16 ms·

What’s Next in Making Encrypted DNS-over-HTTPS the Default

139 points by bzbarsky 7y ago

JeanMarcS 7y ago
So what will be « safer » ? Using a pi-hole or equivalent, or using this ? IIRC all DoH requests are sent to Cloudflare. Is there a way to host your own DNS server and use it with DoH instead ?
- milofeynman 7y ago
  They are not mutually exclusive. Pi-hole supports dns-over-https. My concern with this technology is my port 53 masquerade rule on my router will no longer grab all dns requests when this becomes common practice. I imagine there will be a solution but I'm not sure what it is.
  - mtsr 7y ago
    I don't really see a solution without installing root CA's to MitM HTTPS traffic. I too would be interested in solutions for this.
- pletnes 7y ago
  AFAIK a pi-hole can use dns-over-https if configured correctly so there’s no either/or.
- jlgaddis 7y ago
  Yeah, you can re-configure Pi-Hole to use DoH (with your preferred servers). unbound can be configured to use DoH as well.
  - mtsr 7y ago
    For forwarding yes, but not for recursive resolution.
  - mike-cardwell 7y ago
    For unbound, I just dropped this in my /etc/unbound/unbound.conf.d/02-block-doh.conf local-zone: "use-application-dns.net" static
    - mtsr 7y ago
      Exactly what I did.
- iforgotpassword 7y ago
  For now I'm blocking traffic to Google's and cloudflare's DNS and plan on also following the advice about that special domain from https://support.mozilla.org/en-US/kb/configuring-networks-disable-dns-over-https https://support.mozilla.org/en-US/kb/configuring-networks-di... that someone posted here.
papaf 7y ago
At first, I was sceptical of DNS over HTTPS and thought that it gave Cloudflare, who already control too much access over the internet, even more control. However, other DNS providers are available. For instance Google[1] and Quad 9 [2] both provide free DNS over HTTPS services. [1] https://developers.google.com/speed/public-dns/docs/doh/ https://developers.google.com/speed/public-dns/docs/doh/ [2] https://www.quad9.net/doh-quad9-dns-servers/ https://www.quad9.net/doh-quad9-dns-servers/
- auslander 7y ago
  > For instance Google[1] and Quad 9 [2] both provide free DNS over HTTPS services. Using Google is giving your browsing history to an Ad company, why? At least Quad9 is non-profit. It also provides DNS over TLS, DoT service, which I'm using.
  - shpx 7y ago
    Because with Google you only have to trust one organization that flat out says in the FAQ that they do not "correlate or combine information from temporary or permanent logs with any personal information that [you] have provided Google for other services". Quad9 is a conglomorate of "Threat Intelligence Partners" and three founding organizations: IBM, Packet Clearing House and Global Cyber Alliance https://www.quad9.net/about/ https://www.quad9.net/about/ . What's that third one? I don't know, but it's founded by The City of London Police, NY District Attorney and the Center for Internet Security https://www.globalcyberalliance.org/who-we-are/ https://www.globalcyberalliance.org/who-we-are/ that third one is like a hundred "Partners", with such privacy champions as The US Secret Service. Over 100 organizations. What are their incentives? What role do all these organization play and how much access do they have? Who knows. Compare their privacy policies. They're strikingly similar because Quad9 largely lifted theirs from Google's (I'm assuming, since theirs came later) https://developers.google.com/speed/public-dns/privacy https://developers.google.com/speed/public-dns/privacy https://www.quad9.net/policy/ https://www.quad9.net/policy/ Google's policy states they collect private information for 24-48 hours, keep "anonymized" information for 2 weeks and then randomly samples that data for permanent storage: > Google Public DNS stores two sets of logs: temporary and permanent. The temporary logs store the full IP address of the machine you're using. We have to do this so that we can spot potentially bad things like DDoS attacks and so we can fix problems, such as particular domains not showing up for specific users. > We delete these temporary logs within 24 to 48 hours. > In the permanent logs, we don't keep personally identifiable information or IP information. We do keep some location information (at the city/metro level) so that we can conduct debugging, analyze abuse phenomena. After keeping this data for two weeks, we randomly sample a small subset for permanent storage. Quad9 collects effectively the same information (except AS) as Google's 2 week logs and says > All the above data may be kept in full or partial form in permanent archives. If you want a game theoretic, capitalist analysis, Google has an incentive to keep the web running and keeping it an awesome platform, to make sure humanity's information is created and shared in an open format that they know how to index and that they can freely index, instead of apps or some alternative web or some other walled garden. But we're bombarded daily with "goog bad" by politicians and journalists, so Google must obviously be just brazenly lying and you should give your DNS history to an organization founded by The City of London Police instead that "share anonymized data on specific domains queried [...] with its threat intelligence partners". Please double check my work, I didn't read the privacy policies too carefully (I think notably Google stores the AS number and Quad9 doesn't) because I don't actually care, I (along with roughly 100% of internet users) just give all my DNS history in plain text to my ISP.
jlgaddis 7y ago
I didn't see it mentioned in the article. Has Mozilla said whose servers they will be sending unsuspecting users queries to by default? (IIRC, it was Cloudflare previously. Any reason to believe this has changed?) --- If, like me, you already have a solution in place you are happy with and don't like the idea of others (deciding they know what's best for you and) circumventing it, simply ensure that your existing resolvers are configured as described in [0]: > Network administrators may configure their networks as follows to signal that their local DNS resolver implemented special features that make the network unsuitable for DoH: > DNS queries for the A and AAAA records for the domain “use-application-dns.net” must respond with NXDOMAIN rather than the IP address retrieved from the authoritative nameserver. [0]: https://support.mozilla.org/en-US/kb/configuring-networks-disable-dns-over-https https://support.mozilla.org/en-US/kb/configuring-networks-di...
