15 ms·

This is painful to read. Masses off unfounded FUD - the article deliberately buries that it's trivial to change your DoH provider if you're silly enough to beli

This is painful to read. Masses off unfounded FUD - the article deliberately buries that it's trivial to change your DoH provider if you're silly enough to believe that CF is actively logging DoH requests and selling them (CF is involved with serving vast swathes of the internet anyway - if they wanted to go down this route they have far more lucrative avenues open than selling DNS requests by IP). If instead what you worry about is the government spying on your traffic then complaining about DoH is even more silly - DNS requests are routinely intercepted and monitored by ISPs in many countries, with the information available to the security services, who have very few restrictions on what they are allowed to do with this data. This is especially true in the country the author appears to be based (Germany). DoH is vital to protect users around the world from censorship and worse. Enabling it by default is a good thing - protecting users from abuse shouldn't only be opt-in. There has to be SOME default chosen, and the default needs to be a site large and well run enough to a) handle the load, and b) be in the firefox HSTS preload list. There aren't a lot of good DoH providers that fit these criteria - CF is one of the few.

taneq 7y ago
> There has to be SOME default chosen It seems trivial to select a half a dozen likely candidates and let the user choose between them on install. Honestly I'd like them to do the same with the search engine. Yes, it's simple enough to change the default, but it'd be nice to choose up-front.
- johnmaguire2013 7y ago
  Every question you make a potential user/customer answer is a potential loss of conversion. Most Firefox users do not care. Those that do can figure out how to change it easily enough.
- deleted 7y ago
  [deleted]
- matharmin 7y ago
  Yes, it's trivial. It's also very annoying to the probably 99% of users who don't care about it at all, especially if this becomes just one of many settings that needs to be configured on startup.
  - isostatic 7y ago
    Make it random then.
    - soraminazuki 7y ago
      Random security settings that differ with each installation? No thanks, I’d rather not play dice with security.
- booblik 7y ago
  But Cloudflare also happen to be the fastest DNS resolver.
  - ti_ranger 7y ago
    Fastest isn't necessarily best. My ISPs caching DNS, and any caching DNS running on IP addresses belonging/advertised by my ISP by BGP to various CDNs, are the best possible responses. I don't care if the p99 DNS response from my ISP is 50% slower than Cloudflare, if the streaming video, or large download, or many small files requests are better served by CDNs in my ISPs network that are not visible to Cloudflare. All DNS benchmarks I have seen focus only on the DNS response time, never on the DNS response quality. But that's because they are mostly written by people who don't know how the internet (or competent ISPs) actually work. Some of them even seem to log errors when they get unexpected responses for some well-known URLs (like google.com) because they don't know there are new Google sites than when they last checked ...
askmike 7y ago
> if you're silly enough to believe that CF is actively logging DoH requests and selling them (CF is involved with serving vast swathes of the internet anyway - if they wanted to go down this route they have far more lucrative avenues open than selling DNS requests by IP). I don't think anyone believes CF will start selling data, that's not what the article argues. Regardless, it's opt-out not opt-in. Which is against newer consumer protection laws such as GDPR. > DoH is vital to protect users around the world from censorship and worse. This isn't black and white. Yes there is upside (as both you and the article agree), but the downside of how DoH is implemented here is that you have to point all your DNS queries to a US company. Historically we've seen how this is a bad idea for global internet privacy (eg. PRISM, etc).
- jfindley 7y ago
  You do not have to point your DNS queries to a US company, this is completely false. You can point your DNS queries at whichever DoH provider you want - you can even run your own DoH provider if you want to.
  - askmike 7y ago
    I should have worded that differently: the default is a US company. Which applies to everyone who doesn't change it specifically for Firefox (the vast majority of users).
    - gcp 7y ago
      ...users in the US. Quite an important detail.
- tomxor 7y ago
  > I don't think anyone believes CF will start selling data, that's not what the article argues. > Regardless, it's opt-out not opt-in. Which is against newer consumer protection laws such as GDPR. I understand the argument in theory.. but the reality is CF is a more trustworthy DNS provider than basically any consumer ISP in the EU.
m-p-3 7y ago
So far I'm using NextDns.io at home, which is DoH and also applies ad-filtering. I haven't heard of any security concerns yet Disclaimer: I do not work or have any financial connection to that service
- dwdz 7y ago
  I tried NextDns but it's extremely slow for me. (I live in central Europe.)
- telmich 7y ago
  It will actually not be used anymore, because firefox avoids your local DoH setup.
  - m-p-3 7y ago
    > For starters, Mozilla said that after it turns on DoH by default for US users, Firefox will contain a mechanism to detect the presence of any local parental control software or enterprise configurations. > Additionally, Mozilla is also working with ISPs to make sure users won't use DoH as a way to bypass legally-set blocklists. > The organization said it's been asking ISPs and providers of network-based parental control solutions to add a "canary domain" to their blocklists. When Firefox will detect that this canary domain is blocked, it will disable DoH to prevent the feature to be used as a filter-bypassing solution. https://www.zdnet.com/article/mozilla-to-gradually-enable-dns-over-https-for-firefox-us-users-later-this-month/ https://www.zdnet.com/article/mozilla-to-gradually-enable-dn... And I'm already set for the DoH switch https://i.imgur.com/GuP5a8F.png https://i.imgur.com/GuP5a8F.png
    - caf 7y ago
      Doesn't this completely defeat the whole thing? Anyone upstream that wants to start censoring or logging can just add this canary domain and continue business as usual.
bennyp101 7y ago
> the article deliberately buries that it's trivial to change your DoH provider While true for you or me, the vast majority of people will have this enabled by default - probably not even realising it's on
- magashna 7y ago
  And? Those same people are likely using their ISP or Google for DNS right now. How is this worse?
  - telmich 7y ago
    It's worse, because the local ISP is more trustworthy and additionally you enable cloudflare for large scale profiling. And don't claim they won't do it, it's just a matter of time
    - magashna 7y ago
      I scoff at the idea that Comcast is more trustworthy than Cloudflare.
      - bjoli 7y ago
