoHTrial" --force-fieldtrials="DoHTrial/Group1" --force-fieldtrial-params="DoHTrial.Group1:server/https%3A%2F%2F1.1.1.1%2Fdns-query/method/POST This can easily be done persistently via Windows, but I'm not sure what it would take on Mac. The official Chromium guide for starting with launch options[2] only recommends opening terminal every time, which would mean it can't be easily ran on each launch with the shortcut/dock icon. 0: https://github.com/bromite/bromite/wiki/Enabling-DNS-over-HTTPS https://github.com/bromite/bromite/wiki/Enabling-DNS-over-HT... 1: https://crbug.com/799753#c8 https://crbug.com/799753#c8 2: https://www.chromium.org/developers/how-tos/run-chromium-with-flags https://www.chromium.org/developers/how-tos/run-chromium-wit...
  - mlrhazi 7y ago
    Thank you!
SimeVidas 7y ago
PSA Firefox Nightly is very stable (with occasional breakage on some websites). It has the latest features, including a convenient checkbox for DoH: https://i.imgur.com/NhifLq5.png https://i.imgur.com/NhifLq5.png
- blitmap 7y ago
  I don't know how I've improved the situation going from Chrome to Firefox and then to Firefox Nightly: I wish Mozilla put efforts toward preserving settings and not reinstalling search providers one has purposefully removed. I understand that by using Nightly I cannot expect what a general user expects, but this problem exists in all browsers. I consider it user-hostile behavior that more emphasis isn't taken to preserve settings. Oh a new update? Clearly you want us to sync everything instead of just the few things you selected. Let's revert it all to defaults. I also understand how settings are stored (the backend format) might change between minor or major versions. Sometimes factory defaults need to be reinstated - but it should be very fucking clear (with a notification) that the user should go review settings that have changed/reverted. And this cannot be a banner that shows every time an update applies. Give the user some transparency. On Chrome when I ask it to preserve my previous session it preserves just that session's browsing history. This history is forgotten if I make a point to close all tabs and end the session. On Firefox I must save all history be to 'restore the current session'. Wish we had more control over this. You can't disable Firefox from checking for updates (I wish this could be left to package managers on some systems). I understand but I don't want to be nagged. You can make Firefox ask you, but it will check nonetheless. Why the fuck would I want "Recommmend features as I browse?" or "Recommend extensions as I browse?" I hate being advertised to. "Warn you about unwanted and uncommon software" - who is making this determination? Who is Firefox talking to about what I download? I wish I could sync settings, open tabs, addresses, history, etc - to an simple archive on close or periodically. No online service to sync against with another account I have to worry about. Sucks that in hotels Firefox determines if there's a captive portal in effect by querying a Mozilla-hosted site (detectportal.firefox.com). Blah.
  - the_pwner224 7y ago
    > On Firefox I must save all history be to 'restore the current session'. Wish we had more control over this. What do you mean by that? I have mine set to never remember history, and I often force-kill FF as a way to save a session. When I start it up again it prompts to restore the previous session. > You can't disable Firefox from checking for updates (I wish this could be left to package managers on some systems). Firefox's updater is disabled on Arch Linux and iirc also Ubuntu/Fedora/etc. The 'About' window says that it has been disabled by the system administrator. Presumably this is either an about:config setting (good) or a compile-time flag (sad). > Why the fuck would I want "Recommmend features as I browse?" or "Recommend extensions as I browse?" I hate being advertised to. These aren't ads; you can't pay to have your extension shown to users. Recommending features is done by the browser on your computer; iirc the addons recommendations are also computed locally based on anonymized data (don't quote me on that though). I at least find the feature suggestions to have been helpful. Many normal people won't know about reader mode, and FF on Android also tells you that bookmarking a page will save it for offline use, which I would not have otherwise known. > "Warn you about unwanted and uncommon software" - who is making this determination? Who is Firefox talking to about what I download? Google is used; if a file seems suspicious only then are details sent to google to give the final word. I wish they were more upfront about that. But FF is targeted at normal people, and this does help them not get malware. Advanced users like us can easily disable it. That doesn't excuse the lack of transparency though. > Sucks that in hotels Firefox determines if there's a captive portal in effect by querying a Mozilla-hosted site (detectportal.firefox.com). How else do you propose they do this? And better to have Mozilla host it than someone else. On Android you are forced to use Google's NTP servers, and I have no doubt their captive portal detection is also google-hosted. I'd bet the detection URL is exposed in an about:config flag on FF. > I wish I could sync settings, open tabs, addresses, history, etc - to an simple archive on close or periodically. No online service to sync against with another account I have to worry about. For what its worth, Firefox Sync is e2e encrypted with your password. If you log out of sync on all your devices and forget your password, the synced data is gone forever. To log back in you will have to reset the password, and since none of your devices are logged in (they act as backups for the data), it is gone forever.
johnklos 7y ago
I wonder how long it'll be before Firefox comes with it enabled by default. It seems that they're going to do it regardless of the loss of control implications to end users.
- userbinator 7y ago
  It seems that they're going to do it regardless of the loss of control implications to end users. That seems to be a common trend these days --- ignore what they want, claim that it's "for their safety/security/privacy/whatever", and gradually remove options for configurability. In particular, this sort of "overstepping the boundaries" is unfortunately getting more popular, and IMHO it's rather disturbing that browsers have gone in this direction; software should follow the system defaults/configuration whatever they are. Yes, the platform coud be compromised or otherwise not to your liking. That's not your problem, Mozilla! (I run everything on my network through a filtering proxy. These attempts to subvert it are definitely not welcome.)
  - comex 7y ago