- josteink 7y ago
  If true that DoH can be disabled at network level, ad-blocking solutions like pihole should probably implement it by default. Anyone have any idea if this is the case? That would at least save me a lot of trouble and work.
  - Dylan16807 7y ago
    Pihole is great because it can do all your non-browser activity. But for a browser, an ad-blocking extension works better and is less than a minute to set up. Why force it to use the same DNS blocking?
    - josteink 7y ago
      Most mobile-browsers don’t support ad-blocking, especially on iOS.
      - Dylan16807 7y ago
        They're not threatening to use DNS-over-HTTPS either. But didn't iOS get browser adblocking capability in the last couple years?
nicolaslem 7y ago
The article is not clear about one issue: are all applications expected to disregard the OS DNS? Is there an option to tell all applications that they should not bypass it? I will be pretty pissed if I wake up one day and find that Firefox decided to stop using my DNS server and instead started sending my requests to a third-party.
- jlgaddis 7y ago
  That's exactly what their plan is -- and if you have experiments enabled, they may have already started sending your DNS queries to Cloudflare.
  - z3t4 7y ago
    I guess thats Mozillas new monetizing strategy, sell user data to cloudflare, and market it as privacy. If you want privacy you better firewall everything your computer want to send to Cloudflare, Akamai, et.al.
    - tinus_hn 7y ago
      Good luck with blocking Cloudflare and Akamai and still using the internet.
      - throw0101a 7y ago
        Which is why some people, like Paul Vixie (no DNS dummy, he), think that this is an absolutely terrible idea. Mozilla is now basically dictating policy to organizations.
      - badrabbit 7y ago
        It's not that bad. Done it before. It's as if some sites are more like other paywalled sites.maybe noscript trained me well for it.
    - wipseabusbus 7y ago
      >...sell user data to cloudflare... Cloudflare claims they "will never sell your data or use it to target ads." You can read their 1.1.1.1 privacy policies here: https://developers.cloudflare.com/1.1.1.1/commitment-to-privacy/ https://developers.cloudflare.com/1.1.1.1/commitment-to-priv... https://developers.cloudflare.com/1.1.1.1/commitment-to-privacy/privacy-policy/privacy-policy/ https://developers.cloudflare.com/1.1.1.1/commitment-to-priv...
techntoke 7y ago
At what point can I expect Mozilla to start proxying my web requests as well?
- andrerm 7y ago
  Mozilla I don't know but Google is already doing it with AMP
euph0ria 7y ago
What is the latency for DoH compared to traditional UDP DNS?
- Santosh83 7y ago
  I have DoH enabled (Cloudflare) and I can't visibly notice any latency compared to normal DNS (which was also Cloudflare). I haven't timed the requests though...
- nullify88 7y ago
  Here's a whitepaper that did some benchmarks and a detailed analysis on it. Was posted on hn a few days ago. https://arxiv.org/abs/1907.08089 https://arxiv.org/abs/1907.08089 They test various network conditions with some results showing DoH and DoT loading webpages faster than udp dns (due to tcp timing out faster than udp on lossy connections )
  - euph0ria 7y ago
    Thanks!
auslander 7y ago
I wish Mozilla had Firefox version free from all integrations with 3rd parties.
- floatboth 7y ago
  Just build it from source with no API keys. (Though DoH is not an "integration" in that sense.)
Jonnax 7y ago
There's a lot of negativity here. But this is a win overall for privacy. DNS is used by ISPs to sell user's data and is one way that oppressive regimes track what their users do. If you're technical enough to understand DNS then you are smart enough to change what the default is. If you're a system administrator for a company. You should be able to push a profile down to the user's computer to configure DNS how you want.
- TheChaplain 7y ago
  Well, DoH effectively bypass DNS-filters set up by countries. While some are questionable, I believe it won't take long until Mozilla ends up with some bad press, and being an underdog it doesn't need that.
  - indalo 7y ago
    To me that is good press, and it's something I personally would like. Seeing a state and/or adjunct corporations throwing a tantrum over this is only a measure of success. After all privacy is the goal, isn't it?
  - mtgx 7y ago
    In other words, Mozilla shouldn't do something good for its users because it could bring bad press.
- zajio1am 7y ago
  Not if one trusts more his/her ISP more than Cloudflare. At least, an ISP is a contractual partner and under the same jurisdiction, in Europe including GDPR.
  - floatboth 7y ago
    Being in the same jurisdiction is bad: your ISP is THE place for your local law enforcement to get info on your browsing.
    - 7y ago
edjw 7y ago
Unfortunately, Mozilla are planning to leave DoH off by default for Firefox users in the UK. Almost certainly to avoid criticism from politicians and children’s charities about how DoH would interfere with the UK’s network level website blocking of ‘adult’ websites.
- choeger 7y ago
  Hrhr. But talk about how it intends to prevent censorship...
andreareina 7y ago
> Fall back to operating system defaults for DNS when split horizon configuration or other DNS issues cause lookup failures. I hope we'll be given the opportunity to disable this, or at the very least show a warning (similar to cert warnings?) that something's off.
- the8472 7y ago
  the network.trr.mode setting provides fine control https://wiki.mozilla.org/Trusted_Recursive_Resolver https://wiki.mozilla.org/Trusted_Recursive_Resolver
elcomet 7y ago
Why don't they rather include a resolver in Firefox ? This way, no privacy problems, you're directly contacting authoritarive servers. And you don't rely on a single dns-over-https provider. Is the latency a big problem there? I would say that with caching it is not too bad.
- deleted 7y ago
  [deleted]
- EvanAnderson 7y ago
  A local resolver using root hints and DNS-over-TLS would be a win for privacy and, at the same time, would not promote centralization of the Internet to DNS-over-HTTPS providers. It still suffers from the problem of overriding local network policy but it's better than just handing all the queries over to a single DoH provider.
  - StavrosK 7y ago
    How is DoT different from DoH? Do you have an issue with the format on the wire? Because otherwise you can use whichever resolver you want in either case.
    - EvanAnderson 7y ago
