10 ms·

It's bad for privacy in theory because you centralize DNS requests through Cloudflare. In practice ISPs are almost universally reprehensible in how they collect

• DavideNL 7y ago
  > In practice ISPs are the almost universally reprehensible in how they collect, track, and sell your data ... in your country. For me it's the other way around; i'd rather trust my ISP because privacy laws in my country/EU are much better vs the US. I interpret the move by Mozilla as hostile in regards of privacy, and i can't understand why EU politics don't intervene when a US company starts hijacking all Firefox users DNS requests (opt-out instead of opt-in.)
  • the8472 7y ago
    > and i can't understand why EU politics don't intervene Maybe it is as simple as nobody having filed a complaint with a data protection agency yet.
    • jannes 7y ago
      Interesting question... How would I file a complaint against Mozilla? Their privacy policy is only available in English and lists Mozilla Corporation in Mountain View as the legal entity. They probably don't conduct many business activities in the EU. However, it looks like they are providing a website for "data subject access requests" which means they might fall under EU regulation as it sounds like a GDPR compliance thing. https://app.onetrust.com/app/#/webform/4ba08202-2ede-4934-a89e-f0b0870f95f0 https://app.onetrust.com/app/#/webform/4ba08202-2ede-4934-a8...
    • mfer 7y ago
      Maybe because the rollout of DoH by default doesn't include the EU. https://www.theregister.co.uk/2019/09/24/mozilla_backtracks_doh_for_uk_users/ https://www.theregister.co.uk/2019/09/24/mozilla_backtracks_... It looks like they are exploring how to handle things in the EU and looking for partners there.
  • pingyong 7y ago
    The Cloudflare DNS servers you connect to are in the EU and are subject to EU regulation just like your ISP. You don't have 11 ms (or anything sub-~90 ms) latency to the US. One thing to consider also is that unencrypted DNS means that virtually anyone can read (and modify) those requests, not just your ISP. That can be before the data enters your ISPs network, or at any point that isn't physically or technically well protected. Or, in the case of state actors, at any point really.
    • judge2020 7y ago
      > or at any point that isn't physically or technically well protected Kind of off topic, but I was wondering if ISPs use any encryption whatsoever between the home and their IX/servers. Could you theoretically attach something to the wire in the ground, or monitor a satellite-based internet signal, and observe the HTTP/unencrypted data?
      • missosoup 7y ago
        There's no additional encryption layer if that's what you're asking. There will still be multiplexing and whatnot, but if you can recover a particular stream from that, it'll be the same stream that the endpoints see.
        • Hikikomori 7y ago
          There is macsec, probably not that common but the ISP I was working for was looking to implement it in their network. Multiplexing on what?
          • tialaramex 7y ago
            > Multiplexing on what? Light. Optical fibres can move _way_ more data than actual households need, so you use one fibre to move data for, say, 16 endpoints until you get closer, and split it later, saving the cost of 15 long fibres. You can do everything so that there are no active components out in the field where it's annoying except at the customer site, a passive splitter is quite capable of shoving frequencies A-A' to Alice, B-B' to Bob and so on, it's not just solid state it's completely passive, no more likely to need maintenance than, say, the fibre itself.
  • Kuinox 7y ago
    In EU the ISP are forced to use lying DNS to block websites.
    • rocqua 7y ago
      AFAIK the piratebay block works at more than the DNS level. As in, navigating to the correct IP still gets you blocked.
      • Avamander 7y ago
        Depends on the country. The Internet freedom index talks about what each country limits, not all do in any significant manner.
    • throw0101a 7y ago
      First, these things are generally country specific. Is there an EU Directive that makes it continent-wide? Second, given countries in the EU are fairly democratic, this is done via acceptance of the voting public because they elected the representatives. They can always have the law changed if they don't like it.
    • zajio1am 7y ago
      In Czechia, ISPs are forced to block certain websites, but exact method is not speficied. Today, they just block it on DNS level, as that is simplest and effective enough (although easy to circumvent). If ordinary users were using DoH, then ISPs would be forced to use IP based blocking
      • throw0101a 7y ago
        This was one of the concerns brought up at the UKNOG panel: Currently there is DNS blocking (e.g. gambling sites in Poland), and it handles most cases. If (too many?) people start circumventing that, will a government start insisting on more invasive measure (e.g., DPI)?
        • tialaramex 7y ago
  • captn3m0 7y ago
    I reached out to Mozilla, and they've confirmed that DoH is being enabled by default only for installations inside US. So, if you are in the EU, Firefox won't switch you to DoH. You can still enable it if you wish, but your DNS queries will reach your local resolver unless you change it.
    • throw0101a 7y ago
      I was under the impression that it was people with "en_US" locale. What if you're in UK/CA/AU/NZ and running that particular language variant instead of the "correct" one?
    • ti_ranger 7y ago
      > I reached out to Mozilla, and they've confirmed that DoH is being enabled by default only for installations inside US. How do they know? What is the likelihood of them getting it wrong? What protections do they have in place for their geo-location, to ensure that they don't leak unnecessary information when determining whether a user is in the U.S. or not?