    I disagree. The claim is about a loss of control for "end users" – but it's really a loss of control for network administrators. If I run Firefox on someone else's network and DoH lets me circumvent a filtering proxy, that's handing control away from the network administrator towards me, the end user. Same goes if the network administrator is "just" logging DNS queries, at the cost of my privacy. It so happens that many of the people who post on this site actively administrate at least a home network for which they are also end users. But even in that rarified group, how many people don't connect their computers to untrusted Wi-Fi networks, regularly or at least occasionally? I'd guess it's a pretty low fraction. And among Firefox users in general, the fraction that has meaningful input over the configuration of any network they connect to is surely negligible. (Owning a router doesn't count if you don't know how to configure it.) If you're really an end user, then you'll always have the ability to change Firefox's settings to turn off DoH, or point it at whatever server you want. It's only if you're trying to monitor someone else's connections that you're out of luck.
snek 7y ago
This article got the trr.mode key slightly wrong 0 - Default (will be one of the below options, right now it happens to be 5) 1 - Race regular DNS and DoH, use whichever one responds first 2 - Try DoH, use regular DNS if DoH fails 3 - Use DoH, regular DNS is disabled entirely 4 - unused 5 - DoH is fully disabled, always use regular DNS
- the_pwner224 7y ago
  I recall reading on a Mozilla blog that 0 is 'default'; right now TRR is disabled but eventually it will be enabled by default. If you want to disable it you should explicitly set it to 5, so that a future update does not enable it.
- campuscodi 7y ago
  Should be fixed now. Thanks!
- DavideNL 7y ago
  https://wiki.mozilla.org/Trusted_Recursive_Resolver https://wiki.mozilla.org/Trusted_Recursive_Resolver
cheez 7y ago
Why over HTTPS vs TLS?
- brians 7y ago
  Approximately: because browsers already have good HTTP parsers built in, and that seems safer than trying a new fast binary parser.
  - cheez 7y ago
    Fair enough.
  - mehrdadn 7y ago
    Is performance really such a big concern here? How slowly can one possibly parse binary DNS responses in a native language?
    - jbverschoor 7y ago
      Also, why a complete http stack? Before we know it we need to send JSON packets to the cpu to do some multiplication
- eastdakota 7y ago
  With HTTP/2, if you open a connection to one HTTPS server then you can pipe additional content down over the same connection without having to reestablish. So DoH can be faster for overall page load times than DoT.
- topranks 7y ago
  DoT works on port 853, so it’s easy for ISPs to spot/block it. They can’t do the same for HTTPS.
  - zzzcpan 7y ago
    No, they still can spot and block it. The only way it can be hard to block for an ISP is if DoH used domain fronting style collateral freedom, but that didn't turn out to work in practice as governments found even the largest corporations to be acceptable collateral and just blocked IP ranges of those corporations to pressure them to disallow such thing and of course they all pretty quickly disabled domain fronting. At this point there is no way big tech corporations can get involved in censorship circumvention, but they can and are in censorship both to satisfy all the governments and for their own benefit.
deleted 7y ago
[deleted]
Havoc 7y ago
I'm guessing this is impossible to use with a pi hole?
tus88 7y ago
Could something like pieHole intercept all DNS and send it over a VPN or something, while providing a local DNS cache? Seems unnecessary to wait for all software to support it nativity. Edit: Apparently they already thought of this and it's a feature!
needle0 7y ago
Is there any way to enable DoH by default but exclude certain domains that are managed by a local DNS server? (eg. intranet domains?)
- rmdoss 7y ago
  Not from my experience. That's why I had to disable DoH locally.
- ChuckMcM 7y ago
  Set up your own DoH server that uses your DNS server as a proxy.
- bzbarsky 7y ago
  In Firefox? Yes. Set the "network.trr.excluded-domains" pref in about:config to a comma-separated list of the things you want to exclude.
ignoramous 7y ago
Opera comes with a free VPN (which does collect as much data as it can), and I think, Firefox is primed to move in that direction, as well. Given how they already have a partnership for DoH, they might extend it for Warp, which might be great if they do it in a privacy-oriented way and do right by their users. Esp, as more and more govts censor the Internet and ISPs turn into trackers the need for Firefox to be the thorn in the neck of powers-that-be is ever more important.
- theturtletalks 7y ago
  If Firefox included a built-in VPN, they could increase their market share substantially. As long as they keep privacy a priority, they can give Chrome solid competition.
  - TylerE 7y ago
    People would actually trust a VPN? Seems like the worst kind of false security. It's going to be monetized out the ass, because bandwidth costs money.
    - michaelmrose 7y ago
      I trust a non free vpn
      - adsche 7y ago
        Serious question: why? Is there any kind of transparent auditing going on?
      - akho 7y ago
        Why? They have access to the same data, and a similar incentive to monetize. It will just be an _additional_ profit stream, not the only one. (I trust a vpn to not be my isp or someone at the next table at a coffee place with WiFi. I trust paid vpn providers to provide decent performance. I’m not as worried about data mining)
dimkr1 7y ago
Or, you can use https://github.com/dimkr/nss-tls https://github.com/dimkr/nss-tls - everything that uses gethostbyname(), addrinfo(), etc', including Firefox with network.trr.mode set to DNS, will use DoH
- antpls 7y ago
  Another option that may work, suggested by pmoriarty in another thread : https://github.com/jedisct1/dnscrypt-proxy https://github.com/jedisct1/dnscrypt-proxy which is a DNS proxy server that could locally transform classic DNS to DNS-over-HTTPS by using iptables to redirect DNS traffic to it (https://news.ycombinator.com/item?id=20370741 https://news.ycombinator.com/item?id=20370741)
  - nothrabannosir 7y ago
    I use this and it works great. Especially in combination with https://github.com/jedisct1/bitbar-dnscrypt-proxy-switcher https://github.com/jedisct1/bitbar-dnscrypt-proxy-switcher (and its dependency Bitbar), which gives you a little icon in the taskbar to monitor and manage the dnscrypt settings. (mac os x)
- vorticalbox 7y ago
  Thanks for this link :)
- wtmt 7y ago
  That seems to be Linux-only. There should ideally be GUI applications for every platform that lay people can download, install and run with sane defaults. Cloudflare did that for mobile with the 1.1.1.1 app.
aaossa 7y ago
How can I check if I got the settings right? Is there any web app or command or something?
- setzer22 7y ago
  You could always use a packet sniffer like Wireshark and see if you get any DNS request on port 53 after accessing a website.
- sleavey 7y ago
  Yes there is: https://www.cloudflare.com/ssl/encrypted-sni/ https://www.cloudflare.com/ssl/encrypted-sni/
stevekemp 7y ago
I enabled DNS over HTTPs in the recent past, and was very happy with it. Until I came to test a staging-version of a website and discovered that updating `/etc/hosts` to change the IP of the given name no longer worked. It took me an embarassingly long time to realise I was still visiting the production site.