        Telia in Sweden has shared data with "selected partners" in a way that led to customers being extorted because of, among other things, porn surfing history and torrent downloading. Trusting your ISP, even in a country with data protection laws like Sweden, is naive. I'd much rather trust a company that tells me "this is the data we store. This is the data we share with APNIC and no-one else".
    - darkhorn 7y ago
      Are you kidding? My ISP is blocking wikipedia.org, i.imgur.com, imbd.com, torproject.org, and many other.
    - bjoli 7y ago
      I live in Sweden and I would never trust any ISP. There are too many cases of data shared with "business partners" that led to things like tries to extort torrent users or porn surfers (even reputable ISPs). This should be, if not illegal at least highly problematic in the eyes of the law. At best the ISPs got a "better behave, because next time ...". All ISPs have data sharing with "selected partners to ensure service quality" which, at least until GDPR, meant basically that they could sell data. Whereas cloudflare states that the 1.1.1.1 data will only ever be shared with APNIC in anonymised form (which they define). Cloudflare defines what data they share for 1.1.1.1 users, which my ISP does not. I trust cloudflare, at least right now. If they were to change their retention policies and agreement I would maybe reconsider.
zzzcpan 7y ago
> DNS requests are routinely intercepted and monitored by ISPs in many countries, with the information available to the security services Not true. ISPs typically record and store netflow-like data, very rarely DNS-data (I'd say storing DNS data is even unusual). If ISPs are in a position to get more detailed than netflow data on you they resort to things like deep packet inspection (DPI), which doesn't rely on DNS, pretty much all mobile/cellular ISPs do that today. > DoH is vital to protect users around the world from censorship and worse. Not true either. DoH can't do anything against censorship and if enabled by default in all browsers can actually give worldwide censorship powers to a single US entity that already has something akin "we will block anything we don't like and do anything our government wants" in their ToS.
- jamespo 7y ago
  you too have ignored "it's trivial to change your DoH provider"
  - stakhanov 7y ago
    It's actually not, or am I somehow missing that this is a feature that Mozilla has announced as part of this move? Users who are not technical powerusers will not understand the real security implications of "Enable DNS over HTTPS", and right now I can't find a setting to change the provider anywhere in the settings dialogue, and about:config and enterprise policies are not something that regular users mess with.
    - DHPersonal 7y ago
      It's in Options/Preferences > Network Settings > Settings, scroll to the bottom and select Custom from the Use Provider dropdown. I added AdGuard's DNS over HTTPS address. https://dns.adguard.com/dns-query https://dns.adguard.com/dns-query
      - stakhanov 7y ago
        Haha. Okay: Actually didn't see it because that one line landed below the fold on my resolution (960px height, fixed taskbar on Windows). Rookie mistake. But also bad UI design if this is actually something that's important and that users should pay attention to. But. (1) There is no informed consent happening here, highlighting to a user, say in Europe, that this would lead to a U.S.-regulated entity knowing a lot about their browsing history. Regular users can't be expected to understand that that is what this setting implies but will think of "DNS over HTTPS" as technical mumbo jumbo that they don't need to pay attention to and that they should keep at default. (2) The dropdown doesn't have any options besides Cloudflare. In order to use the "Other" option, the user would have to research URLs of providers on the Web, which seems like so much friction that few people will do this.
userbinator 7y ago
DoH is vital to protect users around the world from censorship and worse. Like I've asked before, should Mozilla also start including an obfuscating VPN by default, to bypass the Chinese firewall? This is a political issue, and one that I don't think Mozilla should even get involved in because it could have very ugly consequences --- just focus on making a good browser and leave the politics (and VPN/firewall-busters) to others.
- sciurus 7y ago
  In case you missed it, https://blog.mozilla.org/blog/2019/09/10/firefoxs-test-pilot-program-returns-with-firefox-private-network-beta/ https://blog.mozilla.org/blog/2019/09/10/firefoxs-test-pilot...
- CameronNemo 7y ago
  Mozilla is working to add a tor mode or add on.
  - cf141q5325 7y ago
    I dont think they are in a position to be trustworthy enough to offer that. Not after the fiasco with their expired addon certificate sabotaging Tor. I still dont see how the standard practice in Firefox to just silently disable addons is anything but malice.
- _Codemonkeyism 7y ago
  And route all (Firefox) internet traffic of the world through the US.
throw0101a 7y ago
> This is especially true in the country the author appears to be based (Germany). Of all the governments to worry about, the ones in the EU (as well as US, CA, AU, NZ), are the ones I'd least be concerned with, relatively speaking. They're enabling this in the US, and yet even with all its problems, it's the one country that the average web surfer would have to worry least about when visiting "inappropriate" sites. * https://en.wikipedia.org/wiki/Room_641A https://en.wikipedia.org/wiki/Room_641A > DoH is vital to protect users around the world from censorship and worse. Great. Then enable it in countries where it's actually a problem. As a Canadian I do not feel a need for this, and I worry about Cloudflare getting an NSL more than I worry about CSIS/RCMP tapping glass. * https://en.wikipedia.org/wiki/National_security_letter https://en.wikipedia.org/wiki/National_security_letter
- raxxorrax 7y ago
  > Of all the governments to worry about, the ones in the EU (as well as US, CA, AU, NZ), are the ones I'd least be concerned with, relatively speaking. Completely wrong threat assesment in my opinion. You should always be concerned about your own government. It isn't only the axis of evil that imprisons people with leaks about heavy privacy invasions. Russia and China have anything about you and you are a citizen of a western nation? Great, because that doesn't matter at all. You know who poses the greatest threat in motorsports? It is the other driver on your team.
  - throw0101a 7y ago
    > ... * concerned about your own government.* Who says I'm not? But I have recourse with government. What recourse do I have with a private corporation that's based in a country with such law privacy laws.
    - _Codemonkeyism 7y ago
      I know it was a rhetorical question but here it needs to be spelled out: None.
  - Hitton 7y ago
huhtenberg 7y ago
Don't oversimplify the issue. > it's trivial to change your DoH provider Cloudfare is the default. Cloudfare is the only provider listed. Cloudfare will be On by default, so it will be that for 99.999% of Firefox users. That ain't right no matter how well intended it is.
- wruza 7y ago
