5 ms·

There's nothing that makes Cloudflare the more "privacy friendly" 3rd party. "Privacy friendly" would be a mechanism by which my desire to communicate with "exa

There's nothing that makes Cloudflare the more "privacy friendly" 3rd party. "Privacy friendly" would be a mechanism by which my desire to communicate with "example.com" involved my computer and the computer at example.com with no third party in between. As it stands Mozilla is switching out our local ISP for CloudFlare without asking our consent which means my traffic data is now spread around one more company - that seems like less privacy. And I am not looking forward to finding out the fun ways in which this will break our local DNS. The idea that Cloudflare is in way more trustworty than my local ISP is at best naïve. All this creates is another huge centralized pool of data with no oversight whatsoever except the promise of some company that is currently growing fast, that they will not do anything with that data. Come the times when money becomes tight again, we'll see how well that promise holds up. Sure, encrypting DNS is a good thing. But this is just like trying to make email more secure by using a 3rd party encryption gateway - all it does is moving around who to trust. That's not privacy - that's just silly

diffeomorphism 7y ago
> that seems like less privacy. Seems obvious, but is wrong. If there is a really obvious obstacle to anything, which immediately comes to mind, chances are people addressed this already. In the US, Firefox by default directs DoH queries to DNS servers that are operated by CloudFlare, meaning that CloudFlare has the ability to see users' queries. Mozilla has a strong Trusted Recursive Resolver (TRR) policy in place that forbids CloudFlare or any other DoH partner from collecting personal identifying information. To mitigate this risk, our partners are contractually bound to adhere to this policy. https://support.mozilla.org/en-US/kb/firefox-dns-over-https https://support.mozilla.org/en-US/kb/firefox-dns-over-https
- icebraining 7y ago
  Before, my ISP could gather the domains I visit by DNS. Now, they can still gather them from the IP addresses and SNI, and Cloudflare can gather them from DNS. I'm really struggling to see how this isn't a reduction in privacy. > Mozilla has a strong Trusted Recursive Resolver (TRR) policy in place that forbids CloudFlare or any other DoH partner from collecting personal identifying information. To mitigate this risk, our partners are contractually bound to adhere to this policy. What happens if they get a FISA warrant? How does your contract protect users that before didn't have their DNS queries sent to US companies?
  - diffeomorphism 7y ago
    Your ISP can gather them with much, much more effort. There is privacy value in making things harder. The only motivation your ISP has for logging this is making money; if getting the information is too tedious and expensive why would they bother? > and Cloudflare can gather them from DNS but is contractually forbidden from saving that information. > What happens if they get a FISA warrant? They have to follow the law? Wrong threat model.
    - a-raccoon 7y ago
      > Wrong threat model. You are not permitted to hand-wave corrupt government interception or rubberhosing of civilian data as "wrong threat model." These technologies are central to, and must be focused specifically on, protecting all civilian data from all governments. That is the primary purpose of all privacy systems. Not to protect you from coffee-shop denizens trying to snoop which dating sites you use.
      - dredmorbius 7y ago
        Your ISP is subject to the same FISA warrant threat. If it's one of the large monopoly providers, it's as much a one-stop-shop as Cloudfront is.
        TeMPOraL 7y ago
        Not outside the US. Now unless Mozilla decides to pick a different DoH party for deployment in EU, the problem will come back.
        dredmorbius 7y ago
        Fair point. I'd meant to add "inside the US". The warrant hypo strongly implies this, though as you note, needn't necessarily. Though outside the US, the NSA doesn't require a FISA warrant to intercept data, nor does it face any US legal restrictions on doing so.
        7y ago
- yosamino 7y ago