- ShinTakuya 7y ago
  Using the hosts file to visit a staging environment is a gross practice anyway. Just make the domain configurable in your code and either but the IP directly or make some subdomain (or better yet, separate domain) redirect to it.
  - chousuke 7y ago
    That doesn't always work. There are migration scenarios where you have to use the correct domain to be able to test everything properly.
    - ShinTakuya 7y ago
      I'm not convinced that's the same situation or if what you're describing is necessary in the majority of cases. Using the "correct" domain shouldn't be the norm - it should be an exceptional circumstance. As demonstrated in the above comment, it's easy to accidentally hit the production environment at which point you may be convinced that everything is alright and ship a broken change to production.
      - bpizzi 7y ago
        In theory I agree with your stance. OTOH, in the real world, almost all websites that I've got to migrate are somewhat hardcoded for one domain (I've got this side project were I do websites hosting, good recurring money, little work). Going for /etc/hosts is the only pragmatic choice here.
        7y ago
josteink 7y ago
A heroic, but misguided effort. DNS should be provided by the OS, and not reimplemented in every application running on top of it.
- jbverschoor 7y ago
  While true, the OS will contain less and less functionality. Which is funny because on one hand we want to have less dependencies, and on the other hand we have microservices for everything. Developers going the sysop direction of services Sysops going the developer way of statically linking
  - josteink 7y ago
    > While true, the OS will contain less and less functionality. That’s a bold claim, and I see no data to back it up. If anything, OSes only tend to get bigger with time.
DavideNL 7y ago
I think it's kind of strange that they are planning to enable DOH by default; Your ISP can see all connections/ip addresses you connect to regardless of whether you use your ISP's DNS servers or not. So, in the end by using DOH in Firefox (= Cloudflare's DNS by default) you're just sharing your internet history with yet another third party. This may be beneficial for some people where ISP's mess with DNS resolving, but for many other people it's actually a regression in privacy (especially if you live in a country that has higher privacy standards/laws than the US.)
- DanBC 7y ago
  > This may be beneficial for some people where ISP's mess with DNS resolving This includes most people in the UK.
  - lugg 7y ago
    > This includes most people. Fixed that for you. ISPs are a crapshoot the world over apart from very few countries. Almost all block or mess with torrent sites. Off the back of a trip overseas, the "free wifi" is also a mess with DNS hijacking for no other reason than to feed you a cookie / limit access for essentially no good reason. Breaking that shitshow when chrome eventually follows suit will be a nice change for users.
- ziegeer 7y ago
  An IP address is not always as telling as the DNS name of what you're connecting to. E.g. I may be connecting to a CDN like CloudFlare for content over HTTPS and my ISP will have no idea what I'm doing. But if I used the DNS name that refers to that content it would likely be more obvious in many cases.
  - lugg 7y ago
    AMP, Facebook groups, WordPress.com sites, shared hosting, download sites etc. Thinking this is a step backwards is pretty naive.
  - zimbatm 7y ago
bagswatchesus 7y ago
I wish this could be left to package managers on some systems http://www.chanelguccius.com/handbags/gucci.html http://www.chanelguccius.com/handbags/gucci.html
paulcarroty 7y ago
Very cool feature, but adblocking on system side is tricky. Blocking by hosts possible only with your own personal server.
option_greek 7y ago
Is it supposed to speed up load times ? I assumed it would slow it down but I'm actually noticing a improvement in page load time.
floatingatoll 7y ago
I hesitate to rain on a positive parade, but.. Keep in mind when enabling features ahead of widespread release in software, that obvious and/or non-obvious things are more likely to break when you do so than if you wait until it’s enabled for you. This goes double for users on the Release channel of software rather than the Beta/Nightly/Canary/Whatever channel, since it takes weeks or months to fix problems. I’m not saying “don’t”, but I am saying “be prepared to encounter self-inflicted issues”. The tendency is to blame the issues and the frustration of tracking down their cause on the software developer. Keep notes about what you enable, so you can try disabling it and see if that fixes it. Report bugs you find, and don’t panic if they’re known and/or unsolved.
- o-__-o 7y ago
  such as expecting an application (not OS) based DNS resolver to react to /etc/hosts changes...
  - floatingatoll 7y ago
    Yes. But. That’s very specific and assumes they’ll only ever query one or the other, which might not necessarily be true for *.local and localhost (I haven’t researched or tested).
wst_ 7y ago
Using stable Firefox 67.0.4 64-bit and this is right there on the options page in General/Network settings. Truth to be told, it will set network.trr.mode to 2, which falls back to normal DNS if anything is wrong, but nonetheless it's there.
darkhorn 7y ago
Thanks to DNS over HTTPS now I can access illegal¹ web sites such as Wikipedia. Also enable ESNI in Firefox. ¹ https://en.m.wikipedia.org/wiki/Block_of_Wikipedia_in_Turkey https://en.m.wikipedia.org/wiki/Block_of_Wikipedia_in_Turkey
philo23 7y ago
After that ISP award thing came out it finally convinced me to look into DoH and give it a go. So I ended up setting up a Pi Hole this weekend running a local DoH-to-DNS proxy and then changing the DNS settings on my router to point to the Pi Hole. This also means my hosts file continues to work if I need it, and all* the programs running on my PC are transparently going through DoH without them being any the wiser. The setup was a little bit fiddly to get going, but I'm now super happy with it. As a sidenote, it was interesting to see how effective uBlock Origin already was because I thought the Pi Hole's blacklists weren't working at first! *I imagine I'm not catching every single one of the DNS lookups on my network, but I bet it's now a large percentage of them.
vinay_ys 7y ago
I wonder if it is ever possible to move to a protocol like MinimalLT - https://cr.yp.to/tcpip/minimalt-20131031.pdf https://cr.yp.to/tcpip/minimalt-20131031.pdf and solve the privacy aspects in a fundamental low-level protocol usable for all types of packet transfers.
beezle 7y ago
I understand how DOH can help prevent DNS spoofing, but I really don't understand the privacy claims. Are not outbound connections, http or https, known by the ISP? Or is the assumption that the world is all behind a proxy like cloudfare?
m-p-3 7y ago
I tried to do it on Firefox Mobile (Android) through about:config but it didn't seem to work. Any idea why, without using an app like Intra?