  • fmajid 7y ago
    Depends where in the EU. In the UK, DNS snooping by ISPs is universal, and in fact required by law under the pretext of blocking minors' access to porn.
    • throw0101a 7y ago
      > ... in fact required by law under the pretext of blocking minors' access to porn. [citation needed] Which law specifically? I was under the impression that this was currently being done voluntarily by the ISPs so that the government wouldn't start drafting legislation. (I could be wrong; I just want a referenced/definitive answer either way.)
      • tialaramex 7y ago
        Digital Economy Act 2017 http://www.legislation.gov.uk/ukpga/2017/30/contents/enacted http://www.legislation.gov.uk/ukpga/2017/30/contents/enacted The idea was, Porn sites need to obey UK government rules, if they /don't/ (and why would, for example, a Canadian porn site obey those rules?) then a censor (the BBFC that took on this role for video got that job) directs that ISPs should block the offending site using DNS blocks. In practice it keeps getting pushed out because it's hopeless from all angles.
        • throw0101a 7y ago
          I wonder why PICS/POWDER never took off: * https://en.wikipedia.org/wiki/Platform_for_Internet_Content_Selection https://en.wikipedia.org/wiki/Platform_for_Internet_Content_... * https://en.wikipedia.org/wiki/Protocol_for_Web_Description_Resources https://en.wikipedia.org/wiki/Protocol_for_Web_Description_R... Self-labeling could then perhaps help third-party software filter things.
  • wbl 7y ago
    I've got some great news for you: firefox is only doing DoH in the US.
  • magashna 7y ago
    Yet you're still using online resources that are within the 5 eyes.
  • bigiain 7y ago
    > > In practice ISPs are the almost universally reprehensible in how they collect, track, and sell your data > ... in your country. In my country, they are legally required to be reprehensible in those ways... Yay Australia... :-/ (Where I'm pretty sure my VPN use puts me own a list. Another list...)
  • zaarn 7y ago
    If you're in the EU then there is no concern since CF will only be used as a default provider in the US for US users using the US version of Firefox.
  • jillesvangurp 7y ago
    In most countries, including the EU. If you have a laptop and configure your DNS automatically, you are using whatever DNS is configured by hotels, airports, coffee shops, etc. You have no privacy whatsoever when it comes to DNS requests and you have no control over this until you manually configure your DNS (which most users don't even know how to do). The default configuration of laptops is to use whatever they are told to use automatically. In most places the only safe assumption is that multiple nation states are actively monitoring and aggregating every single DNS request you make and the practical reality is that that is actually exactly what happens. The sad reality is that ISPs in most places don't lift a finger to protect the privacy of their users and actively facilitate policing, censoring, and monitoring of their user's DNS traffic; even when they are not required to (which they are in most places). Your trust in them is completely misguided. I live in Germany. I know that my ISP works with the German government to help them censor me accessing certain websites by blocking DNS. I also know that they collaborate with lawyers going after individual p2p users. And I know it has a history of serving advertisements on domains that don't resolve (something I opted out of years ago). I also know DNS traffic data is routinely shared between different nation states and that this practice has little or no oversight. In so far they are not actively sharing data (which they are), they can also be relied apon to be generally incompetent when it comes to operating and securing their infrastructure and you'd have to assume that foreign intelligence agencies have been actively helping themselves to whatever information they can extract that way for decades. If you are wondering, my ISP is O2. I'd switch but Germany has a state protected ISP oligarchy and the other ISPs are not really much better. Mozilla protecting users from their privacy being violated like this by default is a net improvement in most places in the world. Anyone who cares about their privacy enough already configures their DNS manually and probably also uses a VPN and can continue to do so. But for those not capable of figuring this out, this is a massive improvement of their default level of privacy. The status quo for that is that they have none whatsoever in most places when it comes to DNS. It's hard to do worse than that.
    • pergadad 7y ago
      > I know that my ISP works with the German government to help them censor me accessing certain websites by blocking DNS. Citation on o2/Telekom/etc blocking domains? > I also know that they collaborate with lawyers going after individual p2p users. Kind of hard not to do if you're legally obliged. But not per se a privacy violation and not a matter of snooping on content. > And I know it has a history of serving advertisements on domains that don't resolve (something I opted out of years ago). > Ok but again not really a major privacy leak, just stupid/bad/user-hostile practice. > I also know DNS traffic data is routinely shared between different nation states and that this practice has little or no oversight. And who is the main party spying on/in Germany? Snowden leaks tells us the NSA, with active but idiotically unaware cooperation by the BND. So you're giving data directly to a US cloud provider instead.
  • antpls 7y ago
    So I also live in EU and, regarding DNS, I trust NA way more than the ISP of my country. Your local intelligence agency and local ads network can probably way more easily and legally look into the local DNS records of the same country than the records stored on another continent. What's more, I don't mind the USA having my browsing habits because they can't easily use it against me, as EU is a different market. It's all about splitting the data about yourself to different competing entities, rather than trusting only one entity with everything.
