8 ms·

OpenBSD Disabled DoH by Default in Firefox

73 points by katzeilla 7y ago

bureaucrat 7y ago
DoH should be supported on the OS network stack, if needed. I can’t understand this move. Firefox should retreat from this default.
- swiley 7y ago
  The problem with this is that the language runtimes now have to have an http client implementation. DNS isn’t super simple but I would argue it’s much simpler than http. DoH is a very good idea and we need the security it provides but I think using http as the protocol is probably a mistake and will prevent it from being widely adopted.
  - asveikau 7y ago
    So perhaps the right solution is to run a plaintext DNS server bound to localhost, and it calls out using whatever encrypted protocol deemed necessary, systemwide.
    - mtsr 7y ago
      Exactly. And Mozilla could easily offer this instead and benefit other applications the user has.
  - masklinn 7y ago
    You probably don't need a full-fledged general-purpose HTTP implementation to do DOH. However you'd need a pretty complete TLS implementation in the network stack. Which I guess you also need to provide DNS over TLS.
    - ori_b 7y ago
      Yes. I wish we were discussing dnscurve: https://en.m.wikipedia.org/wiki/DNSCurve https://en.m.wikipedia.org/wiki/DNSCurve
      - techntoke 7y ago
        Yes, this really is the correct way to do this. Mozilla adds a lot of complexity when it isn't necessary. I often feel like they are disingenuous.
      - wbl 7y ago
        Dnscurve didn't secure the stub to recursive link but the recursive to authoritative link. Idea was you wouldn't use recursive. The performance impact plus politics were too much so no adoption. Plus some operational problems with name server names.
  - easilyconfused 7y ago
    Why? I assumed everyone asking for it to be OS level would mean that the system resolver does DoH while normal clients continue doing regular DNS. Otherwise what would it even mean to be OS-level if all the client applicatios are doing DoH themselves...?
  - ori_b 7y ago
    Yes. A DNS client was trivial to implement for Myrddin. 550 lines of code. HTTP2 would be incredibly big in comparison. https://git.eigenstate.org/ori/mc.git/tree/lib/std/resolve+posixy.myr https://git.eigenstate.org/ori/mc.git/tree/lib/std/resolve+p...
    - ori_b 7y ago
      (note, more than half of the code is in reading the hosts file and parsing resolv.conf, so DNS itself is about 200 lines)
- osstack 7y ago
  Are Linux/Mac/Windows actually working on adding DoH to their network stack? I never heard anything regarding this. And what would be the relationship to DHCP?
  - katzeilla 7y ago
    Not sure about Linux/Mac/Windows, but for OpenBSD, you can simply use unbound in base system to enable DoH (EDIT: No, it's not DoH, it's DoT) for everything in your system. https://man.openbsd.org/unbound.conf https://man.openbsd.org/unbound.conf
    - detaro 7y ago
      I don't think unbound supports DoH yet (the manpage you link doesn't mention it either). But AFAIK it does DoT. EDIT: clearly shouldn't have used unexplained acronyms: DoH = DNS over HTTPS, DoT = DNS over TLS (which typically uses port 853)
      - ori_b 7y ago
        Which is better, since it avoids ridiculously complicated web standards like HTTP2 for simple DNS lookups.
        bureaucrat 7y ago
        It sounds bad, but the fact that it can’t be blocked is important in terms of censorship. DNS over TLS can be easily blocked by blocking port 853. To block DNS over HTTPS you need to block the entire HTTPS traffic.
        ori_b 7y ago
        If that's the concern, you can run a DNS server on port 443. DOH also doesn't help much with censorship: If you look at traffic patterns, you can detect and block DOH servers pretty easily: look for small queries to a constant endpoint that come just before new connections.
- bigbaguette 7y ago
  Some argue that it's better than nothing, seeing the lack of progress on this matter at the OS level
Jonnax 7y ago
DNS over HTTPS is great for the average user. Anyone who needs some other configuration, clearly is knowledgeable enough to change the behavior.
- lucb1e 7y ago
  I have mixed feelings about this. Yes, we should do what is best for most people, and in particular those who cannot or will not configure it by themselves. But I, too, would like to have good defaults. In this particular case it seems relatively easy: have a blacklist of bad ISPs (similar to how we keep track of phishing sites) and enable it by default for those users (they already have lots of remote calls built in, such as http://detectportal.firefox.com/success.txt http://detectportal.firefox.com/success.txt or the update check, which could easily check to which ISP the request comes from). In the general case, I guess it would be something to choose on first run, which nobody wants. Perhaps there should be a flag/setting "I do want first-run questions for questionable defaults", so that I don't have to hear through the media which settings I have to change after the next update?
- zrm 7y ago
  It's not a matter of knowledge. If each application ignores the OS DNS configuration in favor of its own, it's no longer possible to make a system-wide change to it. You have to change each application individually, and then go back and do it again for each one that updates to a version that adds its own support for DoH. You also then end up with each application using its own implementation, but DoH is a complex protocol (DNS+TLS+HTTP), so that's a lot of attack surface. Better to have one high-quality up-to-date implementation in the OS than dozens of applications that each get their own chance to screw it up. It also breaks all of the usual things that make local DNS work. Your local DHCP server provides your local DNS server which includes entries for the local names with RFC1918 addresses that are only accessible on the local network. Move to DoH via some default external provider and that breaks and requires touching every application on every client to fix it.
  - m45t3r 7y ago