269 points by smacktoward 7y ago

plg 7y ago

My Pi-hole is set up to do encrypted DNS. Advantage: every device on my home network automatically benefits from this.

kodachi 7y ago
I was thinking for a while to do more networking security at home, from basic stuff like a guest's wifi, to white-listing content and ports. How much time did it take you to set up Pi-hole to your liking?
- ahipple 7y ago
  I set it up a couple of months ago as well and as I recall I went from zero to "up and running" in an hour or two — I usually wake up a little earlier than my wife and I'd finished setting it up by the time we were ready to make breakfast. The ArchWiki page (https://wiki.archlinux.org/index.php/Pi-hole https://wiki.archlinux.org/index.php/Pi-hole) was a useful reference for the few snags I encountered.
  - theWheez 7y ago
    I’ll second this. Pi-Hole was very easy to set up and gives me some good peace of mind. Love seeing query trends too.
- plg 7y ago
  Not long at all for the basic setup. For encrypted DNS setup I used this guide which worked: https://scotthelme.co.uk/securing-dns-across-all-of-my-devices-with-pihole-dns-over-https-1-1-1-1/ https://scotthelme.co.uk/securing-dns-across-all-of-my-devic...
- kodachi 7y ago
  Thanks all. Of course the arch wiki is a good place to go. I will definitely give it a try.
- StreamBright 7y ago
  It is pretty simple to set up. You can do it in 1 hour.
noncoml 7y ago
So instead of getting spied, blocked, tampered, etc. by your ISP you are getting spied by Cloudflare? We didn’t solve the problem, just shifted it..
- satokema 7y ago
  What DNS provider is actually trustworthy and how can you prove it?
- greenyoda 7y ago
  My ISP knows my real-world identity: name, address, phone number and credit card information. Cloudflare knows none of these things about me, so there's much less they can do with my browsing information.
  - tinus_hn 7y ago
    Cloudflare has access to many of the sites you browse. They have the SSL keys, they host the services. They (potentially) know a lot more about you than your ISP. If you ever bought something from a web shop hosted on Cloudflare they have access to your billing address, credit card info and what you are buying. They may not collect it but they do have access.
- celsoazevedo 7y ago
  Set up your own server then?
- BlackRing 7y ago
  Who said he was using cloudflare as his upstream DNS? There are far more choices than cloudflare, google, or your ISP.
- snek 7y ago
  Cloudflare has a list of all data they collect from firefox DoH here: https://developers.cloudflare.com/1.1.1.1/commitment-to-privacy/privacy-policy/firefox/ https://developers.cloudflare.com/1.1.1.1/commitment-to-priv...
xjay 7y ago
That is, until software on any of these devices start running their DNS queries through DoH directly, circumventing any DNS filtering at the perimeter. This is what browsers, like Firefox, are likely to do as it stands today.
- StreamBright 7y ago
  Then there can be a browser that does not do that and this is what I will use.
  - andrerm 7y ago
    Until you're minority, the browser don't receives funds enough and dies
- tinus_hn 7y ago
  And then you change the setting from the default to make it do what you want. The sky is not falling.
  - TeMPOraL 7y ago
    Until they take that setting away from you, "because security". Not to mention that where DNS was centrally managed before, now you have to change settings in each and every application that uses DoH to resolve names on the Internet. (And then Google decides to do cert pinning on DoH, and suddenly you can only ever use 8.8.8.8 and 1.1.1.1, and if you want to change it, you need to buy Enterprise version of Chrome.)
    - andrerm 7y ago
      I do think you're right. And I also think that DoH will legitimate MITM because if application developers can break an long standing contract like DNS on OS well... "why can't we"
  - andrerm 7y ago
    Until you can't any more
plg 7y ago
tried this (installing unbound) — seems to work well, easy install https://docs.pi-hole.net/guides/unbound/#setting-up-pi-hole-as-a-recursive-dns-server-solution https://docs.pi-hole.net/guides/unbound/#setting-up-pi-hole-...