      I'm on mobile so rather than restate I'll just refer to a comment w/ a good link from an earlier discussion: https://news.ycombinator.com/item?id=19624136 https://news.ycombinator.com/item?id=19624136
- hannob 7y ago
  1. The connection to the authoritative servers isn't encrypted, so the whole point of DoH is undermined. 2. There's plenty of networks that don't let arbitrary DNS traffic out, so this doesn't work without another fallbacks. Fallbacks for security features are bad. I see that there are legit controversies around DoH. But these "Why don't you just do X?" comments aren't helpful. Try to understand the problem they're trying to resolve.
Jonahgay 7y ago
i think DNS over https is stupid, because ISP already knows where your data is going/coming.
pmontra 7y ago
DoH bypasses the OS and the /etc/hosts file. This breaks some workflows.
- Jonnax 7y ago
  Oh no. Maybe you can configure this? https://support.mozilla.org/en-US/kb/customizing-firefox-using-policiesjson https://support.mozilla.org/en-US/kb/customizing-firefox-usi... Or perhaps use their canary domain to force Firefox to use local DNS? Or just configure it yourself? It's not security if an application can still access the internet. Why not block all internet access except via a proxy server? Which is what a "real" enterprise would do because they can block what they want and have a secure network.
lota-putty 7y ago
We're getting an option to bypass TSP's DNS to a 3rd party over secure connection; be it DoH or DoT. TSPs can easily map your usage behaviour to your identity while 3rd party DNS provider will have your behaviour alone. Albeit, TSP will still have IPs you've accessed for data transfer. TSPs that honour their customers' privacy will allow 3rd party DoH/DoT, esp DoT(ie port:853). TSP: Telecom service provider
EvanAnderson 7y ago
Can somebody point me to the place in the Firefox code where the "use-application-dns.net" canary domain is actually checked? I've tried searching the mozilla-central Mercurial repository and I'm not finding it. I'm clearly inept here. I'm looking at what my Windows DNS servers return when I put in an empty zone for "use-application-dns.net" and I'd like to see exactly what Firefox is testing for. Windows 2012 R2, at least, returns the SOA and no NXDOMAIN for an "A" query to "use-application-dns.net" with an empty zone. If they're explicitly looking for NXDOMAIN then blocking DOH behavior with Windows DNS servers probably isn't going to work. >sigh<
- bzbarsky 7y ago
  The canary is not implemented yet, as far as I can tell.
antpls 7y ago
I tried forced-mode DoH in Firefox 68 and 69, on Debian 9 and 10. In all cases, it worked for a while then stopped to work after a few hours (at random it seems). The only way for me to make it work again was to disable DoH. I guess a more long term solution is to have a local proxy dns-to-doh, but we are falling back in the solution that only a technical user can setup : https://developers.cloudflare.com/1.1.1.1/dns-over-https/cloudflared-proxy/ https://developers.cloudflare.com/1.1.1.1/dns-over-https/clo... https://facebookexperimental.github.io/doh-proxy/ https://facebookexperimental.github.io/doh-proxy/ And it means setting up firewall routing and filters, as some softwares don't have settings to add DNS proxy, or even bypass them (Google Chrome for example)
tannhaeuser 7y ago
Same story as always with Google "innovations": "hey, we're preventing DNS queries to go to your ISP who is selling it" (to go to our service instead so we can profit from it). It's scary that Moz sides with monopolies like Google and Cloudflare on this one.
- LUmBULtERA 7y ago
  In my Firefox settings I can choose any DoH provider I want, not just Cloudflare. Naturally something has to be set up as a default so it works. Why is adding DoH in the browser a bad thing?
  - josteink 7y ago
    Because if we’re replacing classic DNS with something new, it needs to be part of the OS. Not reimplemented (and configured) per application. The user and OS should control the application, not the other way around.
    - Faark 7y ago
      Is any OS vendor working on something like that? Or do you expect Moz to jump into OS dev as well? I'd expect them to import settings from OS as soon as a major OS provides this for DoH.
  - tannhaeuser 7y ago
    The DNS has grown into a regulated service, with TLD authorities and protocols to follow for registrators, transparency for domain holders, many registrators to choose, etc. Do you want to replace it by a centralized system run by very few monopolies that track resolution queries by IP?
- jedisct1 7y ago
  At the end, you still need to trust the resolver. There is a proposal to improve this. Resolves won't know client IPs any more: https://github.com/DNSCrypt/dnscrypt-protocol/blob/master/ANONYMIZED-DNSCRYPT.txt https://github.com/DNSCrypt/dnscrypt-protocol/blob/master/AN... Reference client and server implementations should be ready in the next few days.
redder2 7y ago
Its great what Mozilla is doing but I would like them to push for this to be made system wide and provide the tools to set it up rather then doing it in the Browser only, and I say that as a lifetime Firefox user. In systemd there is currently only DNS over TLS and there is a security issue open about that. Also not sure if there forced setting has made it into stable. What I want to do it just a easy setting to set up up on my Linux (And windows gaming partition) and never think about it again. And for those concerned about selling data to Google or CF, just use some of the privacy organizations servers for it!
throawayeu45556 7y ago
I am wondering, does DNS-over-HTTPS really helps since the way I understand it, after the domain name is resolved to an IP address, the client contacts the IP address so the ISP could still know the website visited especially since many if not most websites have dedicated IP addresses. So ISP could simply crawl the web and map domain names to IP addresses. Is there anything in DoH mitigating this? Or maybe is this attack vector negligible in practice because most servers typically host multiple websites? At least this adds plausible deniability in a wide range of situations I guess. But is it really true? And for example, would it really help in a country where a website like Facebook is censored? (Since their IP addresses are dedicated).
- guiambros 7y ago
  DoH definitely doesn't mitigate against your upstream provider doing traffic inspection and siphoning the IPs your network is connecting to. Ultimately, they have to route your IP packets, so they'll always have that visibility. But this 1) adds a technical hurdle, 2) reduces accuracy of the data captured, and 3) adds a potential legal barrier, as the data is not theirs anymore (before ISPs could claim that the use of their DNS gave them right to use the data collected)