    > It also breaks all of the usual things that make local DNS work. Your local DHCP server provides your local DNS server which includes entries for the local names with RFC1918 addresses that are only accessible on the local network. Move to DoH via some default external provider and that breaks and requires touching every application on every client to fix it. This is not true, Firefox will fallback to your OS configured name resolver if it can't find a name. You can also set it to strict mode so it will only use DOH, but this is not the option that Firefox set by default. https://blog.mozilla.org/futurereleases/2019/09/06/whats-next-in-making-dns-over-https-the-default/ https://blog.mozilla.org/futurereleases/2019/09/06/whats-nex...
artemiszenk 7y ago
I don’t see anything sinister here. Many of us who care about utilizing DoH may already have an appliance that performs this task, but leaving it as an option users can eventually opt into is a good thing. If Google was the one offering DoH, and Otto made this change basically saying, “We don’t want all our traffic going to Google,” I think it would add perspective.
- Faark 7y ago
  There are arguments against Mozilla's current DoH rollout. DNS should be an OS setting and it should not default to a single commercial company. Both are totally valid and I hope be addressed as DoH matures. Or do you mean nothing sinister in this OpenBSD move? Well, it is kind of ironic to downgrade Firefox defaults to unencrypted DNS, since the absence of any modern & encrypted DNS on OSes was likely the only reason Mozilla felt the need for the switch in the first place. And this move doesn't seem to address this underlying issue of unsafe defaults caused by OSes like OpenBSD and thus feels a lot like some "no, shut up, everything is fine" reaction to criticism.
  - windexh8er 7y ago
    Agreed. But I do see it as very similar to preloaded/preselected search. We're numb to that feature of browsers and sometimes fail to remember we don't need them. In many regards DNS in the browser gives back control to the end user. As governments and service providers encroach DoH and DoT are leveling the playing field. Also keep in mind there are different modes DoH in Firefox can operate in. [0] Ultimately I welcome the feature and hope we see more not-for-profit options as defaults in Firefox. [0] https://wiki.mozilla.org/Trusted_Recursive_Resolver https://wiki.mozilla.org/Trusted_Recursive_Resolver
- jlgaddis 7y ago
  > If Google was the one offering DoH, ... Related: With Chrome 78, Google is starting to "experiment" with ("an auto-upgrade approach" to) DNS over HTTPS (DoH) [0], as previously discussed [1] a few days ago. There are some very notable differences from Firefox's testing, however (in particular, they will be "keeping the user’s DNS provider unchanged"). [0]: https://www.chromium.org/developers/dns-over-https https://www.chromium.org/developers/dns-over-https [1]: https://news.ycombinator.com/item?id=20929720 https://news.ycombinator.com/item?id=20929720
lucb1e 7y ago
As a European, I also find it very weird to enable this globally by default. I really don't want to send my traffic to a third party on some other continent that gives me a service for free. I pay my ISP good money to do this for me. No idea how common this is in other countries, but my ISP doesn't sniff or sell my traffic. I've only ever heard about that on HN or Reddit, which are USA-centric. I guess it also happens in other countries, but in the EU such a thing would have to be made known to the user because it processes personal data. Somehow, adding a Pocket button is bad but sending all visited websites to Cloudflare is good. The top two comments (and many others) on the thread about Pocket can be applied here as well if you just replace the name "Pocket" with "Cloudflare": https://news.ycombinator.com/item?id=9667809 https://news.ycombinator.com/item?id=9667809
- Santosh83 7y ago
  Indian here. My ISP does inject ads into plain HTTP traffic, so based on that user-hostile behaviour I assume that they also record my DNS queries and/or sell them. Also whether or not they do that, they are mandated by govt to keep DNS query records for at least 18 months (last I looked) and then anonymise them. Under the current authoritarian leaning govt, I wouldn't be surprised if rules have been revised mandating indefinite recording.
  - lucb1e 7y ago
    Interesting, thanks for adding that data point. I'm wondering if there is a list of this somewhere, it seems like the kind of thing we'd want to track (similar to e.g. the press freedom map https://rsf.org/en/ranking https://rsf.org/en/ranking )
  - mtsr 7y ago
    But the proper solution for that is DNS-over-TLS and picking or running your own recursive DNS resolver.
    - CogitoCogito 7y ago
      Is it not possible to have a recursive DNS resolver with DNS over HTTPS? I.e. are their more differences between DoH and DNS over TLS than just the port number?
dontbenebby 7y ago
Does anyone know a good resource for someone who hasn't done a deep dive on networking in a while, but wants to brush up on the technicals of how DoH works?
- katzeilla 7y ago
  How about this APNIC blog post? https://blog.apnic.net/2018/10/12/doh-dns-over-https-explained/ https://blog.apnic.net/2018/10/12/doh-dns-over-https-explain...
aloknnikhil 7y ago
https://en.wikipedia.org/wiki/Zooko%27s_triangle https://en.wikipedia.org/wiki/Zooko%27s_triangle There have been attempts at solving this through P2P DNS resolution. But, it's just hard to store all those records locally and keep them up-to-date regularly. Perhaps, we could cache and update records for the "popular" domains regularly and reach out to Cloudflare/other DoH or DoTLS providers when the tier 1 lookup fails?
karmakaze 7y ago
Possible Future abuses aside, I much prefer knowing who I'm trusting Mozilla and CloudFlare with a public reputations to preserve than ISPs that make no assertions and regularly voilate privacy.
ysleepy 7y ago
Instead of using a different DoH server than the user set DNS servers, Firefox should test if the user supplied DNS servers support DoH and opportunistically switch over to that.