krispbyte 7y ago

Why is this supported at the application level instead of the OS? So other tools like ping or nslookup can use it too.

the_angry_angel 7y ago
This is my beef with (my understanding maybe incomplete, in which case I apologise) the implementation. Internal DNS, split brain DNS aren’t catered for without disabling support? I don’t want my internal names leaking to the internet, nor necessarily are they the same for external resolvers. Now yes the latter is a hack, but it’s one widely used still today. The idea is laudable. But it feels hostile. I can disable support, but for how long?
- tssva 7y ago
  Once Firefox starts to ignore DNS resolvers configured at the OS level other apps are sure to look at it and think it must be a good idea because Firefox is doing it. Soon there will be a multitude of applications needing this disabled in their own unique way. If the Mozilla Foundation see this as an issue they should instead be developing a separate solution to provide this system wide. If you must bundle it with Firefox and offer to install it at browser installation or upgrade time. Don't install it by default and certainly don't enable it without user permission.
- krispbyte 7y ago
  I guess it would be possible to run my own local DNS server that connects to these DoH servers. Does any DNS server support DoH? This could also allow the user to override domains using their /etc/hosts file in case DoH on Firefox doesn't support it.
  - uponcoffee 7y ago
    I use pihole + dnscrypt-proxy 2.* A fair number of resolvers support DoH and dnscrypt-proxy also supports DoT. It's fairly feature rich, you can configure a hosts file and then some. [0] https://github.com/jedisct1/dnscrypt-proxy https://github.com/jedisct1/dnscrypt-proxy

monsterbash506 7y ago

DNS over HTTPS is a requirement for ESNI. You should enable that too if you want to stay up to date on the latest privacy features.

redder2 7y ago

TLTR: Question: To what do I set network.trr.bootstrapAddress for https://doh.appliedprivacy.net/query https://doh.appliedprivacy.net/query? I am confused. The guide tell me to set: network.trr.uri But Foundation for Applied Privacy sounds nice and I want to force DNS over HTTPS. The site specifically tells me to use the the Firfeox setting page https://appliedprivacy.net/services/dns/ https://appliedprivacy.net/services/dns/ but that sets network.trr.custom_uri not network.trr.uri so whats the diffrence? And it also tells that I have to set the network.trr.bootstrapAddress but does not tell you to what in case I missed something.

mlrhazi 7y ago

I saw somewhere that this can be enabled in Chrome from chrome://flags/, but I can't seem to find it in mine, v75 on Mac. Was it removed from recent versions?

judge2020 7y ago
A chromium project called Bromite exposes this flag[0], but I don't think it's ever been available on Desktop versions of Chrome (probably due to the likelihood of Schools, Enterprises, etc. getting mad if a user uses it to circumvent DNS blocks). As per a comment by Eric [unknown surname] at Microsoft here[1], you can enable it on desktop chrome by adding the following to your chrome launch options: --enable-features="dns-over-https<DoHTrial" --force-fieldtrials="DoHTrial/Group1" --force-fieldtrial-params="DoHTrial.Group1:server/https%3A%2F%2F1.1.1.1%2Fdns-query/method/POST This can easily be done persistently via Windows, but I'm not sure what it would take on Mac. The official Chromium guide for starting with launch options[2] only recommends opening terminal every time, which would mean it can't be easily ran on each launch with the shortcut/dock icon. 0: https://github.com/bromite/bromite/wiki/Enabling-DNS-over-HTTPS https://github.com/bromite/bromite/wiki/Enabling-DNS-over-HT... 1: https://crbug.com/799753#c8 https://crbug.com/799753#c8 2: https://www.chromium.org/developers/how-tos/run-chromium-with-flags https://www.chromium.org/developers/how-tos/run-chromium-wit...
- mlrhazi 7y ago
  Thank you!

SimeVidas 7y ago

PSA Firefox Nightly is very stable (with occasional breakage on some websites). It has the latest features, including a convenient checkbox for DoH: https://i.imgur.com/NhifLq5.png https://i.imgur.com/NhifLq5.png