- zzzcpan 7y ago
  Yes, ISPs can know IP addresses and map domains to IP addresses, they can also know exact SNI names, all kinds of passive TCP-level information about your communications, can do active probing for all kinds of information on behalf of you, can use all that together to build a much more detailed profile of you, than available through DNS queries. There is an entire industry of commercial DPI solutions to do that. On top of that ISPs can always block DoH and force fallback to their own DNS servers. So, a minimum amount of privacy can only be achieved with a VPN (or a proxy), not DoH, DoH just leaks to and centralizes data on third parties, violating privacy, making it easier for state actors to spy on people, things like that, it might even give governments capabilities to do world wide censorship if all major browsers implement it. Mozilla, Cloudflare and everyone else involved are being very dishonest when it comes to DoH.
  - 7y ago
tinus_hn 7y ago
Can you run this service yourself easily?
jamescun 7y ago
I'd personally prefer to be greeted with a screen providing me with the option of multiple DNS-over-HTTPS providers, and the option of not using one at all, than being silently forced into handing CloudFlare even more of my data.
- josteink 7y ago
  How about to save time, we could have this choice only once, and that would apply to every application on the machine. Say it could even be handled by the OS itself! And to save users even more time, not having to configure this per machine, we could have such assignment be an automatic part of the network infrastructure... We could call it DHCP and DNS! How about it?
  - testis321 7y ago
    And DNSSEC all the way to the user!
    - tptacek 7y ago
      I'd be pretty pissed if my network connection opted me into a DNSSEC-verifying resolver, since that is pretty much pure downside for users.
      - josteink 7y ago
        As someone not very knowledgable about DNSSEC, can you expand on this point? To the uninformed that sounds very counterintuitive.
        wolf550e 7y ago
        His blog post: https://sockpuppet.org/blog/2015/01/15/against-dnssec/ https://sockpuppet.org/blog/2015/01/15/against-dnssec/
        tptacek 7y ago
        Apart from the blog post, if you don't know anything about DNSSEC, I think the things you want to know are: 1. Almost nobody --- major tech companies, banks, privacy and security organizations --- uses it. It's decades old, and its adoption, at least in North America and in industry, is zero. There are lots of reasons, but you don't have to care right now. 2. Since almost nothing uses it, there's no real upside to enabling it. But there is a downside! If DNSSEC is misconfigured --- which is easy to do, and it won't get noticed quickly (see: point 1) --- then sites in the DNSSEC-signed zone silently drop off the Internet, as if they never existed. That happened, for instance, to HBO when they launched HBO NOW: nobody on Comcast could see it, because it turned out they'd screwed up DNSSEC, and Comcast had DNSSEC-verifying resolvers.
TazeTSchnitzel 7y ago
I wonder if this will break TP-Link's tplinklogin.net and tplinkrepeater.net for logging into their routers/repeaters? At least the latter is supposed to be intercepted by the device, and if it isn't, you get a message saying things are misconfigured.
- xg15 7y ago
  Seems to me they should be able to keep this sort of working by resolving tplinklogin.net to 192.168.0.1 or such on their public DNS and ensuring the router always serves the web page from that IP. Of course things will break down if a router is ever configured to use a different IP - but then again, the public DNS with local IP might trigger Firefox' heuristics and cause it to fall back to traditional DNS - so thinks may still work. But the whole concept of using an on-device web page as config UI seems to become problematic, thanks to HTTPS-everywhere, as there appears to be no way to serve HTTPS from a local, unsupervised device that is frictionless and does not open a security vulnerability.
xg15 7y ago
What I still don't see addressed is the question how this will affect non-browser applications. It's nice that Firefox (currently) still offers options to turn off DoH and to keep using local domains. (although the way DoH and HTTPS-everywhere are structured show that non-internet sites don't seem to have much of a place in the web of the future) However, now that we have public DoH endpoints available for everyone to query, what will keep non-browser apps and devices from using DoH without any way to opt-out? Currently, tracking DNS requests seems to be a common way for security and privacy researchers to get some basic information what an app or device is doing on the internet. If DoH is widely deployed, all you'll probably be seeing is encrypted connections to IPs of shared hosters. This seems like a perfect opportunity for apps and devices to cloak data tracking and other illegitimate requests.
- zamadatix 7y ago
  The same thing that stopped it before DoH was standardized: nothing. There are ways to make FW rules based on trusted DNS lookups (i.e. you can only do traditional DNS to a trusted DNS server with domain filtering and you can only connect to an IP if a DNS lookup has been performed) but this is extremely hard to maintain in any sort of foolproof way. The truth is if you allow outbound connectivity then there all the sender needs to do is add 1 more level of obfuscation than you secure against.
exabrial 7y ago
Could we have srv records as the default to alleviate/eliminate the ipv4 crisis?
andrerm 7y ago
Android + Chrome + DoH + AMP = ? Edit: typo
Avamander 7y ago
ISPs, OSs and Routers should effort at providing secure resolving themselves before every app out there thinks it knows better what DNS to use.
darkhorn 7y ago
Big thanks to Mozilla for making internet a more secure place.
badrabbit 7y ago
Why would Mozilla hurt Firefox's market share in such an obvioud and drastic way? Do they not have anyone at their meetings that brings up obvious and uncomfortable risks? I use DoH on Firefox and love it but man, I myself would block Firefox in a corporate network I help oversee if this is the default. Matter of fact, web proxies already list DoH resolvers as anonymizing sites. Even if this involves some profit with cloudflare,this is strategically terrible for long term goals.