  The other viable doh provider is google. Other’s timeout is simply not worth the request, in my experience. How does one choose from these two?
  - ndidi 7y ago
    No, the other viable option is not enabling DoH by default.
    - m-p-3 7y ago
      privacy-wise, plaintext is the worst option possible.
      - ndidi 7y ago
        I can think of something worse: sending all your DNS queries to an unregulated third party.
        lousken 7y ago
        aren't you still sending your data to unregulated third party with any ISP? (i dont live in the US so i am not aware if they're regulated in this regard)
        Grimm665 7y ago
        This is already what happens. Your DNS queries have to go somewhere, and unless you control the DNS servers, there's a third party in the loop somewhere.
stakhanov 7y ago
> DNS requests are routinely intercepted and monitored by ISPs in many countries, with the information available to the security services, who have very few restrictions on what they are allowed to do with this data. This is especially true in the country the author appears to be based (Germany). Germany: Storing data for a limited period of time so that data pertaining to individuals can be requested on a case-by-case basis by law enforcement (we are talking Police, not all of government). Not a big deal. U.S.: Highly developed and well resourced mass surveillance in operation on both the business side (surveillance capitalism) and government side (NSA). Privacy laws that protect only U.S.-based persons and declare data pertaining to foreign persons to be fair game. Big f*ing deal.
- soraminazuki 7y ago
  European privacy laws are great, but I’m not so sure it’s as simple as you make it out to be. German intelligence also cooperates with the US on NSA surveillance. https://www.reuters.com/article/us-germany-spying-merkel/merkel-defends-german-intelligence-cooperation-with-nsa-idUSKBN0NP13620150504 https://www.reuters.com/article/us-germany-spying-merkel/mer...
lima 7y ago
> DNS requests are routinely intercepted and monitored by ISPs in many countries, with the information available to the security services, who have very few restrictions on what they are allowed to do with this data. This is especially true in the country the author appears to be based (Germany). Author is based in Switzerland. But since you mentioned Germany - German security services have no legal authority to indiscriminately monitor internet traffic, particularly not inside the country. They got into trouble with parliament the last time they got caught doing it. For ISPs, there's no business value in intercepting or logging customer traffic. They're not allowed to use such data themselves, like for advertising purposes. At "large ISP" scale (tens to hundreds of gigabits), equipment that can intercept DNS queries at line rate is very expensive and adds a lot of infrastructure complexity. ISPs operate on thin margins and have zero incentive to deploy such equipment or otherwise mess with traffic. They're legally mandated to store some metadata like IP address assignments and flow/CGNAT data for a limited period of time and aren't terribly happy about it, at the very least because it's expensive to collect and store it with no benefit. Deutsche Telekom has recently sued the government about it and won[1]. The so-called "Vorratsdatenspeicherung" is a recurrent topic in German politics with conservative governments introducing it, and then having to scrap it when it gets challenged in court by civil rights groups and/or companies[2]. In either case, DNS request data is NOT metadata and would never be inspected and stored unless there's a specific warrant. Deutsche Telekom once redirected NXDOMAIN responses to an OpenDNS-like landing page with suggestions ("Navigationshilfe") and had to stop doing it when people complained to authorities[3]. Exporting and analyzing sampled packet headers or flows is pretty cheap and a standard feature with carrier-grade routing equipment (NetFlow/IPFIX and/or sFlow). IP assignments are basic accounting data that every ISP has. Inspecting packet contents is very different and requires plenty of expensive extra equipment and/or complicated network engineering to redirect traffic to a centralized analyzer, which increases latency. It's only done if necessary, like temporary rerouting for ingress DDoS mitigation. (source: worked in the industry) > Masses off unfounded FUD - the article deliberately buries that it's trivial to change your DoH provider if you're silly enough to believe that CF is actively logging DoH requests and selling them (CF is involved with serving vast swathes of the internet anyway - if they wanted to go down this route they have far more lucrative avenues open than selling DNS requests by IP). Personally, I do trust CloudFlare and understand Mozilla's choice, but I do agree with the centralization concerns. It's a difficult set of tradeoffs, and characterizing the author's concerns as "unfounded FUD" is not fair. [1]: https://web.archive.org/web/20180511081552/http://www.vg-koeln.nrw.de/behoerde/presse/Pressemitteilungen/01_180420/index.php https://web.archive.org/web/20180511081552/http://www.vg-koe... [2]: https://de.wikipedia.org/wiki/Vorratsdatenspeicherung https://de.wikipedia.org/wiki/Vorratsdatenspeicherung [3]: https://www.golem.de/news/t-online-navigationshilfe-telekom-beendet-dns-hijacking-nach-strafanzeige-1905-141370.html https://www.golem.de/news/t-online-navigationshilfe-telekom-...
pdkl95 7y ago
> DNS requests are routinely ... monitored by ISPs DoH doesn't prevent ISP monitoring. Even if they cannot see the DNS request, the browser sends the ISP the returned A/AAAA record in the header of a TCP SYN packet. The ISP necessarily sees the hosts you are connecting to; they don't need to see the DNS traffic. DoH to Cloudflare allows both Cloudflare and the ISP to monitor your pattern-of-life. > DoH is vital to protect users around the world from censorship and worse. Yes, it would be a useful tool to fight censorship, but don't conflate that with monitoring traffic. The ISP still sees the addresses and ports in the IP+TCP headers.
- aseipp 7y ago
  Well, the A/AAAA record and the host you're contacting aren't necessarily the same information, right? You could connect to 10 wildly different sites all behind a CDN and get the same A record for all of them, but vastly different results. It's the host, not the A/AAAA record, that leaks the most information in such a case. DoH/DoT plugs the host being leaked in the DNS packet, then. But of course, then the problem is punted to SNI, since your TLS Hello packet will probably send the host name with the setup packet, leaking the host then. So we're back to square one. To be fair, Firefox and Cloudflare are also working on ESNI, in which case, from what I understand, your DoH reply will include the A/AAAA record and the public key to encrypt SNI names with, which plugs that final major hole. So I think the A/AAAA record being exposed doesn't necessarily tank everything, but it certainly isn't perfect, either. But realistically none of these solutions were 100% perfect and a unique A/AAAA record was always going to expose you to a significant amount of side analysis, I think. In general, it just raises the bar and lets us place more trust in the "last hop" between you and the resolvers, much like many other improvements over the past few years, and originally envisioned by e.g. DNSCrypt. In general I feel the actual host header is more important than the A/AAAA record (it is at least more accurate), but I could be super wrong about that. (The more general discussion about a few major players being able to shape major internet changes for users like this, and general consolidation of the internet is, I think, extremely relevant. But also beyond just this particular exercise.)
