5 ms·

There's a lot of negativity here. But this is a win overall for privacy. DNS is used by ISPs to sell user's data and is one way that oppressive regimes track

by Jonnax 7y ago

There's a lot of negativity here. But this is a win overall for privacy. DNS is used by ISPs to sell user's data and is one way that oppressive regimes track what their users do. If you're technical enough to understand DNS then you are smart enough to change what the default is. If you're a system administrator for a company. You should be able to push a profile down to the user's computer to configure DNS how you want.

TheChaplain 7y ago
Well, DoH effectively bypass DNS-filters set up by countries. While some are questionable, I believe it won't take long until Mozilla ends up with some bad press, and being an underdog it doesn't need that.
- indalo 7y ago
  To me that is good press, and it's something I personally would like. Seeing a state and/or adjunct corporations throwing a tantrum over this is only a measure of success. After all privacy is the goal, isn't it?
- mtgx 7y ago
  In other words, Mozilla shouldn't do something good for its users because it could bring bad press.
zajio1am 7y ago
Not if one trusts more his/her ISP more than Cloudflare. At least, an ISP is a contractual partner and under the same jurisdiction, in Europe including GDPR.
- floatboth 7y ago
  Being in the same jurisdiction is bad: your ISP is THE place for your local law enforcement to get info on your browsing.
  - xg15 7y ago
    Yes. However with Cloudflare, now everyone would effectively be under the jurisdiction of the US which is not necessarily better.
    - floatboth 7y ago
      Well, it's good if you live in a non-US-friendly country :)
    - darkhorn 7y ago
      You can change your DoH provider under the settings in Firefox.
- rnhmjoj 7y ago
  Or if you run your own resolver and don't want a completely unrelated third party like Cloudflare siphoning your traffic.
  - mtsr 7y ago
    This. And I already have to deal with smart appliances that try to contact their own DNS (I’m looking at you, Samsung) and that break if I force their requests through my own resolver. This will just allow all applications and appliances to bypass my privacy measures.
    - ferzul 7y ago
      who will write the article about the weird world we live in, where the person who is mitm'ing the network connection is me, and it's the non-mitm'ed connection that is untrusted and worrying. at this point i expect to see talk of “the VPN”, a new network for hobbyists and academics, that's kinda like the old internet, and we only use devices that are wrapped in it.
      - mtsr 7y ago
        Take a look at Privoxy. It's mostly useless now with everyone defaulting to HTTPS unless you install a root certificate on all your devices.
        rnhmjoj 7y ago
        This is actually what I'm doing. With some additional duct tape[1] I made privoxy work on https too. I run an instance for each host, though it could be possible to distribute a personal CA certificate. [1]: https://maxwell.ydns.eu/git/rnhmjoj/privoxy-tls https://maxwell.ydns.eu/git/rnhmjoj/privoxy-tls
      - nathanaldensr 7y ago
        I was just thinking this. It's crazy: we used to all be concerned about protecting the transport (HTTPS/TLS) but now the bigger problem seems to be the endpoints themselves being untrustworthy--"smart" appliances, Google, Facebook, Mozilla and CloudFlare with DNS-over-HTTPS. Untrustworthy endpoints using secure transport to hide malintent.
- lordlimecat 7y ago
  Cloudflare would also be under GDPR as it serves customers in EU.
- meowface 7y ago
  For what it's worth, I trust Cloudflare an order of magnitude more than I trust my ISP (Comcast).
zzzcpan 7y ago
> But this is a win overall for privacy. > DNS is used by ISPs to sell user's data and is one way that oppressive regimes track what their users do. It's not a win for privacy, ISPs will still have that data and now third parties will have that data, state actors will have that data in a nice convenient centralized locations, governments will have an ability to force those centralized providers to do censorship for them. As for oppressive regimes - they don't care about DNS data, if they want to spy on people, they will one way or another.
- lovelearning 7y ago
  DoH does not imply centralization in any way. Any trusted party can provide their own DoH endpoint. I can run my own DoH server on a cheap VPS hosted in another country. I live in an increasingly oppressive regime. Most of the blocking is done at DNS level. DoH is a great solution. Slamming DoH because they can anyway spy one way or another is a poor argument.
  - tssva 7y ago
    The issue is each application implementing DoH themselves. Now any software which you wish to use your own DoH resolver would have to be configured individually. A better solution would have been for Mozilla to fund development of an enduser friendly DNS proxy application which would enable DoH system wide.
    - lovelearning 7y ago
      The ideal solution would be something that can be installed in any home router, but that's a non-starter because of total lack of home router configuration standards. Flashing a router is not user-friendly for anybody. The next best solution would be your suggestion, but that too is not practical unless it comes preinstalled on all OSes because the average user won't even know they need something called a DNS proxy. I don't see OS vendors agreeing to preinstall it. Additionally, AFAIK, popular OSes like Android and iOS prior to some versions don't even allow such system-wide DNS proxy configurations. The practical approach left then is to implement it in browsers, solving it at least for the most common use case on all devices. Everybody knows how to download and install and use browsers. In a discussion forum I frequent, average users ask for ISP censorship bypass solutions all the time. Since Chrome does not support DoH yet, among all the possible solutions - VPN, Tor, SSHproxy - using another browser is actually the most user-friendly, least expensive, most performant option. It helps that it's Mozilla's product because their trust perception is higher than Google/MS/Apple/VPN providers. I feel Mozilla's taken a good approach overall within the scope of their area of expertise.
xorcist 7y ago
> DNS is used by ISPs to sell user's data Claims like these keep surfacing in every discussion. While it is good to contemplate what your ISP spying on you would look like and what you can do to minimize that risk, it is not good to present this as normal behaviour. From my perspective I am absolutely certain that this is not something that is routinely done, not in established ISPs in democratic countries. The risks would be far too great for a tiny income. Who would you sell to? The advertising networks have their own data sources, and even the web giants with billions of users and trackers embedded in pretty much every web page you visit can't charge much. Even if you wanted to do this, DNS would be a low value target considering it is cached at every layer. Data mining sFlow logs, which is something every ISP would use anyway for diagnostic purposes, would give you better view of which kind of services users connect to and for how long. So please don't normalize something that is at best a niche for bad actors. That can lead to decisions for end users, many of whom would be wiser not sending their data off to a foreign third party.
- BubRoss 7y ago
  How are you so certain that this doesn't happen in general?
  - Ajedi32 7y ago
    Is there any evidence suggesting that it does? Personally I have no idea whether or not this is a common practice, though I have to agree with xorcist that it's certainly not a given.
    - BubRoss 7y ago
      It is common for AT&T
throw0101a 7y ago
> DNS is used by ISPs to sell user's data and is one way that oppressive regimes track what their users do. Your ISP may do this, but mine does not, so why should Mozilla get to dictate IT policy of my machine (i.e., ignoring resolve.conf)? Or policy of the company where I help run IT?
- Jonnax 7y ago
  DNS is a plaintext protocol. It's a new technology. Technically this is better. It reminds me of this silliness I sometimes hear: "I need to use NAT with IPv6 to protect my network" Firefox will allow you to set up a DNS rule locally that forces the client to use local dns, if you need it. You can also configure a DNS over HTTPs server as your DNS. If you help run IT and care about security. Then you should be blocking direct access to the internet anyway. All your traffic should be going through a proxy server. Also defaults should help those that are in weaker security positions. Just because you're lucky to have a good ISP doesn't mean that other people shouldn't be protected by default. You're knowledgeable enough to configure your DNS, you just gotta learn something different.