blitmap 7y ago
I don't know how I've improved the situation going from Chrome to Firefox and then to Firefox Nightly: I wish Mozilla put efforts toward preserving settings and not reinstalling search providers one has purposefully removed. I understand that by using Nightly I cannot expect what a general user expects, but this problem exists in all browsers. I consider it user-hostile behavior that more emphasis isn't taken to preserve settings. Oh a new update? Clearly you want us to sync everything instead of just the few things you selected. Let's revert it all to defaults. I also understand how settings are stored (the backend format) might change between minor or major versions. Sometimes factory defaults need to be reinstated - but it should be very fucking clear (with a notification) that the user should go review settings that have changed/reverted. And this cannot be a banner that shows every time an update applies. Give the user some transparency. On Chrome when I ask it to preserve my previous session it preserves just that session's browsing history. This history is forgotten if I make a point to close all tabs and end the session. On Firefox I must save all history be to 'restore the current session'. Wish we had more control over this. You can't disable Firefox from checking for updates (I wish this could be left to package managers on some systems). I understand but I don't want to be nagged. You can make Firefox ask you, but it will check nonetheless. Why the fuck would I want "Recommmend features as I browse?" or "Recommend extensions as I browse?" I hate being advertised to. "Warn you about unwanted and uncommon software" - who is making this determination? Who is Firefox talking to about what I download? I wish I could sync settings, open tabs, addresses, history, etc - to an simple archive on close or periodically. No online service to sync against with another account I have to worry about. Sucks that in hotels Firefox determines if there's a captive portal in effect by querying a Mozilla-hosted site (detectportal.firefox.com). Blah.
- the_pwner224 7y ago
  > On Firefox I must save all history be to 'restore the current session'. Wish we had more control over this. What do you mean by that? I have mine set to never remember history, and I often force-kill FF as a way to save a session. When I start it up again it prompts to restore the previous session. > You can't disable Firefox from checking for updates (I wish this could be left to package managers on some systems). Firefox's updater is disabled on Arch Linux and iirc also Ubuntu/Fedora/etc. The 'About' window says that it has been disabled by the system administrator. Presumably this is either an about:config setting (good) or a compile-time flag (sad). > Why the fuck would I want "Recommmend features as I browse?" or "Recommend extensions as I browse?" I hate being advertised to. These aren't ads; you can't pay to have your extension shown to users. Recommending features is done by the browser on your computer; iirc the addons recommendations are also computed locally based on anonymized data (don't quote me on that though). I at least find the feature suggestions to have been helpful. Many normal people won't know about reader mode, and FF on Android also tells you that bookmarking a page will save it for offline use, which I would not have otherwise known. > "Warn you about unwanted and uncommon software" - who is making this determination? Who is Firefox talking to about what I download? Google is used; if a file seems suspicious only then are details sent to google to give the final word. I wish they were more upfront about that. But FF is targeted at normal people, and this does help them not get malware. Advanced users like us can easily disable it. That doesn't excuse the lack of transparency though. > Sucks that in hotels Firefox determines if there's a captive portal in effect by querying a Mozilla-hosted site (detectportal.firefox.com). How else do you propose they do this? And better to have Mozilla host it than someone else. On Android you are forced to use Google's NTP servers, and I have no doubt their captive portal detection is also google-hosted. I'd bet the detection URL is exposed in an about:config flag on FF. > I wish I could sync settings, open tabs, addresses, history, etc - to an simple archive on close or periodically. No online service to sync against with another account I have to worry about. For what its worth, Firefox Sync is e2e encrypted with your password. If you log out of sync on all your devices and forget your password, the synced data is gone forever. To log back in you will have to reset the password, and since none of your devices are logged in (they act as backups for the data), it is gone forever.

johnklos 7y ago

I wonder how long it'll be before Firefox comes with it enabled by default. It seems that they're going to do it regardless of the loss of control implications to end users.

userbinator 7y ago
It seems that they're going to do it regardless of the loss of control implications to end users. That seems to be a common trend these days --- ignore what they want, claim that it's "for their safety/security/privacy/whatever", and gradually remove options for configurability. In particular, this sort of "overstepping the boundaries" is unfortunately getting more popular, and IMHO it's rather disturbing that browsers have gone in this direction; software should follow the system defaults/configuration whatever they are. Yes, the platform coud be compromised or otherwise not to your liking. That's not your problem, Mozilla! (I run everything on my network through a filtering proxy. These attempts to subvert it are definitely not welcome.)
- comex 7y ago
  I disagree. The claim is about a loss of control for "end users" – but it's really a loss of control for network administrators. If I run Firefox on someone else's network and DoH lets me circumvent a filtering proxy, that's handing control away from the network administrator towards me, the end user. Same goes if the network administrator is "just" logging DNS queries, at the cost of my privacy. It so happens that many of the people who post on this site actively administrate at least a home network for which they are also end users. But even in that rarified group, how many people don't connect their computers to untrusted Wi-Fi networks, regularly or at least occasionally? I'd guess it's a pretty low fraction. And among Firefox users in general, the fraction that has meaningful input over the configuration of any network they connect to is surely negligible. (Owning a router doesn't count if you don't know how to configure it.) If you're really an end user, then you'll always have the ability to change Firefox's settings to turn off DoH, or point it at whatever server you want. It's only if you're trying to monitor someone else's connections that you're out of luck.

snek 7y ago

This article got the trr.mode key slightly wrong 0 - Default (will be one of the below options, right now it happens to be 5) 1 - Race regular DNS and DoH, use whichever one responds first 2 - Try DoH, use regular DNS if DoH fails 3 - Use DoH, regular DNS is disabled entirely 4 - unused 5 - DoH is fully disabled, always use regular DNS

the_pwner224 7y ago
I recall reading on a Mozilla blog that 0 is 'default'; right now TRR is disabled but eventually it will be enabled by default. If you want to disable it you should explicitly set it to 5, so that a future update does not enable it.
campuscodi 7y ago
Should be fixed now. Thanks!
DavideNL 7y ago
https://wiki.mozilla.org/Trusted_Recursive_Resolver https://wiki.mozilla.org/Trusted_Recursive_Resolver

cheez 7y ago

Why over HTTPS vs TLS?