deleted 7y ago
[deleted]
yosamino 7y ago
There's nothing that makes Cloudflare the more "privacy friendly" 3rd party. "Privacy friendly" would be a mechanism by which my desire to communicate with "example.com" involved my computer and the computer at example.com with no third party in between. As it stands Mozilla is switching out our local ISP for CloudFlare without asking our consent which means my traffic data is now spread around one more company - that seems like less privacy. And I am not looking forward to finding out the fun ways in which this will break our local DNS. The idea that Cloudflare is in way more trustworty than my local ISP is at best naïve. All this creates is another huge centralized pool of data with no oversight whatsoever except the promise of some company that is currently growing fast, that they will not do anything with that data. Come the times when money becomes tight again, we'll see how well that promise holds up. Sure, encrypting DNS is a good thing. But this is just like trying to make email more secure by using a 3rd party encryption gateway - all it does is moving around who to trust. That's not privacy - that's just silly
- diffeomorphism 7y ago
  > that seems like less privacy. Seems obvious, but is wrong. If there is a really obvious obstacle to anything, which immediately comes to mind, chances are people addressed this already. In the US, Firefox by default directs DoH queries to DNS servers that are operated by CloudFlare, meaning that CloudFlare has the ability to see users' queries. Mozilla has a strong Trusted Recursive Resolver (TRR) policy in place that forbids CloudFlare or any other DoH partner from collecting personal identifying information. To mitigate this risk, our partners are contractually bound to adhere to this policy. https://support.mozilla.org/en-US/kb/firefox-dns-over-https https://support.mozilla.org/en-US/kb/firefox-dns-over-https
  - icebraining 7y ago
    Before, my ISP could gather the domains I visit by DNS. Now, they can still gather them from the IP addresses and SNI, and Cloudflare can gather them from DNS. I'm really struggling to see how this isn't a reduction in privacy. > Mozilla has a strong Trusted Recursive Resolver (TRR) policy in place that forbids CloudFlare or any other DoH partner from collecting personal identifying information. To mitigate this risk, our partners are contractually bound to adhere to this policy. What happens if they get a FISA warrant? How does your contract protect users that before didn't have their DNS queries sent to US companies?
Kim_Bruning 7y ago
A minor quibble, but the url ends in .ch, and the company address is in Switzerland. Why do you say the author is in Germany? (Am I missing something?)
stefantalpalaru 7y ago
> CF is involved with serving vast swathes of the internet anyway Too involved. Cloudflare also single-handedly killed web browsing over Tor with extremely frequent and hard CAPTCHAS, until users install a browser extension that sets a cookie encrypted using NSA's favourite elliptic curve flavour. Just a coincidence, I'm sure. Much like their ability to offer free MITM CDN services to so many web sites.
deleted 7y ago
[deleted]
tannhaeuser 7y ago
Your post is painful to read. Masses of unfounded FUD. > security services, who have very few restrictions on what they are allowed to do with this data. This is especially true in the country the author appears to be based (Germany). The author appears to be from Switzerland, and it's not clear at all why "security services" (who?) in Germany "especially" have few restrictions.
- tialaramex 7y ago
  Laws restricting what the government and private entities can do with data almost invariably (e.g. the GDPR) just have a blanket exception for security services. Very long term we might trend away from that, just as eventually countries which had outlawed capital punishment "except in times of war" realised they had no intention of doing it in a war either so many of them began removing that caveat. But today this is the case with every such restriction I've seen, it either says in the law itself that it doesn't apply to security services or there's a superseding law that says the security services needn't obey the data protection rules.
- diffeomorphism 7y ago
  The usual list of security services, BND etc., not sure why adding lists of acronyms is important to you, when "security services" captures the meaning quite well. > "especially" That refers to news and new laws in recent years, which extended their surveillance capabilities. Also, it is relevant because Germany both has relative strong data protection against non-state actors, but also quite capable intelligence agencies. That said, I think arguing about state actors is the wrong threat model for this discussion.
  - tannhaeuser 7y ago
    > I think arguing about state actors is the wrong threat model for this discussion My post was just a rebuttal to GP's framing the discussion around vague accusations towards state actors. > security services captures the meaning quite well It really doesn't. The various secret services (internal, external, military) are reporting to parliament (not the whole of it, just a close circle/committee nevertheless having received trust by being elected), and their heads are nominated by the government. It's of course entirely within your right to criticize their existence or operations, but yielding power to private monopolies based in another country without any public control whatsover and potential ties to foreign secret services (we don't really know) can't possibly solve whatever problem you're on to, and shouldn't be justified on such vague arguments.
YarickR2 7y ago
Since this moment Firefox should be actively prohibited in any security-conscious workplace - because it will leak some or whole map of internal resources to the third party, which has absolutely no business knowing what resources are deployed in the local network. And deciding what's good for users without making them explicitly and consciously confirm this choice is bad, worse than censorship.
stjohnswarts 7y ago
I don't really see how DoH helps because the IP is still flowing between host and client. What does it matter if they can't see the DNS request? They still see the ip values flying between your computer and TheGreatSatan.us.xxx ? Only a VPN can help here anyway. DoH is good for making sure the IP matches up to the host address because it can verify the IP returned is the one that it is in actually rather than a state actor substitution.