139 points by bzbarsky 7y ago

So what will be « safer » ? Using a pi-hole or equivalent, or using this ? IIRC all DoH requests are sent to Cloudflare. Is there a way to host your own DNS server and use it with DoH instead ?

milofeynman 7y ago
They are not mutually exclusive. Pi-hole supports dns-over-https. My concern with this technology is my port 53 masquerade rule on my router will no longer grab all dns requests when this becomes common practice. I imagine there will be a solution but I'm not sure what it is.
- mtsr 7y ago
  I don't really see a solution without installing root CA's to MitM HTTPS traffic. I too would be interested in solutions for this.
pletnes 7y ago
AFAIK a pi-hole can use dns-over-https if configured correctly so there’s no either/or.
jlgaddis 7y ago
Yeah, you can re-configure Pi-Hole to use DoH (with your preferred servers). unbound can be configured to use DoH as well.
- mtsr 7y ago
  For forwarding yes, but not for recursive resolution.
- mike-cardwell 7y ago
  For unbound, I just dropped this in my /etc/unbound/unbound.conf.d/02-block-doh.conf local-zone: "use-application-dns.net" static
  - mtsr 7y ago
    Exactly what I did.
iforgotpassword 7y ago
For now I'm blocking traffic to Google's and cloudflare's DNS and plan on also following the advice about that special domain from https://support.mozilla.org/en-US/kb/configuring-networks-disable-dns-over-https https://support.mozilla.org/en-US/kb/configuring-networks-di... that someone posted here.

papaf 7y ago

At first, I was sceptical of DNS over HTTPS and thought that it gave Cloudflare, who already control too much access over the internet, even more control. However, other DNS providers are available. For instance Google[1] and Quad 9 [2] both provide free DNS over HTTPS services. [1] https://developers.google.com/speed/public-dns/docs/doh/ https://developers.google.com/speed/public-dns/docs/doh/ [2] https://www.quad9.net/doh-quad9-dns-servers/ https://www.quad9.net/doh-quad9-dns-servers/

auslander 7y ago
> For instance Google[1] and Quad 9 [2] both provide free DNS over HTTPS services. Using Google is giving your browsing history to an Ad company, why? At least Quad9 is non-profit. It also provides DNS over TLS, DoT service, which I'm using.
- shpx 7y ago
  Because with Google you only have to trust one organization that flat out says in the FAQ that they do not "correlate or combine information from temporary or permanent logs with any personal information that [you] have provided Google for other services". Quad9 is a conglomorate of "Threat Intelligence Partners" and three founding organizations: IBM, Packet Clearing House and Global Cyber Alliance https://www.quad9.net/about/ https://www.quad9.net/about/ . What's that third one? I don't know, but it's founded by The City of London Police, NY District Attorney and the Center for Internet Security https://www.globalcyberalliance.org/who-we-are/ https://www.globalcyberalliance.org/who-we-are/ that third one is like a hundred "Partners", with such privacy champions as The US Secret Service. Over 100 organizations. What are their incentives? What role do all these organization play and how much access do they have? Who knows. Compare their privacy policies. They're strikingly similar because Quad9 largely lifted theirs from Google's (I'm assuming, since theirs came later) https://developers.google.com/speed/public-dns/privacy https://developers.google.com/speed/public-dns/privacy https://www.quad9.net/policy/ https://www.quad9.net/policy/ Google's policy states they collect private information for 24-48 hours, keep "anonymized" information for 2 weeks and then randomly samples that data for permanent storage: > Google Public DNS stores two sets of logs: temporary and permanent. The temporary logs store the full IP address of the machine you're using. We have to do this so that we can spot potentially bad things like DDoS attacks and so we can fix problems, such as particular domains not showing up for specific users. > We delete these temporary logs within 24 to 48 hours. > In the permanent logs, we don't keep personally identifiable information or IP information. We do keep some location information (at the city/metro level) so that we can conduct debugging, analyze abuse phenomena. After keeping this data for two weeks, we randomly sample a small subset for permanent storage. Quad9 collects effectively the same information (except AS) as Google's 2 week logs and says > All the above data may be kept in full or partial form in permanent archives. If you want a game theoretic, capitalist analysis, Google has an incentive to keep the web running and keeping it an awesome platform, to make sure humanity's information is created and shared in an open format that they know how to index and that they can freely index, instead of apps or some alternative web or some other walled garden. But we're bombarded daily with "goog bad" by politicians and journalists, so Google must obviously be just brazenly lying and you should give your DNS history to an organization founded by The City of London Police instead that "share anonymized data on specific domains queried [...] with its threat intelligence partners". Please double check my work, I didn't read the privacy policies too carefully (I think notably Google stores the AS number and Quad9 doesn't) because I don't actually care, I (along with roughly 100% of internet users) just give all my DNS history in plain text to my ISP.

jlgaddis 7y ago

I didn't see it mentioned in the article. Has Mozilla said whose servers they will be sending unsuspecting users queries to by default? (IIRC, it was Cloudflare previously. Any reason to believe this has changed?) --- If, like me, you already have a solution in place you are happy with and don't like the idea of others (deciding they know what's best for you and) circumventing it, simply ensure that your existing resolvers are configured as described in [0]: > Network administrators may configure their networks as follows to signal that their local DNS resolver implemented special features that make the network unsuitable for DoH: > DNS queries for the A and AAAA records for the domain “use-application-dns.net” must respond with NXDOMAIN rather than the IP address retrieved from the authoritative nameserver. [0]: https://support.mozilla.org/en-US/kb/configuring-networks-disable-dns-over-https https://support.mozilla.org/en-US/kb/configuring-networks-di...