  Even if this infrastructure was run by Mozilla itself, and they really really promised me that they would not do anything with the data - that's all I would have - a promise ( which is also how cloudflare words it btw [0]). Which in the asymetric situation that puts me in, is not worth all too much to me, because I will never be able to verify it. The data would still end up at yet one more company, compared to the status quo. Trust works if I know the people involved - but I don't know a single individual at Mozilla (or Cloudflare for that matter). That Mozilla trusts Cloudflare is besides the point if I don't really know who they are. The entity I am actually trying to trust is example.com - all this shuffling around trust in increasing layers of complexity is missing the point of the actual problem: Bootstrapping a connection to example.com without revealing to a 3rd part that that is what one is trying to do. [0] https://developers.cloudflare.com/1.1.1.1/commitment-to-privacy/privacy-policy/firefox/ https://developers.cloudflare.com/1.1.1.1/commitment-to-priv...
- TeMPOraL 7y ago
  Ceteris paribus, not having the data is strictly, mathematically more private and secure than having the data but being contractually obliged not to distribute it around. Contracts change, laws change, accidental leaks and targeted attacks happen, there's FISA, and there's a non-zero probability that Cloudflare suddenly decides that half of Europe is Nazis and don't deserve their contractual protections anymore (I'm sorry, but Cloudflare walked into that one themselves). It's as simple as this. Now I do prefer a society of trust over excessive technological means, but let's not pretend like sending data to an additional third party is somehow more or even just as private as not sending it in the first place.
- ti_ranger 7y ago
  > To mitigate this risk, our partners are contractually bound to adhere to this policy. You seem to think that: 1)No company in the history of the world, has ever violated a contract? 2)No government has ever forced a company to give up information that it is contractually obliged not to give up 3)No hacker has ever hacked into a company's systems and exfiltrated data the company was contractually obliged not to share You seem to think that if a contract has been concluded, it is impossible for it to be violated. Then there are also the problems of making all Firefox browsers depend on the availability of CloudFlare.
GeekyBear 7y ago
>As it stands Mozilla is switching out our local ISP for CloudFlare without asking our consent According to their blog post discussing the matter, they fully intend to inform the user of the change and give them the opportunity to opt out. >When DoH is enabled, users will be notified and given the opportunity to opt out https://blog.mozilla.org/futurereleases/2019/09/06/whats-next-in-making-dns-over-https-the-default/ https://blog.mozilla.org/futurereleases/2019/09/06/whats-nex...
dangerface 7y ago
> As it stands Mozilla is switching out our local ISP for CloudFlare without asking our consent which means my traffic data is now spread around one more company > Sure, encrypting DNS is a good thing. But this is just like trying to make email more secure by using a 3rd party encryption gateway - all it does is moving around who to trust. Make up your mind are you worried about the number of people that can see your dns or not?
alerighi 7y ago
You are not considering that IP addresses are dynamic. Only your provider can associate your IP address with you, and thus associate the DNS requests that you make with your identity. Cloudfare can't, because today you have one IP, tomorrow you can have another. And this without talking about providers that puts you inside a NAT, like it's common with mobile connections, where thousands of different costumers shares the same IP address, and thus only the provider can really log your DNS traffic. So if Cloudfare maintains a log of your requests who cares, that log is useless since they can't identify you as soon as you change your IP address. While using standard DNS the provider can identify you and can log all you DNS requests, even if you don't the default ISP DNS servers, since they can simply intercept and decode all the traffic on the DNS port. And not only your provider, everyone in the path between your PC and the DNS server, even at LAN level, for example in public WiFi networks like in airports, schools, companies, the administrators can log all your DNS traffic, and put filters on it.
- prirun 7y ago
  In the US, it's been my experience that cable IP addresses rarely change.