taneq 7y ago

> There has to be SOME default chosen It seems trivial to select a half a dozen likely candidates and let the user choose between them on install. Honestly I'd like them to do the same with the search engine. Yes, it's simple enough to change the default, but it'd be nice to choose up-front.

johnmaguire2013 7y ago
Every question you make a potential user/customer answer is a potential loss of conversion. Most Firefox users do not care. Those that do can figure out how to change it easily enough.
deleted 7y ago
[deleted]
matharmin 7y ago
Yes, it's trivial. It's also very annoying to the probably 99% of users who don't care about it at all, especially if this becomes just one of many settings that needs to be configured on startup.
- isostatic 7y ago
  Make it random then.
  - soraminazuki 7y ago
    Random security settings that differ with each installation? No thanks, I’d rather not play dice with security.
booblik 7y ago
But Cloudflare also happen to be the fastest DNS resolver.
- ti_ranger 7y ago
  Fastest isn't necessarily best. My ISPs caching DNS, and any caching DNS running on IP addresses belonging/advertised by my ISP by BGP to various CDNs, are the best possible responses. I don't care if the p99 DNS response from my ISP is 50% slower than Cloudflare, if the streaming video, or large download, or many small files requests are better served by CDNs in my ISPs network that are not visible to Cloudflare. All DNS benchmarks I have seen focus only on the DNS response time, never on the DNS response quality. But that's because they are mostly written by people who don't know how the internet (or competent ISPs) actually work. Some of them even seem to log errors when they get unexpected responses for some well-known URLs (like google.com) because they don't know there are new Google sites than when they last checked ...

askmike 7y ago

> if you're silly enough to believe that CF is actively logging DoH requests and selling them (CF is involved with serving vast swathes of the internet anyway - if they wanted to go down this route they have far more lucrative avenues open than selling DNS requests by IP). I don't think anyone believes CF will start selling data, that's not what the article argues. Regardless, it's opt-out not opt-in. Which is against newer consumer protection laws such as GDPR. > DoH is vital to protect users around the world from censorship and worse. This isn't black and white. Yes there is upside (as both you and the article agree), but the downside of how DoH is implemented here is that you have to point all your DNS queries to a US company. Historically we've seen how this is a bad idea for global internet privacy (eg. PRISM, etc).

jfindley 7y ago
You do not have to point your DNS queries to a US company, this is completely false. You can point your DNS queries at whichever DoH provider you want - you can even run your own DoH provider if you want to.
- askmike 7y ago
  I should have worded that differently: the default is a US company. Which applies to everyone who doesn't change it specifically for Firefox (the vast majority of users).
  - gcp 7y ago
    ...users in the US. Quite an important detail.
tomxor 7y ago
> I don't think anyone believes CF will start selling data, that's not what the article argues. > Regardless, it's opt-out not opt-in. Which is against newer consumer protection laws such as GDPR. I understand the argument in theory.. but the reality is CF is a more trustworthy DNS provider than basically any consumer ISP in the EU.

m-p-3 7y ago

So far I'm using NextDns.io at home, which is DoH and also applies ad-filtering. I haven't heard of any security concerns yet Disclaimer: I do not work or have any financial connection to that service

dwdz 7y ago
I tried NextDns but it's extremely slow for me. (I live in central Europe.)
telmich 7y ago
It will actually not be used anymore, because firefox avoids your local DoH setup.
- m-p-3 7y ago
  > For starters, Mozilla said that after it turns on DoH by default for US users, Firefox will contain a mechanism to detect the presence of any local parental control software or enterprise configurations. > Additionally, Mozilla is also working with ISPs to make sure users won't use DoH as a way to bypass legally-set blocklists. > The organization said it's been asking ISPs and providers of network-based parental control solutions to add a "canary domain" to their blocklists. When Firefox will detect that this canary domain is blocked, it will disable DoH to prevent the feature to be used as a filter-bypassing solution. https://www.zdnet.com/article/mozilla-to-gradually-enable-dns-over-https-for-firefox-us-users-later-this-month/ https://www.zdnet.com/article/mozilla-to-gradually-enable-dn... And I'm already set for the DoH switch https://i.imgur.com/GuP5a8F.png https://i.imgur.com/GuP5a8F.png
  - caf 7y ago
    Doesn't this completely defeat the whole thing? Anyone upstream that wants to start censoring or logging can just add this canary domain and continue business as usual.