josteink 7y ago
If true that DoH can be disabled at network level, ad-blocking solutions like pihole should probably implement it by default. Anyone have any idea if this is the case? That would at least save me a lot of trouble and work.
- Dylan16807 7y ago
  Pihole is great because it can do all your non-browser activity. But for a browser, an ad-blocking extension works better and is less than a minute to set up. Why force it to use the same DNS blocking?
  - josteink 7y ago
    Most mobile-browsers don’t support ad-blocking, especially on iOS.
    - Dylan16807 7y ago
      They're not threatening to use DNS-over-HTTPS either. But didn't iOS get browser adblocking capability in the last couple years?

nicolaslem 7y ago

The article is not clear about one issue: are all applications expected to disregard the OS DNS? Is there an option to tell all applications that they should not bypass it? I will be pretty pissed if I wake up one day and find that Firefox decided to stop using my DNS server and instead started sending my requests to a third-party.

jlgaddis 7y ago
That's exactly what their plan is -- and if you have experiments enabled, they may have already started sending your DNS queries to Cloudflare.
- z3t4 7y ago
  I guess thats Mozillas new monetizing strategy, sell user data to cloudflare, and market it as privacy. If you want privacy you better firewall everything your computer want to send to Cloudflare, Akamai, et.al.
  - tinus_hn 7y ago
    Good luck with blocking Cloudflare and Akamai and still using the internet.
    - throw0101a 7y ago
      Which is why some people, like Paul Vixie (no DNS dummy, he), think that this is an absolutely terrible idea. Mozilla is now basically dictating policy to organizations.
    - badrabbit 7y ago
      It's not that bad. Done it before. It's as if some sites are more like other paywalled sites.maybe noscript trained me well for it.
  - wipseabusbus 7y ago
    >...sell user data to cloudflare... Cloudflare claims they "will never sell your data or use it to target ads." You can read their 1.1.1.1 privacy policies here: https://developers.cloudflare.com/1.1.1.1/commitment-to-privacy/ https://developers.cloudflare.com/1.1.1.1/commitment-to-priv... https://developers.cloudflare.com/1.1.1.1/commitment-to-privacy/privacy-policy/privacy-policy/ https://developers.cloudflare.com/1.1.1.1/commitment-to-priv...

techntoke 7y ago

At what point can I expect Mozilla to start proxying my web requests as well?

andrerm 7y ago
Mozilla I don't know but Google is already doing it with AMP

euph0ria 7y ago

What is the latency for DoH compared to traditional UDP DNS?

Santosh83 7y ago
I have DoH enabled (Cloudflare) and I can't visibly notice any latency compared to normal DNS (which was also Cloudflare). I haven't timed the requests though...
nullify88 7y ago
Here's a whitepaper that did some benchmarks and a detailed analysis on it. Was posted on hn a few days ago. https://arxiv.org/abs/1907.08089 https://arxiv.org/abs/1907.08089 They test various network conditions with some results showing DoH and DoT loading webpages faster than udp dns (due to tcp timing out faster than udp on lossy connections )
- euph0ria 7y ago
  Thanks!

auslander 7y ago

I wish Mozilla had Firefox version free from all integrations with 3rd parties.

floatboth 7y ago
Just build it from source with no API keys. (Though DoH is not an "integration" in that sense.)

Jonnax 7y ago

There's a lot of negativity here. But this is a win overall for privacy. DNS is used by ISPs to sell user's data and is one way that oppressive regimes track what their users do. If you're technical enough to understand DNS then you are smart enough to change what the default is. If you're a system administrator for a company. You should be able to push a profile down to the user's computer to configure DNS how you want.

TheChaplain 7y ago
Well, DoH effectively bypass DNS-filters set up by countries. While some are questionable, I believe it won't take long until Mozilla ends up with some bad press, and being an underdog it doesn't need that.
- indalo 7y ago
  To me that is good press, and it's something I personally would like. Seeing a state and/or adjunct corporations throwing a tantrum over this is only a measure of success. After all privacy is the goal, isn't it?
- mtgx 7y ago
  In other words, Mozilla shouldn't do something good for its users because it could bring bad press.
zajio1am 7y ago
Not if one trusts more his/her ISP more than Cloudflare. At least, an ISP is a contractual partner and under the same jurisdiction, in Europe including GDPR.
- floatboth 7y ago
  Being in the same jurisdiction is bad: your ISP is THE place for your local law enforcement to get info on your browsing.
  - 7y ago

edjw 7y ago

Unfortunately, Mozilla are planning to leave DoH off by default for Firefox users in the UK. Almost certainly to avoid criticism from politicians and children’s charities about how DoH would interfere with the UK’s network level website blocking of ‘adult’ websites.

choeger 7y ago
Hrhr. But talk about how it intends to prevent censorship...

andreareina 7y ago

> Fall back to operating system defaults for DNS when split horizon configuration or other DNS issues cause lookup failures. I hope we'll be given the opportunity to disable this, or at the very least show a warning (similar to cert warnings?) that something's off.

the8472 7y ago
the network.trr.mode setting provides fine control https://wiki.mozilla.org/Trusted_Recursive_Resolver https://wiki.mozilla.org/Trusted_Recursive_Resolver

elcomet 7y ago

Why don't they rather include a resolver in Firefox ? This way, no privacy problems, you're directly contacting authoritarive servers. And you don't rely on a single dns-over-https provider. Is the latency a big problem there? I would say that with caching it is not too bad.

deleted 7y ago
[deleted]
EvanAnderson 7y ago
A local resolver using root hints and DNS-over-TLS would be a win for privacy and, at the same time, would not promote centralization of the Internet to DNS-over-HTTPS providers. It still suffers from the problem of overriding local network policy but it's better than just handing all the queries over to a single DoH provider.
- StavrosK 7y ago
  How is DoT different from DoH? Do you have an issue with the format on the wire? Because otherwise you can use whichever resolver you want in either case.
  - EvanAnderson 7y ago
    I'm on mobile so rather than restate I'll just refer to a comment w/ a good link from an earlier discussion: https://news.ycombinator.com/item?id=19624136 https://news.ycombinator.com/item?id=19624136
hannob 7y ago
1. The connection to the authoritative servers isn't encrypted, so the whole point of DoH is undermined. 2. There's plenty of networks that don't let arbitrary DNS traffic out, so this doesn't work without another fallbacks. Fallbacks for security features are bad. I see that there are legit controversies around DoH. But these "Why don't you just do X?" comments aren't helpful. Try to understand the problem they're trying to resolve.