73 points by katzeilla 7y ago

DoH should be supported on the OS network stack, if needed. I can’t understand this move. Firefox should retreat from this default.

swiley 7y ago
The problem with this is that the language runtimes now have to have an http client implementation. DNS isn’t super simple but I would argue it’s much simpler than http. DoH is a very good idea and we need the security it provides but I think using http as the protocol is probably a mistake and will prevent it from being widely adopted.
- asveikau 7y ago
  So perhaps the right solution is to run a plaintext DNS server bound to localhost, and it calls out using whatever encrypted protocol deemed necessary, systemwide.
  - mtsr 7y ago
    Exactly. And Mozilla could easily offer this instead and benefit other applications the user has.
- masklinn 7y ago
  You probably don't need a full-fledged general-purpose HTTP implementation to do DOH. However you'd need a pretty complete TLS implementation in the network stack. Which I guess you also need to provide DNS over TLS.
  - ori_b 7y ago
    Yes. I wish we were discussing dnscurve: https://en.m.wikipedia.org/wiki/DNSCurve https://en.m.wikipedia.org/wiki/DNSCurve
    - techntoke 7y ago
      Yes, this really is the correct way to do this. Mozilla adds a lot of complexity when it isn't necessary. I often feel like they are disingenuous.
    - wbl 7y ago
      Dnscurve didn't secure the stub to recursive link but the recursive to authoritative link. Idea was you wouldn't use recursive. The performance impact plus politics were too much so no adoption. Plus some operational problems with name server names.
- easilyconfused 7y ago
  Why? I assumed everyone asking for it to be OS level would mean that the system resolver does DoH while normal clients continue doing regular DNS. Otherwise what would it even mean to be OS-level if all the client applicatios are doing DoH themselves...?
- ori_b 7y ago
  Yes. A DNS client was trivial to implement for Myrddin. 550 lines of code. HTTP2 would be incredibly big in comparison. https://git.eigenstate.org/ori/mc.git/tree/lib/std/resolve+posixy.myr https://git.eigenstate.org/ori/mc.git/tree/lib/std/resolve+p...
  - ori_b 7y ago
    (note, more than half of the code is in reading the hosts file and parsing resolv.conf, so DNS itself is about 200 lines)
osstack 7y ago
Are Linux/Mac/Windows actually working on adding DoH to their network stack? I never heard anything regarding this. And what would be the relationship to DHCP?
- katzeilla 7y ago
  Not sure about Linux/Mac/Windows, but for OpenBSD, you can simply use unbound in base system to enable DoH (EDIT: No, it's not DoH, it's DoT) for everything in your system. https://man.openbsd.org/unbound.conf https://man.openbsd.org/unbound.conf
  - detaro 7y ago
    I don't think unbound supports DoH yet (the manpage you link doesn't mention it either). But AFAIK it does DoT. EDIT: clearly shouldn't have used unexplained acronyms: DoH = DNS over HTTPS, DoT = DNS over TLS (which typically uses port 853)
    - ori_b 7y ago
      Which is better, since it avoids ridiculously complicated web standards like HTTP2 for simple DNS lookups.
      - bureaucrat 7y ago
        It sounds bad, but the fact that it can’t be blocked is important in terms of censorship. DNS over TLS can be easily blocked by blocking port 853. To block DNS over HTTPS you need to block the entire HTTPS traffic.
        ori_b 7y ago
        If that's the concern, you can run a DNS server on port 443. DOH also doesn't help much with censorship: If you look at traffic patterns, you can detect and block DOH servers pretty easily: look for small queries to a constant endpoint that come just before new connections.
bigbaguette 7y ago
Some argue that it's better than nothing, seeing the lack of progress on this matter at the OS level