bennyp101 7y ago

> the article deliberately buries that it's trivial to change your DoH provider While true for you or me, the vast majority of people will have this enabled by default - probably not even realising it's on

magashna 7y ago
And? Those same people are likely using their ISP or Google for DNS right now. How is this worse?
- telmich 7y ago
  It's worse, because the local ISP is more trustworthy and additionally you enable cloudflare for large scale profiling. And don't claim they won't do it, it's just a matter of time
  - magashna 7y ago
    I scoff at the idea that Comcast is more trustworthy than Cloudflare.
    - bjoli 7y ago
      Telia in Sweden has shared data with "selected partners" in a way that led to customers being extorted because of, among other things, porn surfing history and torrent downloading. Trusting your ISP, even in a country with data protection laws like Sweden, is naive. I'd much rather trust a company that tells me "this is the data we store. This is the data we share with APNIC and no-one else".
  - darkhorn 7y ago
    Are you kidding? My ISP is blocking wikipedia.org, i.imgur.com, imbd.com, torproject.org, and many other.
  - bjoli 7y ago
    I live in Sweden and I would never trust any ISP. There are too many cases of data shared with "business partners" that led to things like tries to extort torrent users or porn surfers (even reputable ISPs). This should be, if not illegal at least highly problematic in the eyes of the law. At best the ISPs got a "better behave, because next time ...". All ISPs have data sharing with "selected partners to ensure service quality" which, at least until GDPR, meant basically that they could sell data. Whereas cloudflare states that the 1.1.1.1 data will only ever be shared with APNIC in anonymised form (which they define). Cloudflare defines what data they share for 1.1.1.1 users, which my ISP does not. I trust cloudflare, at least right now. If they were to change their retention policies and agreement I would maybe reconsider.

zzzcpan 7y ago

> DNS requests are routinely intercepted and monitored by ISPs in many countries, with the information available to the security services Not true. ISPs typically record and store netflow-like data, very rarely DNS-data (I'd say storing DNS data is even unusual). If ISPs are in a position to get more detailed than netflow data on you they resort to things like deep packet inspection (DPI), which doesn't rely on DNS, pretty much all mobile/cellular ISPs do that today. > DoH is vital to protect users around the world from censorship and worse. Not true either. DoH can't do anything against censorship and if enabled by default in all browsers can actually give worldwide censorship powers to a single US entity that already has something akin "we will block anything we don't like and do anything our government wants" in their ToS.

jamespo 7y ago
you too have ignored "it's trivial to change your DoH provider"
- stakhanov 7y ago
  It's actually not, or am I somehow missing that this is a feature that Mozilla has announced as part of this move? Users who are not technical powerusers will not understand the real security implications of "Enable DNS over HTTPS", and right now I can't find a setting to change the provider anywhere in the settings dialogue, and about:config and enterprise policies are not something that regular users mess with.
  - DHPersonal 7y ago
    It's in Options/Preferences > Network Settings > Settings, scroll to the bottom and select Custom from the Use Provider dropdown. I added AdGuard's DNS over HTTPS address. https://dns.adguard.com/dns-query https://dns.adguard.com/dns-query
    - stakhanov 7y ago
      Haha. Okay: Actually didn't see it because that one line landed below the fold on my resolution (960px height, fixed taskbar on Windows). Rookie mistake. But also bad UI design if this is actually something that's important and that users should pay attention to. But. (1) There is no informed consent happening here, highlighting to a user, say in Europe, that this would lead to a U.S.-regulated entity knowing a lot about their browsing history. Regular users can't be expected to understand that that is what this setting implies but will think of "DNS over HTTPS" as technical mumbo jumbo that they don't need to pay attention to and that they should keep at default. (2) The dropdown doesn't have any options besides Cloudflare. In order to use the "Other" option, the user would have to research URLs of providers on the Web, which seems like so much friction that few people will do this.

userbinator 7y ago

DoH is vital to protect users around the world from censorship and worse. Like I've asked before, should Mozilla also start including an obfuscating VPN by default, to bypass the Chinese firewall? This is a political issue, and one that I don't think Mozilla should even get involved in because it could have very ugly consequences --- just focus on making a good browser and leave the politics (and VPN/firewall-busters) to others.

sciurus 7y ago
In case you missed it, https://blog.mozilla.org/blog/2019/09/10/firefoxs-test-pilot-program-returns-with-firefox-private-network-beta/ https://blog.mozilla.org/blog/2019/09/10/firefoxs-test-pilot...
CameronNemo 7y ago
Mozilla is working to add a tor mode or add on.
- cf141q5325 7y ago
  I dont think they are in a position to be trustworthy enough to offer that. Not after the fiasco with their expired addon certificate sabotaging Tor. I still dont see how the standard practice in Firefox to just silently disable addons is anything but malice.
_Codemonkeyism 7y ago
And route all (Firefox) internet traffic of the world through the US.

throw0101a 7y ago

> This is especially true in the country the author appears to be based (Germany). Of all the governments to worry about, the ones in the EU (as well as US, CA, AU, NZ), are the ones I'd least be concerned with, relatively speaking. They're enabling this in the US, and yet even with all its problems, it's the one country that the average web surfer would have to worry least about when visiting "inappropriate" sites. * https://en.wikipedia.org/wiki/Room_641A https://en.wikipedia.org/wiki/Room_641A > DoH is vital to protect users around the world from censorship and worse. Great. Then enable it in countries where it's actually a problem. As a Canadian I do not feel a need for this, and I worry about Cloudflare getting an NSL more than I worry about CSIS/RCMP tapping glass. * https://en.wikipedia.org/wiki/National_security_letter https://en.wikipedia.org/wiki/National_security_letter

raxxorrax 7y ago
> Of all the governments to worry about, the ones in the EU (as well as US, CA, AU, NZ), are the ones I'd least be concerned with, relatively speaking. Completely wrong threat assesment in my opinion. You should always be concerned about your own government. It isn't only the axis of evil that imprisons people with leaks about heavy privacy invasions. Russia and China have anything about you and you are a citizen of a western nation? Great, because that doesn't matter at all. You know who poses the greatest threat in motorsports? It is the other driver on your team.
- throw0101a 7y ago
  > ... * concerned about your own government.* Who says I'm not? But I have recourse with government. What recourse do I have with a private corporation that's based in a country with such law privacy laws.
  - _Codemonkeyism 7y ago
    I know it was a rhetorical question but here it needs to be spelled out: None.
- Hitton 7y ago

huhtenberg 7y ago

Don't oversimplify the issue. > it's trivial to change your DoH provider Cloudfare is the default. Cloudfare is the only provider listed. Cloudfare will be On by default, so it will be that for 99.999% of Firefox users. That ain't right no matter how well intended it is.