Jonahgay 7y ago

i think DNS over https is stupid, because ISP already knows where your data is going/coming.

pmontra 7y ago

DoH bypasses the OS and the /etc/hosts file. This breaks some workflows.

Jonnax 7y ago
Oh no. Maybe you can configure this? https://support.mozilla.org/en-US/kb/customizing-firefox-using-policiesjson https://support.mozilla.org/en-US/kb/customizing-firefox-usi... Or perhaps use their canary domain to force Firefox to use local DNS? Or just configure it yourself? It's not security if an application can still access the internet. Why not block all internet access except via a proxy server? Which is what a "real" enterprise would do because they can block what they want and have a secure network.

lota-putty 7y ago

We're getting an option to bypass TSP's DNS to a 3rd party over secure connection; be it DoH or DoT. TSPs can easily map your usage behaviour to your identity while 3rd party DNS provider will have your behaviour alone. Albeit, TSP will still have IPs you've accessed for data transfer. TSPs that honour their customers' privacy will allow 3rd party DoH/DoT, esp DoT(ie port:853). TSP: Telecom service provider

EvanAnderson 7y ago

Can somebody point me to the place in the Firefox code where the "use-application-dns.net" canary domain is actually checked? I've tried searching the mozilla-central Mercurial repository and I'm not finding it. I'm clearly inept here. I'm looking at what my Windows DNS servers return when I put in an empty zone for "use-application-dns.net" and I'd like to see exactly what Firefox is testing for. Windows 2012 R2, at least, returns the SOA and no NXDOMAIN for an "A" query to "use-application-dns.net" with an empty zone. If they're explicitly looking for NXDOMAIN then blocking DOH behavior with Windows DNS servers probably isn't going to work. >sigh<

bzbarsky 7y ago
The canary is not implemented yet, as far as I can tell.

antpls 7y ago

I tried forced-mode DoH in Firefox 68 and 69, on Debian 9 and 10. In all cases, it worked for a while then stopped to work after a few hours (at random it seems). The only way for me to make it work again was to disable DoH. I guess a more long term solution is to have a local proxy dns-to-doh, but we are falling back in the solution that only a technical user can setup : https://developers.cloudflare.com/1.1.1.1/dns-over-https/cloudflared-proxy/ https://developers.cloudflare.com/1.1.1.1/dns-over-https/clo... https://facebookexperimental.github.io/doh-proxy/ https://facebookexperimental.github.io/doh-proxy/ And it means setting up firewall routing and filters, as some softwares don't have settings to add DNS proxy, or even bypass them (Google Chrome for example)

tannhaeuser 7y ago

Same story as always with Google "innovations": "hey, we're preventing DNS queries to go to your ISP who is selling it" (to go to our service instead so we can profit from it). It's scary that Moz sides with monopolies like Google and Cloudflare on this one.

LUmBULtERA 7y ago
In my Firefox settings I can choose any DoH provider I want, not just Cloudflare. Naturally something has to be set up as a default so it works. Why is adding DoH in the browser a bad thing?
- josteink 7y ago
  Because if we’re replacing classic DNS with something new, it needs to be part of the OS. Not reimplemented (and configured) per application. The user and OS should control the application, not the other way around.
  - Faark 7y ago
    Is any OS vendor working on something like that? Or do you expect Moz to jump into OS dev as well? I'd expect them to import settings from OS as soon as a major OS provides this for DoH.
- tannhaeuser 7y ago
  The DNS has grown into a regulated service, with TLD authorities and protocols to follow for registrators, transparency for domain holders, many registrators to choose, etc. Do you want to replace it by a centralized system run by very few monopolies that track resolution queries by IP?
jedisct1 7y ago
At the end, you still need to trust the resolver. There is a proposal to improve this. Resolves won't know client IPs any more: https://github.com/DNSCrypt/dnscrypt-protocol/blob/master/ANONYMIZED-DNSCRYPT.txt https://github.com/DNSCrypt/dnscrypt-protocol/blob/master/AN... Reference client and server implementations should be ready in the next few days.

redder2 7y ago

Its great what Mozilla is doing but I would like them to push for this to be made system wide and provide the tools to set it up rather then doing it in the Browser only, and I say that as a lifetime Firefox user. In systemd there is currently only DNS over TLS and there is a security issue open about that. Also not sure if there forced setting has made it into stable. What I want to do it just a easy setting to set up up on my Linux (And windows gaming partition) and never think about it again. And for those concerned about selling data to Google or CF, just use some of the privacy organizations servers for it!

throawayeu45556 7y ago

I am wondering, does DNS-over-HTTPS really helps since the way I understand it, after the domain name is resolved to an IP address, the client contacts the IP address so the ISP could still know the website visited especially since many if not most websites have dedicated IP addresses. So ISP could simply crawl the web and map domain names to IP addresses. Is there anything in DoH mitigating this? Or maybe is this attack vector negligible in practice because most servers typically host multiple websites? At least this adds plausible deniability in a wide range of situations I guess. But is it really true? And for example, would it really help in a country where a website like Facebook is censored? (Since their IP addresses are dedicated).