diffeomorphism 7y ago

> that seems like less privacy. Seems obvious, but is wrong. If there is a really obvious obstacle to anything, which immediately comes to mind, chances are people addressed this already. In the US, Firefox by default directs DoH queries to DNS servers that are operated by CloudFlare, meaning that CloudFlare has the ability to see users' queries. Mozilla has a strong Trusted Recursive Resolver (TRR) policy in place that forbids CloudFlare or any other DoH partner from collecting personal identifying information. To mitigate this risk, our partners are contractually bound to adhere to this policy. https://support.mozilla.org/en-US/kb/firefox-dns-over-https https://support.mozilla.org/en-US/kb/firefox-dns-over-https

icebraining 7y ago
Before, my ISP could gather the domains I visit by DNS. Now, they can still gather them from the IP addresses and SNI, and Cloudflare can gather them from DNS. I'm really struggling to see how this isn't a reduction in privacy. > Mozilla has a strong Trusted Recursive Resolver (TRR) policy in place that forbids CloudFlare or any other DoH partner from collecting personal identifying information. To mitigate this risk, our partners are contractually bound to adhere to this policy. What happens if they get a FISA warrant? How does your contract protect users that before didn't have their DNS queries sent to US companies?
- diffeomorphism 7y ago
  Your ISP can gather them with much, much more effort. There is privacy value in making things harder. The only motivation your ISP has for logging this is making money; if getting the information is too tedious and expensive why would they bother? > and Cloudflare can gather them from DNS but is contractually forbidden from saving that information. > What happens if they get a FISA warrant? They have to follow the law? Wrong threat model.
  - a-raccoon 7y ago
    > Wrong threat model. You are not permitted to hand-wave corrupt government interception or rubberhosing of civilian data as "wrong threat model." These technologies are central to, and must be focused specifically on, protecting all civilian data from all governments. That is the primary purpose of all privacy systems. Not to protect you from coffee-shop denizens trying to snoop which dating sites you use.
    - dredmorbius 7y ago
      Your ISP is subject to the same FISA warrant threat. If it's one of the large monopoly providers, it's as much a one-stop-shop as Cloudfront is.
      - TeMPOraL 7y ago
        Not outside the US. Now unless Mozilla decides to pick a different DoH party for deployment in EU, the problem will come back.
        dredmorbius 7y ago
        Fair point. I'd meant to add "inside the US". The warrant hypo strongly implies this, though as you note, needn't necessarily. Though outside the US, the NSA doesn't require a FISA warrant to intercept data, nor does it face any US legal restrictions on doing so.
        7y ago
yosamino 7y ago
Even if this infrastructure was run by Mozilla itself, and they really really promised me that they would not do anything with the data - that's all I would have - a promise ( which is also how cloudflare words it btw [0]). Which in the asymetric situation that puts me in, is not worth all too much to me, because I will never be able to verify it. The data would still end up at yet one more company, compared to the status quo. Trust works if I know the people involved - but I don't know a single individual at Mozilla (or Cloudflare for that matter). That Mozilla trusts Cloudflare is besides the point if I don't really know who they are. The entity I am actually trying to trust is example.com - all this shuffling around trust in increasing layers of complexity is missing the point of the actual problem: Bootstrapping a connection to example.com without revealing to a 3rd part that that is what one is trying to do. [0] https://developers.cloudflare.com/1.1.1.1/commitment-to-privacy/privacy-policy/firefox/ https://developers.cloudflare.com/1.1.1.1/commitment-to-priv...
TeMPOraL 7y ago
Ceteris paribus, not having the data is strictly, mathematically more private and secure than having the data but being contractually obliged not to distribute it around. Contracts change, laws change, accidental leaks and targeted attacks happen, there's FISA, and there's a non-zero probability that Cloudflare suddenly decides that half of Europe is Nazis and don't deserve their contractual protections anymore (I'm sorry, but Cloudflare walked into that one themselves). It's as simple as this. Now I do prefer a society of trust over excessive technological means, but let's not pretend like sending data to an additional third party is somehow more or even just as private as not sending it in the first place.
ti_ranger 7y ago
> To mitigate this risk, our partners are contractually bound to adhere to this policy. You seem to think that: 1)No company in the history of the world, has ever violated a contract? 2)No government has ever forced a company to give up information that it is contractually obliged not to give up 3)No hacker has ever hacked into a company's systems and exfiltrated data the company was contractually obliged not to share You seem to think that if a contract has been concluded, it is impossible for it to be violated. Then there are also the problems of making all Firefox browsers depend on the availability of CloudFlare.

GeekyBear 7y ago

>As it stands Mozilla is switching out our local ISP for CloudFlare without asking our consent According to their blog post discussing the matter, they fully intend to inform the user of the change and give them the opportunity to opt out. >When DoH is enabled, users will be notified and given the opportunity to opt out https://blog.mozilla.org/futurereleases/2019/09/06/whats-next-in-making-dns-over-https-the-default/ https://blog.mozilla.org/futurereleases/2019/09/06/whats-nex...

dangerface 7y ago

> As it stands Mozilla is switching out our local ISP for CloudFlare without asking our consent which means my traffic data is now spread around one more company > Sure, encrypting DNS is a good thing. But this is just like trying to make email more secure by using a 3rd party encryption gateway - all it does is moving around who to trust. Make up your mind are you worried about the number of people that can see your dns or not?

alerighi 7y ago

You are not considering that IP addresses are dynamic. Only your provider can associate your IP address with you, and thus associate the DNS requests that you make with your identity. Cloudfare can't, because today you have one IP, tomorrow you can have another. And this without talking about providers that puts you inside a NAT, like it's common with mobile connections, where thousands of different costumers shares the same IP address, and thus only the provider can really log your DNS traffic. So if Cloudfare maintains a log of your requests who cares, that log is useless since they can't identify you as soon as you change your IP address. While using standard DNS the provider can identify you and can log all you DNS requests, even if you don't the default ISP DNS servers, since they can simply intercept and decode all the traffic on the DNS port. And not only your provider, everyone in the path between your PC and the DNS server, even at LAN level, for example in public WiFi networks like in airports, schools, companies, the administrators can log all your DNS traffic, and put filters on it.

prirun 7y ago
In the US, it's been my experience that cable IP addresses rarely change.