by Jonnax 7y ago

TheChaplain 7y ago

Well, DoH effectively bypass DNS-filters set up by countries. While some are questionable, I believe it won't take long until Mozilla ends up with some bad press, and being an underdog it doesn't need that.

indalo 7y ago
To me that is good press, and it's something I personally would like. Seeing a state and/or adjunct corporations throwing a tantrum over this is only a measure of success. After all privacy is the goal, isn't it?
mtgx 7y ago
In other words, Mozilla shouldn't do something good for its users because it could bring bad press.

zajio1am 7y ago

Not if one trusts more his/her ISP more than Cloudflare. At least, an ISP is a contractual partner and under the same jurisdiction, in Europe including GDPR.

floatboth 7y ago
Being in the same jurisdiction is bad: your ISP is THE place for your local law enforcement to get info on your browsing.
- xg15 7y ago
  Yes. However with Cloudflare, now everyone would effectively be under the jurisdiction of the US which is not necessarily better.
  - floatboth 7y ago
    Well, it's good if you live in a non-US-friendly country :)
  - darkhorn 7y ago
    You can change your DoH provider under the settings in Firefox.
rnhmjoj 7y ago
Or if you run your own resolver and don't want a completely unrelated third party like Cloudflare siphoning your traffic.
- mtsr 7y ago
  This. And I already have to deal with smart appliances that try to contact their own DNS (I’m looking at you, Samsung) and that break if I force their requests through my own resolver. This will just allow all applications and appliances to bypass my privacy measures.
  - ferzul 7y ago
    who will write the article about the weird world we live in, where the person who is mitm'ing the network connection is me, and it's the non-mitm'ed connection that is untrusted and worrying. at this point i expect to see talk of “the VPN”, a new network for hobbyists and academics, that's kinda like the old internet, and we only use devices that are wrapped in it.
    - mtsr 7y ago
      Take a look at Privoxy. It's mostly useless now with everyone defaulting to HTTPS unless you install a root certificate on all your devices.
      - rnhmjoj 7y ago
        This is actually what I'm doing. With some additional duct tape[1] I made privoxy work on https too. I run an instance for each host, though it could be possible to distribute a personal CA certificate. [1]: https://maxwell.ydns.eu/git/rnhmjoj/privoxy-tls https://maxwell.ydns.eu/git/rnhmjoj/privoxy-tls
    - nathanaldensr 7y ago
      I was just thinking this. It's crazy: we used to all be concerned about protecting the transport (HTTPS/TLS) but now the bigger problem seems to be the endpoints themselves being untrustworthy--"smart" appliances, Google, Facebook, Mozilla and CloudFlare with DNS-over-HTTPS. Untrustworthy endpoints using secure transport to hide malintent.
lordlimecat 7y ago
Cloudflare would also be under GDPR as it serves customers in EU.
meowface 7y ago
For what it's worth, I trust Cloudflare an order of magnitude more than I trust my ISP (Comcast).