guiambros 7y ago
DoH definitely doesn't mitigate against your upstream provider doing traffic inspection and siphoning the IPs your network is connecting to. Ultimately, they have to route your IP packets, so they'll always have that visibility. But this 1) adds a technical hurdle, 2) reduces accuracy of the data captured, and 3) adds a potential legal barrier, as the data is not theirs anymore (before ISPs could claim that the use of their DNS gave them right to use the data collected)
zzzcpan 7y ago
Yes, ISPs can know IP addresses and map domains to IP addresses, they can also know exact SNI names, all kinds of passive TCP-level information about your communications, can do active probing for all kinds of information on behalf of you, can use all that together to build a much more detailed profile of you, than available through DNS queries. There is an entire industry of commercial DPI solutions to do that. On top of that ISPs can always block DoH and force fallback to their own DNS servers. So, a minimum amount of privacy can only be achieved with a VPN (or a proxy), not DoH, DoH just leaks to and centralizes data on third parties, violating privacy, making it easier for state actors to spy on people, things like that, it might even give governments capabilities to do world wide censorship if all major browsers implement it. Mozilla, Cloudflare and everyone else involved are being very dishonest when it comes to DoH.
- 7y ago

tinus_hn 7y ago

Can you run this service yourself easily?

jamescun 7y ago

I'd personally prefer to be greeted with a screen providing me with the option of multiple DNS-over-HTTPS providers, and the option of not using one at all, than being silently forced into handing CloudFlare even more of my data.

josteink 7y ago
How about to save time, we could have this choice only once, and that would apply to every application on the machine. Say it could even be handled by the OS itself! And to save users even more time, not having to configure this per machine, we could have such assignment be an automatic part of the network infrastructure... We could call it DHCP and DNS! How about it?
- testis321 7y ago
  And DNSSEC all the way to the user!
  - tptacek 7y ago
    I'd be pretty pissed if my network connection opted me into a DNSSEC-verifying resolver, since that is pretty much pure downside for users.
    - josteink 7y ago
      As someone not very knowledgable about DNSSEC, can you expand on this point? To the uninformed that sounds very counterintuitive.
      - wolf550e 7y ago
        His blog post: https://sockpuppet.org/blog/2015/01/15/against-dnssec/ https://sockpuppet.org/blog/2015/01/15/against-dnssec/
      - tptacek 7y ago
        Apart from the blog post, if you don't know anything about DNSSEC, I think the things you want to know are: 1. Almost nobody --- major tech companies, banks, privacy and security organizations --- uses it. It's decades old, and its adoption, at least in North America and in industry, is zero. There are lots of reasons, but you don't have to care right now. 2. Since almost nothing uses it, there's no real upside to enabling it. But there is a downside! If DNSSEC is misconfigured --- which is easy to do, and it won't get noticed quickly (see: point 1) --- then sites in the DNSSEC-signed zone silently drop off the Internet, as if they never existed. That happened, for instance, to HBO when they launched HBO NOW: nobody on Comcast could see it, because it turned out they'd screwed up DNSSEC, and Comcast had DNSSEC-verifying resolvers.

TazeTSchnitzel 7y ago

I wonder if this will break TP-Link's tplinklogin.net and tplinkrepeater.net for logging into their routers/repeaters? At least the latter is supposed to be intercepted by the device, and if it isn't, you get a message saying things are misconfigured.

xg15 7y ago
Seems to me they should be able to keep this sort of working by resolving tplinklogin.net to 192.168.0.1 or such on their public DNS and ensuring the router always serves the web page from that IP. Of course things will break down if a router is ever configured to use a different IP - but then again, the public DNS with local IP might trigger Firefox' heuristics and cause it to fall back to traditional DNS - so thinks may still work. But the whole concept of using an on-device web page as config UI seems to become problematic, thanks to HTTPS-everywhere, as there appears to be no way to serve HTTPS from a local, unsupervised device that is frictionless and does not open a security vulnerability.

xg15 7y ago

What I still don't see addressed is the question how this will affect non-browser applications. It's nice that Firefox (currently) still offers options to turn off DoH and to keep using local domains. (although the way DoH and HTTPS-everywhere are structured show that non-internet sites don't seem to have much of a place in the web of the future) However, now that we have public DoH endpoints available for everyone to query, what will keep non-browser apps and devices from using DoH without any way to opt-out? Currently, tracking DNS requests seems to be a common way for security and privacy researchers to get some basic information what an app or device is doing on the internet. If DoH is widely deployed, all you'll probably be seeing is encrypted connections to IPs of shared hosters. This seems like a perfect opportunity for apps and devices to cloak data tracking and other illegitimate requests.

zamadatix 7y ago
The same thing that stopped it before DoH was standardized: nothing. There are ways to make FW rules based on trusted DNS lookups (i.e. you can only do traditional DNS to a trusted DNS server with domain filtering and you can only connect to an IP if a DNS lookup has been performed) but this is extremely hard to maintain in any sort of foolproof way. The truth is if you allow outbound connectivity then there all the sender needs to do is add 1 more level of obfuscation than you secure against.

exabrial 7y ago

Could we have srv records as the default to alleviate/eliminate the ipv4 crisis?

andrerm 7y ago

Android + Chrome + DoH + AMP = ? Edit: typo

Avamander 7y ago

ISPs, OSs and Routers should effort at providing secure resolving themselves before every app out there thinks it knows better what DNS to use.

darkhorn 7y ago

Big thanks to Mozilla for making internet a more secure place.

badrabbit 7y ago

Why would Mozilla hurt Firefox's market share in such an obvioud and drastic way? Do they not have anyone at their meetings that brings up obvious and uncomfortable risks? I use DoH on Firefox and love it but man, I myself would block Firefox in a corporate network I help oversee if this is the default. Matter of fact, web proxies already list DoH resolvers as anonymizing sites. Even if this involves some profit with cloudflare,this is strategically terrible for long term goals.