Jonnax 7y ago

DNS over HTTPS is great for the average user. Anyone who needs some other configuration, clearly is knowledgeable enough to change the behavior.

lucb1e 7y ago
I have mixed feelings about this. Yes, we should do what is best for most people, and in particular those who cannot or will not configure it by themselves. But I, too, would like to have good defaults. In this particular case it seems relatively easy: have a blacklist of bad ISPs (similar to how we keep track of phishing sites) and enable it by default for those users (they already have lots of remote calls built in, such as http://detectportal.firefox.com/success.txt http://detectportal.firefox.com/success.txt or the update check, which could easily check to which ISP the request comes from). In the general case, I guess it would be something to choose on first run, which nobody wants. Perhaps there should be a flag/setting "I do want first-run questions for questionable defaults", so that I don't have to hear through the media which settings I have to change after the next update?
zrm 7y ago
It's not a matter of knowledge. If each application ignores the OS DNS configuration in favor of its own, it's no longer possible to make a system-wide change to it. You have to change each application individually, and then go back and do it again for each one that updates to a version that adds its own support for DoH. You also then end up with each application using its own implementation, but DoH is a complex protocol (DNS+TLS+HTTP), so that's a lot of attack surface. Better to have one high-quality up-to-date implementation in the OS than dozens of applications that each get their own chance to screw it up. It also breaks all of the usual things that make local DNS work. Your local DHCP server provides your local DNS server which includes entries for the local names with RFC1918 addresses that are only accessible on the local network. Move to DoH via some default external provider and that breaks and requires touching every application on every client to fix it.
- m45t3r 7y ago
  > It also breaks all of the usual things that make local DNS work. Your local DHCP server provides your local DNS server which includes entries for the local names with RFC1918 addresses that are only accessible on the local network. Move to DoH via some default external provider and that breaks and requires touching every application on every client to fix it. This is not true, Firefox will fallback to your OS configured name resolver if it can't find a name. You can also set it to strict mode so it will only use DOH, but this is not the option that Firefox set by default. https://blog.mozilla.org/futurereleases/2019/09/06/whats-next-in-making-dns-over-https-the-default/ https://blog.mozilla.org/futurereleases/2019/09/06/whats-nex...

artemiszenk 7y ago

I don’t see anything sinister here. Many of us who care about utilizing DoH may already have an appliance that performs this task, but leaving it as an option users can eventually opt into is a good thing. If Google was the one offering DoH, and Otto made this change basically saying, “We don’t want all our traffic going to Google,” I think it would add perspective.