brians 7y ago
Approximately: because browsers already have good HTTP parsers built in, and that seems safer than trying a new fast binary parser.
- cheez 7y ago
  Fair enough.
- mehrdadn 7y ago
  Is performance really such a big concern here? How slowly can one possibly parse binary DNS responses in a native language?
  - jbverschoor 7y ago
    Also, why a complete http stack? Before we know it we need to send JSON packets to the cpu to do some multiplication
eastdakota 7y ago
With HTTP/2, if you open a connection to one HTTPS server then you can pipe additional content down over the same connection without having to reestablish. So DoH can be faster for overall page load times than DoT.
topranks 7y ago
DoT works on port 853, so it’s easy for ISPs to spot/block it. They can’t do the same for HTTPS.
- zzzcpan 7y ago
  No, they still can spot and block it. The only way it can be hard to block for an ISP is if DoH used domain fronting style collateral freedom, but that didn't turn out to work in practice as governments found even the largest corporations to be acceptable collateral and just blocked IP ranges of those corporations to pressure them to disallow such thing and of course they all pretty quickly disabled domain fronting. At this point there is no way big tech corporations can get involved in censorship circumvention, but they can and are in censorship both to satisfy all the governments and for their own benefit.

deleted 7y ago

[deleted]

Havoc 7y ago

I'm guessing this is impossible to use with a pi hole?

tus88 7y ago

Could something like pieHole intercept all DNS and send it over a VPN or something, while providing a local DNS cache? Seems unnecessary to wait for all software to support it nativity. Edit: Apparently they already thought of this and it's a feature!

needle0 7y ago

Is there any way to enable DoH by default but exclude certain domains that are managed by a local DNS server? (eg. intranet domains?)

rmdoss 7y ago
Not from my experience. That's why I had to disable DoH locally.
ChuckMcM 7y ago
Set up your own DoH server that uses your DNS server as a proxy.
bzbarsky 7y ago
In Firefox? Yes. Set the "network.trr.excluded-domains" pref in about:config to a comma-separated list of the things you want to exclude.

ignoramous 7y ago

Opera comes with a free VPN (which does collect as much data as it can), and I think, Firefox is primed to move in that direction, as well. Given how they already have a partnership for DoH, they might extend it for Warp, which might be great if they do it in a privacy-oriented way and do right by their users. Esp, as more and more govts censor the Internet and ISPs turn into trackers the need for Firefox to be the thorn in the neck of powers-that-be is ever more important.

theturtletalks 7y ago
If Firefox included a built-in VPN, they could increase their market share substantially. As long as they keep privacy a priority, they can give Chrome solid competition.
- TylerE 7y ago
  People would actually trust a VPN? Seems like the worst kind of false security. It's going to be monetized out the ass, because bandwidth costs money.
  - michaelmrose 7y ago
    I trust a non free vpn
    - adsche 7y ago
      Serious question: why? Is there any kind of transparent auditing going on?
    - akho 7y ago
      Why? They have access to the same data, and a similar incentive to monetize. It will just be an _additional_ profit stream, not the only one. (I trust a vpn to not be my isp or someone at the next table at a coffee place with WiFi. I trust paid vpn providers to provide decent performance. I’m not as worried about data mining)

dimkr1 7y ago

Or, you can use https://github.com/dimkr/nss-tls https://github.com/dimkr/nss-tls - everything that uses gethostbyname(), addrinfo(), etc', including Firefox with network.trr.mode set to DNS, will use DoH

antpls 7y ago
Another option that may work, suggested by pmoriarty in another thread : https://github.com/jedisct1/dnscrypt-proxy https://github.com/jedisct1/dnscrypt-proxy which is a DNS proxy server that could locally transform classic DNS to DNS-over-HTTPS by using iptables to redirect DNS traffic to it (https://news.ycombinator.com/item?id=20370741 https://news.ycombinator.com/item?id=20370741)
- nothrabannosir 7y ago
  I use this and it works great. Especially in combination with https://github.com/jedisct1/bitbar-dnscrypt-proxy-switcher https://github.com/jedisct1/bitbar-dnscrypt-proxy-switcher (and its dependency Bitbar), which gives you a little icon in the taskbar to monitor and manage the dnscrypt settings. (mac os x)
vorticalbox 7y ago
Thanks for this link :)
wtmt 7y ago
That seems to be Linux-only. There should ideally be GUI applications for every platform that lay people can download, install and run with sane defaults. Cloudflare did that for mobile with the 1.1.1.1 app.

aaossa 7y ago

How can I check if I got the settings right? Is there any web app or command or something?

setzer22 7y ago
You could always use a packet sniffer like Wireshark and see if you get any DNS request on port 53 after accessing a website.
sleavey 7y ago
Yes there is: https://www.cloudflare.com/ssl/encrypted-sni/ https://www.cloudflare.com/ssl/encrypted-sni/

stevekemp 7y ago

I enabled DNS over HTTPs in the recent past, and was very happy with it. Until I came to test a staging-version of a website and discovered that updating `/etc/hosts` to change the IP of the given name no longer worked. It took me an embarassingly long time to realise I was still visiting the production site.