wruza 7y ago
The other viable doh provider is google. Other’s timeout is simply not worth the request, in my experience. How does one choose from these two?
- ndidi 7y ago
  No, the other viable option is not enabling DoH by default.
  - m-p-3 7y ago
    privacy-wise, plaintext is the worst option possible.
    - ndidi 7y ago
      I can think of something worse: sending all your DNS queries to an unregulated third party.
      - lousken 7y ago
        aren't you still sending your data to unregulated third party with any ISP? (i dont live in the US so i am not aware if they're regulated in this regard)
      - Grimm665 7y ago
        This is already what happens. Your DNS queries have to go somewhere, and unless you control the DNS servers, there's a third party in the loop somewhere.

stakhanov 7y ago

soraminazuki 7y ago
European privacy laws are great, but I’m not so sure it’s as simple as you make it out to be. German intelligence also cooperates with the US on NSA surveillance. https://www.reuters.com/article/us-germany-spying-merkel/merkel-defends-german-intelligence-cooperation-with-nsa-idUSKBN0NP13620150504 https://www.reuters.com/article/us-germany-spying-merkel/mer...

lima 7y ago

> DNS requests are routinely intercepted and monitored by ISPs in many countries, with the information available to the security services, who have very few restrictions on what they are allowed to do with this data. This is especially true in the country the author appears to be based (Germany). Author is based in Switzerland. But since you mentioned Germany - German security services have no legal authority to indiscriminately monitor internet traffic, particularly not inside the country. They got into trouble with parliament the last time they got caught doing it. For ISPs, there's no business value in intercepting or logging customer traffic. They're not allowed to use such data themselves, like for advertising purposes. At "large ISP" scale (tens to hundreds of gigabits), equipment that can intercept DNS queries at line rate is very expensive and adds a lot of infrastructure complexity. ISPs operate on thin margins and have zero incentive to deploy such equipment or otherwise mess with traffic. They're legally mandated to store some metadata like IP address assignments and flow/CGNAT data for a limited period of time and aren't terribly happy about it, at the very least because it's expensive to collect and store it with no benefit. Deutsche Telekom has recently sued the government about it and won[1]. The so-called "Vorratsdatenspeicherung" is a recurrent topic in German politics with conservative governments introducing it, and then having to scrap it when it gets challenged in court by civil rights groups and/or companies[2]. In either case, DNS request data is NOT metadata and would never be inspected and stored unless there's a specific warrant. Deutsche Telekom once redirected NXDOMAIN responses to an OpenDNS-like landing page with suggestions ("Navigationshilfe") and had to stop doing it when people complained to authorities[3]. Exporting and analyzing sampled packet headers or flows is pretty cheap and a standard feature with carrier-grade routing equipment (NetFlow/IPFIX and/or sFlow). IP assignments are basic accounting data that every ISP has. Inspecting packet contents is very different and requires plenty of expensive extra equipment and/or complicated network engineering to redirect traffic to a centralized analyzer, which increases latency. It's only done if necessary, like temporary rerouting for ingress DDoS mitigation. (source: worked in the industry) > Masses off unfounded FUD - the article deliberately buries that it's trivial to change your DoH provider if you're silly enough to believe that CF is actively logging DoH requests and selling them (CF is involved with serving vast swathes of the internet anyway - if they wanted to go down this route they have far more lucrative avenues open than selling DNS requests by IP). Personally, I do trust CloudFlare and understand Mozilla's choice, but I do agree with the centralization concerns. It's a difficult set of tradeoffs, and characterizing the author's concerns as "unfounded FUD" is not fair. [1]: https://web.archive.org/web/20180511081552/http://www.vg-koeln.nrw.de/behoerde/presse/Pressemitteilungen/01_180420/index.php https://web.archive.org/web/20180511081552/http://www.vg-koe... [2]: https://de.wikipedia.org/wiki/Vorratsdatenspeicherung https://de.wikipedia.org/wiki/Vorratsdatenspeicherung [3]: https://www.golem.de/news/t-online-navigationshilfe-telekom-beendet-dns-hijacking-nach-strafanzeige-1905-141370.html https://www.golem.de/news/t-online-navigationshilfe-telekom-...

pdkl95 7y ago

> DNS requests are routinely ... monitored by ISPs DoH doesn't prevent ISP monitoring. Even if they cannot see the DNS request, the browser sends the ISP the returned A/AAAA record in the header of a TCP SYN packet. The ISP necessarily sees the hosts you are connecting to; they don't need to see the DNS traffic. DoH to Cloudflare allows both Cloudflare and the ISP to monitor your pattern-of-life. > DoH is vital to protect users around the world from censorship and worse. Yes, it would be a useful tool to fight censorship, but don't conflate that with monitoring traffic. The ISP still sees the addresses and ports in the IP+TCP headers.

aseipp 7y ago
Well, the A/AAAA record and the host you're contacting aren't necessarily the same information, right? You could connect to 10 wildly different sites all behind a CDN and get the same A record for all of them, but vastly different results. It's the host, not the A/AAAA record, that leaks the most information in such a case. DoH/DoT plugs the host being leaked in the DNS packet, then. But of course, then the problem is punted to SNI, since your TLS Hello packet will probably send the host name with the setup packet, leaking the host then. So we're back to square one. To be fair, Firefox and Cloudflare are also working on ESNI, in which case, from what I understand, your DoH reply will include the A/AAAA record and the public key to encrypt SNI names with, which plugs that final major hole. So I think the A/AAAA record being exposed doesn't necessarily tank everything, but it certainly isn't perfect, either. But realistically none of these solutions were 100% perfect and a unique A/AAAA record was always going to expose you to a significant amount of side analysis, I think. In general, it just raises the bar and lets us place more trust in the "last hop" between you and the resolvers, much like many other improvements over the past few years, and originally envisioned by e.g. DNSCrypt. In general I feel the actual host header is more important than the A/AAAA record (it is at least more accurate), but I could be super wrong about that. (The more general discussion about a few major players being able to shape major internet changes for users like this, and general consolidation of the internet is, I think, extremely relevant. But also beyond just this particular exercise.)