Faark 7y ago
There are arguments against Mozilla's current DoH rollout. DNS should be an OS setting and it should not default to a single commercial company. Both are totally valid and I hope be addressed as DoH matures. Or do you mean nothing sinister in this OpenBSD move? Well, it is kind of ironic to downgrade Firefox defaults to unencrypted DNS, since the absence of any modern & encrypted DNS on OSes was likely the only reason Mozilla felt the need for the switch in the first place. And this move doesn't seem to address this underlying issue of unsafe defaults caused by OSes like OpenBSD and thus feels a lot like some "no, shut up, everything is fine" reaction to criticism.
- windexh8er 7y ago
  Agreed. But I do see it as very similar to preloaded/preselected search. We're numb to that feature of browsers and sometimes fail to remember we don't need them. In many regards DNS in the browser gives back control to the end user. As governments and service providers encroach DoH and DoT are leveling the playing field. Also keep in mind there are different modes DoH in Firefox can operate in. [0] Ultimately I welcome the feature and hope we see more not-for-profit options as defaults in Firefox. [0] https://wiki.mozilla.org/Trusted_Recursive_Resolver https://wiki.mozilla.org/Trusted_Recursive_Resolver
jlgaddis 7y ago
> If Google was the one offering DoH, ... Related: With Chrome 78, Google is starting to "experiment" with ("an auto-upgrade approach" to) DNS over HTTPS (DoH) [0], as previously discussed [1] a few days ago. There are some very notable differences from Firefox's testing, however (in particular, they will be "keeping the user’s DNS provider unchanged"). [0]: https://www.chromium.org/developers/dns-over-https https://www.chromium.org/developers/dns-over-https [1]: https://news.ycombinator.com/item?id=20929720 https://news.ycombinator.com/item?id=20929720

lucb1e 7y ago

As a European, I also find it very weird to enable this globally by default. I really don't want to send my traffic to a third party on some other continent that gives me a service for free. I pay my ISP good money to do this for me. No idea how common this is in other countries, but my ISP doesn't sniff or sell my traffic. I've only ever heard about that on HN or Reddit, which are USA-centric. I guess it also happens in other countries, but in the EU such a thing would have to be made known to the user because it processes personal data. Somehow, adding a Pocket button is bad but sending all visited websites to Cloudflare is good. The top two comments (and many others) on the thread about Pocket can be applied here as well if you just replace the name "Pocket" with "Cloudflare": https://news.ycombinator.com/item?id=9667809 https://news.ycombinator.com/item?id=9667809

Santosh83 7y ago
Indian here. My ISP does inject ads into plain HTTP traffic, so based on that user-hostile behaviour I assume that they also record my DNS queries and/or sell them. Also whether or not they do that, they are mandated by govt to keep DNS query records for at least 18 months (last I looked) and then anonymise them. Under the current authoritarian leaning govt, I wouldn't be surprised if rules have been revised mandating indefinite recording.
- lucb1e 7y ago
  Interesting, thanks for adding that data point. I'm wondering if there is a list of this somewhere, it seems like the kind of thing we'd want to track (similar to e.g. the press freedom map https://rsf.org/en/ranking https://rsf.org/en/ranking )
- mtsr 7y ago
  But the proper solution for that is DNS-over-TLS and picking or running your own recursive DNS resolver.
  - CogitoCogito 7y ago
    Is it not possible to have a recursive DNS resolver with DNS over HTTPS? I.e. are their more differences between DoH and DNS over TLS than just the port number?

dontbenebby 7y ago

Does anyone know a good resource for someone who hasn't done a deep dive on networking in a while, but wants to brush up on the technicals of how DoH works?

katzeilla 7y ago
How about this APNIC blog post? https://blog.apnic.net/2018/10/12/doh-dns-over-https-explained/ https://blog.apnic.net/2018/10/12/doh-dns-over-https-explain...

aloknnikhil 7y ago

https://en.wikipedia.org/wiki/Zooko%27s_triangle https://en.wikipedia.org/wiki/Zooko%27s_triangle There have been attempts at solving this through P2P DNS resolution. But, it's just hard to store all those records locally and keep them up-to-date regularly. Perhaps, we could cache and update records for the "popular" domains regularly and reach out to Cloudflare/other DoH or DoTLS providers when the tier 1 lookup fails?

karmakaze 7y ago

Possible Future abuses aside, I much prefer knowing who I'm trusting Mozilla and CloudFlare with a public reputations to preserve than ISPs that make no assertions and regularly voilate privacy.

ysleepy 7y ago

Instead of using a different DoH server than the user set DNS servers, Firefox should test if the user supplied DNS servers support DoH and opportunistically switch over to that.