ShinTakuya 7y ago
Using the hosts file to visit a staging environment is a gross practice anyway. Just make the domain configurable in your code and either but the IP directly or make some subdomain (or better yet, separate domain) redirect to it.
- chousuke 7y ago
  That doesn't always work. There are migration scenarios where you have to use the correct domain to be able to test everything properly.
  - ShinTakuya 7y ago
    I'm not convinced that's the same situation or if what you're describing is necessary in the majority of cases. Using the "correct" domain shouldn't be the norm - it should be an exceptional circumstance. As demonstrated in the above comment, it's easy to accidentally hit the production environment at which point you may be convinced that everything is alright and ship a broken change to production.
    - bpizzi 7y ago
      In theory I agree with your stance. OTOH, in the real world, almost all websites that I've got to migrate are somewhat hardcoded for one domain (I've got this side project were I do websites hosting, good recurring money, little work). Going for /etc/hosts is the only pragmatic choice here.
      - 7y ago

josteink 7y ago

A heroic, but misguided effort. DNS should be provided by the OS, and not reimplemented in every application running on top of it.

jbverschoor 7y ago
While true, the OS will contain less and less functionality. Which is funny because on one hand we want to have less dependencies, and on the other hand we have microservices for everything. Developers going the sysop direction of services Sysops going the developer way of statically linking
- josteink 7y ago
  > While true, the OS will contain less and less functionality. That’s a bold claim, and I see no data to back it up. If anything, OSes only tend to get bigger with time.

DavideNL 7y ago

I think it's kind of strange that they are planning to enable DOH by default; Your ISP can see all connections/ip addresses you connect to regardless of whether you use your ISP's DNS servers or not. So, in the end by using DOH in Firefox (= Cloudflare's DNS by default) you're just sharing your internet history with yet another third party. This may be beneficial for some people where ISP's mess with DNS resolving, but for many other people it's actually a regression in privacy (especially if you live in a country that has higher privacy standards/laws than the US.)

DanBC 7y ago
> This may be beneficial for some people where ISP's mess with DNS resolving This includes most people in the UK.
- lugg 7y ago
  > This includes most people. Fixed that for you. ISPs are a crapshoot the world over apart from very few countries. Almost all block or mess with torrent sites. Off the back of a trip overseas, the "free wifi" is also a mess with DNS hijacking for no other reason than to feed you a cookie / limit access for essentially no good reason. Breaking that shitshow when chrome eventually follows suit will be a nice change for users.
ziegeer 7y ago
An IP address is not always as telling as the DNS name of what you're connecting to. E.g. I may be connecting to a CDN like CloudFlare for content over HTTPS and my ISP will have no idea what I'm doing. But if I used the DNS name that refers to that content it would likely be more obvious in many cases.
- lugg 7y ago
  AMP, Facebook groups, WordPress.com sites, shared hosting, download sites etc. Thinking this is a step backwards is pretty naive.
- zimbatm 7y ago

bagswatchesus 7y ago

I wish this could be left to package managers on some systems http://www.chanelguccius.com/handbags/gucci.html http://www.chanelguccius.com/handbags/gucci.html

paulcarroty 7y ago

Very cool feature, but adblocking on system side is tricky. Blocking by hosts possible only with your own personal server.

option_greek 7y ago

Is it supposed to speed up load times ? I assumed it would slow it down but I'm actually noticing a improvement in page load time.

floatingatoll 7y ago

I hesitate to rain on a positive parade, but.. Keep in mind when enabling features ahead of widespread release in software, that obvious and/or non-obvious things are more likely to break when you do so than if you wait until it’s enabled for you. This goes double for users on the Release channel of software rather than the Beta/Nightly/Canary/Whatever channel, since it takes weeks or months to fix problems. I’m not saying “don’t”, but I am saying “be prepared to encounter self-inflicted issues”. The tendency is to blame the issues and the frustration of tracking down their cause on the software developer. Keep notes about what you enable, so you can try disabling it and see if that fixes it. Report bugs you find, and don’t panic if they’re known and/or unsolved.

o-__-o 7y ago
such as expecting an application (not OS) based DNS resolver to react to /etc/hosts changes...
- floatingatoll 7y ago
  Yes. But. That’s very specific and assumes they’ll only ever query one or the other, which might not necessarily be true for *.local and localhost (I haven’t researched or tested).

wst_ 7y ago

Using stable Firefox 67.0.4 64-bit and this is right there on the options page in General/Network settings. Truth to be told, it will set network.trr.mode to 2, which falls back to normal DNS if anything is wrong, but nonetheless it's there.

darkhorn 7y ago

Thanks to DNS over HTTPS now I can access illegal¹ web sites such as Wikipedia. Also enable ESNI in Firefox. ¹ https://en.m.wikipedia.org/wiki/Block_of_Wikipedia_in_Turkey https://en.m.wikipedia.org/wiki/Block_of_Wikipedia_in_Turkey

philo23 7y ago

After that ISP award thing came out it finally convinced me to look into DoH and give it a go. So I ended up setting up a Pi Hole this weekend running a local DoH-to-DNS proxy and then changing the DNS settings on my router to point to the Pi Hole. This also means my hosts file continues to work if I need it, and all* the programs running on my PC are transparently going through DoH without them being any the wiser. The setup was a little bit fiddly to get going, but I'm now super happy with it. As a sidenote, it was interesting to see how effective uBlock Origin already was because I thought the Pi Hole's blacklists weren't working at first! *I imagine I'm not catching every single one of the DNS lookups on my network, but I bet it's now a large percentage of them.

vinay_ys 7y ago

I wonder if it is ever possible to move to a protocol like MinimalLT - https://cr.yp.to/tcpip/minimalt-20131031.pdf https://cr.yp.to/tcpip/minimalt-20131031.pdf and solve the privacy aspects in a fundamental low-level protocol usable for all types of packet transfers.

beezle 7y ago

I understand how DOH can help prevent DNS spoofing, but I really don't understand the privacy claims. Are not outbound connections, http or https, known by the ISP? Or is the assumption that the world is all behind a proxy like cloudfare?

m-p-3 7y ago

I tried to do it on Firefox Mobile (Android) through about:config but it didn't seem to work. Any idea why, without using an app like Intra?