deleted 7y ago

[deleted]

yosamino 7y ago

There's nothing that makes Cloudflare the more "privacy friendly" 3rd party. "Privacy friendly" would be a mechanism by which my desire to communicate with "example.com" involved my computer and the computer at example.com with no third party in between. As it stands Mozilla is switching out our local ISP for CloudFlare without asking our consent which means my traffic data is now spread around one more company - that seems like less privacy. And I am not looking forward to finding out the fun ways in which this will break our local DNS. The idea that Cloudflare is in way more trustworty than my local ISP is at best naïve. All this creates is another huge centralized pool of data with no oversight whatsoever except the promise of some company that is currently growing fast, that they will not do anything with that data. Come the times when money becomes tight again, we'll see how well that promise holds up. Sure, encrypting DNS is a good thing. But this is just like trying to make email more secure by using a 3rd party encryption gateway - all it does is moving around who to trust. That's not privacy - that's just silly

diffeomorphism 7y ago
> that seems like less privacy. Seems obvious, but is wrong. If there is a really obvious obstacle to anything, which immediately comes to mind, chances are people addressed this already. In the US, Firefox by default directs DoH queries to DNS servers that are operated by CloudFlare, meaning that CloudFlare has the ability to see users' queries. Mozilla has a strong Trusted Recursive Resolver (TRR) policy in place that forbids CloudFlare or any other DoH partner from collecting personal identifying information. To mitigate this risk, our partners are contractually bound to adhere to this policy. https://support.mozilla.org/en-US/kb/firefox-dns-over-https https://support.mozilla.org/en-US/kb/firefox-dns-over-https
- icebraining 7y ago
  Before, my ISP could gather the domains I visit by DNS. Now, they can still gather them from the IP addresses and SNI, and Cloudflare can gather them from DNS. I'm really struggling to see how this isn't a reduction in privacy. > Mozilla has a strong Trusted Recursive Resolver (TRR) policy in place that forbids CloudFlare or any other DoH partner from collecting personal identifying information. To mitigate this risk, our partners are contractually bound to adhere to this policy. What happens if they get a FISA warrant? How does your contract protect users that before didn't have their DNS queries sent to US companies?

Kim_Bruning 7y ago

A minor quibble, but the url ends in .ch, and the company address is in Switzerland. Why do you say the author is in Germany? (Am I missing something?)

stefantalpalaru 7y ago

> CF is involved with serving vast swathes of the internet anyway Too involved. Cloudflare also single-handedly killed web browsing over Tor with extremely frequent and hard CAPTCHAS, until users install a browser extension that sets a cookie encrypted using NSA's favourite elliptic curve flavour. Just a coincidence, I'm sure. Much like their ability to offer free MITM CDN services to so many web sites.

deleted 7y ago

[deleted]

tannhaeuser 7y ago

Your post is painful to read. Masses of unfounded FUD. > security services, who have very few restrictions on what they are allowed to do with this data. This is especially true in the country the author appears to be based (Germany). The author appears to be from Switzerland, and it's not clear at all why "security services" (who?) in Germany "especially" have few restrictions.

tialaramex 7y ago
Laws restricting what the government and private entities can do with data almost invariably (e.g. the GDPR) just have a blanket exception for security services. Very long term we might trend away from that, just as eventually countries which had outlawed capital punishment "except in times of war" realised they had no intention of doing it in a war either so many of them began removing that caveat. But today this is the case with every such restriction I've seen, it either says in the law itself that it doesn't apply to security services or there's a superseding law that says the security services needn't obey the data protection rules.
diffeomorphism 7y ago
The usual list of security services, BND etc., not sure why adding lists of acronyms is important to you, when "security services" captures the meaning quite well. > "especially" That refers to news and new laws in recent years, which extended their surveillance capabilities. Also, it is relevant because Germany both has relative strong data protection against non-state actors, but also quite capable intelligence agencies. That said, I think arguing about state actors is the wrong threat model for this discussion.
- tannhaeuser 7y ago
  > I think arguing about state actors is the wrong threat model for this discussion My post was just a rebuttal to GP's framing the discussion around vague accusations towards state actors. > security services captures the meaning quite well It really doesn't. The various secret services (internal, external, military) are reporting to parliament (not the whole of it, just a close circle/committee nevertheless having received trust by being elected), and their heads are nominated by the government. It's of course entirely within your right to criticize their existence or operations, but yielding power to private monopolies based in another country without any public control whatsover and potential ties to foreign secret services (we don't really know) can't possibly solve whatever problem you're on to, and shouldn't be justified on such vague arguments.

YarickR2 7y ago

Since this moment Firefox should be actively prohibited in any security-conscious workplace - because it will leak some or whole map of internal resources to the third party, which has absolutely no business knowing what resources are deployed in the local network. And deciding what's good for users without making them explicitly and consciously confirm this choice is bad, worse than censorship.

stjohnswarts 7y ago

I don't really see how DoH helps because the IP is still flowing between host and client. What does it matter if they can't see the DNS request? They still see the ip values flying between your computer and TheGreatSatan.us.xxx ? Only a VPN can help here anyway. DoH is good for making sure the IP matches up to the host address because it can verify the IP returned is the one that it is in actually rather than a state actor substitution.