zzzcpan 7y ago

> But this is a win overall for privacy. > DNS is used by ISPs to sell user's data and is one way that oppressive regimes track what their users do. It's not a win for privacy, ISPs will still have that data and now third parties will have that data, state actors will have that data in a nice convenient centralized locations, governments will have an ability to force those centralized providers to do censorship for them. As for oppressive regimes - they don't care about DNS data, if they want to spy on people, they will one way or another.

lovelearning 7y ago
DoH does not imply centralization in any way. Any trusted party can provide their own DoH endpoint. I can run my own DoH server on a cheap VPS hosted in another country. I live in an increasingly oppressive regime. Most of the blocking is done at DNS level. DoH is a great solution. Slamming DoH because they can anyway spy one way or another is a poor argument.
- tssva 7y ago
  The issue is each application implementing DoH themselves. Now any software which you wish to use your own DoH resolver would have to be configured individually. A better solution would have been for Mozilla to fund development of an enduser friendly DNS proxy application which would enable DoH system wide.
  - lovelearning 7y ago
    The ideal solution would be something that can be installed in any home router, but that's a non-starter because of total lack of home router configuration standards. Flashing a router is not user-friendly for anybody. The next best solution would be your suggestion, but that too is not practical unless it comes preinstalled on all OSes because the average user won't even know they need something called a DNS proxy. I don't see OS vendors agreeing to preinstall it. Additionally, AFAIK, popular OSes like Android and iOS prior to some versions don't even allow such system-wide DNS proxy configurations. The practical approach left then is to implement it in browsers, solving it at least for the most common use case on all devices. Everybody knows how to download and install and use browsers. In a discussion forum I frequent, average users ask for ISP censorship bypass solutions all the time. Since Chrome does not support DoH yet, among all the possible solutions - VPN, Tor, SSHproxy - using another browser is actually the most user-friendly, least expensive, most performant option. It helps that it's Mozilla's product because their trust perception is higher than Google/MS/Apple/VPN providers. I feel Mozilla's taken a good approach overall within the scope of their area of expertise.

xorcist 7y ago

> DNS is used by ISPs to sell user's data Claims like these keep surfacing in every discussion. While it is good to contemplate what your ISP spying on you would look like and what you can do to minimize that risk, it is not good to present this as normal behaviour. From my perspective I am absolutely certain that this is not something that is routinely done, not in established ISPs in democratic countries. The risks would be far too great for a tiny income. Who would you sell to? The advertising networks have their own data sources, and even the web giants with billions of users and trackers embedded in pretty much every web page you visit can't charge much. Even if you wanted to do this, DNS would be a low value target considering it is cached at every layer. Data mining sFlow logs, which is something every ISP would use anyway for diagnostic purposes, would give you better view of which kind of services users connect to and for how long. So please don't normalize something that is at best a niche for bad actors. That can lead to decisions for end users, many of whom would be wiser not sending their data off to a foreign third party.

BubRoss 7y ago
How are you so certain that this doesn't happen in general?
- Ajedi32 7y ago
  Is there any evidence suggesting that it does? Personally I have no idea whether or not this is a common practice, though I have to agree with xorcist that it's certainly not a given.
  - BubRoss 7y ago
    It is common for AT&T

throw0101a 7y ago

> DNS is used by ISPs to sell user's data and is one way that oppressive regimes track what their users do. Your ISP may do this, but mine does not, so why should Mozilla get to dictate IT policy of my machine (i.e., ignoring resolve.conf)? Or policy of the company where I help run IT?

Jonnax 7y ago
DNS is a plaintext protocol. It's a new technology. Technically this is better. It reminds me of this silliness I sometimes hear: "I need to use NAT with IPv6 to protect my network" Firefox will allow you to set up a DNS rule locally that forces the client to use local dns, if you need it. You can also configure a DNS over HTTPs server as your DNS. If you help run IT and care about security. Then you should be blocking direct access to the internet anyway. All your traffic should be going through a proxy server. Also defaults should help those that are in weaker security positions. Just because you're lucky to have a good ISP doesn't mean that other people shouldn't be protected by default. You're knowledgeable enough to configure your DNS, you just gotta learn something different.