• jannes 7y ago
  I would still wait for European DoH to be available (if ever). There's no way I'm sending my entire DNS traffic to the US or a US entity.
  • xref 7y ago
    It will always be configurable for people who deicide they don’t like the defaults, like it has been, currently is, and will be.
    • vetinari 7y ago
      And it is still missing autoconfig mechanism, like the old DHCP DNS setting. Nobody is going to manually reconfigure their resolver every time they change their network.
  • vetinari 7y ago
    Actually, CZ.NIC (the .cz domain registry) runs one. You can find it at https://odvr.nic.cz/doh https://odvr.nic.cz/doh.
• ezoe 7y ago
  Keep in mind that Cloudflare is US company. US government is infamous for secret subpoena and gag orders toward the US companies. Also US government is infamous for serious and illegal spying. They also holding known vulnerabilities information from public for greater good(for them). Practically, no trust.
  • 8note 7y ago
    it's also a business. As soon as they find it advantageous to start selling that information, they will, and will ride on their reputation for privacy to make as much as possible from that information
  • Dirlewanger 7y ago
    There's also no trust with ISPs. They've already all lobbied at the Congressional level to legally sell our data. The NSA already captures/stores everything that comes out of any of their datacenters. So whose DNS do we use? A shitty company's, or another shitty company's?
    • entropicdrifter 7y ago
      >They've already all lobbied at the Congressional level to legally sell our data. And succeeded! And even as they did it and succeeded, claimed that they didn't want or need that ability and /totally/ wouldn't take advantage of it if/when it did pass.
    • ti_ranger 7y ago
      > There's also no trust with ISPs. They've already all lobbied at the Congressional level to legally sell our data. Yes, for you Americans. Please, go fix your politicians, rather than inflicting technical "solutions" to political problems on the rest of the world.
  • mfer 7y ago
    DoH to Cloudflare by default is only happening to US users. Their current DNS options via their ISP are also subject to the US government.
• swiley 7y ago
  > Practice > theory. Every time. No it's not, that kind of attitude is how you end up with people trying to replace the DOM API with sed or awk. In practice there's quite a lot of DOM queries that can be replaced with awk until you need certain things that become very hard. Theory would have warned you about that from the beginning.
  • eloff 7y ago
    I don't even know where to start with this. The idea of using sed or awk instead of the DOM is ridiculous in both theory and practice. All I'm saying is how things are in reality is more important than how things are in theory. I'm curious if you can find an instance where that's not true, but regardless it's a good rule of thumb.
    • dllthomas 7y ago
      How things are in practice matters, but there's risk that you're misreading the situation. Theory can speak not just to how you think it is, but also to how it might be - particularly in security, where hostile actors are trying to change how it is.
• cf141q5325 7y ago
  I am not a US citizen, your practice isnt mine. That also goes for many here and many more of the people who use the internet. I cant trust a US company with my DNS requests because lacking US citizenship or residency I lack any rights or protection whatsoever when it comes to my data. For my local ISP on the other hand, there are clear rules and regulations in place on how they are allowed to use and share my data. I would say i have more trust in my ISP but trust is not the issue here, its jurisdiction. Routing my DNS requests through another jurisdiction where i lack any rights or protection is just a horrible "screw you" to anyone not living in the US. It might be the tinfoil, but looking at this move by Mozilla after disabling addons silently via an out of date cert a few month ago (screwing over every last Tor user in the process) I am hard pressed not to assume malice on their part.
  • captn3m0 7y ago
    DoH by default is only enabled for US right now. They have no plans for further rollouts as of now.
    • vetinari 7y ago
      That means nothing. Last year, it was only experiment. Next year, it might be rolled out for everyone.
    • cf141q5325 7y ago
      I did not know that, thank you very much for the heads up.
• dev_dull 7y ago
  > * In practice ISPs are the almost universally reprehensible in how they collect, track, and sell your data.* This means it would be an enormous leap forward in privacy for vast amounts of people. I never understood the “perfect or nothing” approach to security that manifests itself in circles of the tech elite. Football is won by getting 1st downs, not throwing touchdowns every time.
• CydeWeys 7y ago
  DoH is a vendor-neutral protocol. There are already many DNS providers beyond just Cloudflare offering it, and there's no reason that every existing DNS provider couldn't offer it in the future. DoH is simply DNS transmitted over a secure encrypted medium, whereas existing DNS is transmitted over an insecure unencrypted medium. It's very similar to HTTP vs HTTPS. Somehow, groups that stand to gain a lot by continuing to be able to read and intercept DNS traffic have led a successful astroturfing campaign against DoH by conflating it with one specific implementation in Firefox that happens to use Cloudflare as default provider (though of course with the ability to choose other providers, as you can for search engine). This is not a good argument against DoH in general, for obvious reasons.
  • ti_ranger 7y ago
    > DoH is a vendor-neutral protocol. But there are still gaps regarding discovery of DoH servers. > DoH is simply DNS transmitted over a secure encrypted medium, whereas existing DNS is transmitted over an insecure unencrypted medium. I think you're confusing DoH and DoT. > It's very similar to HTTP vs HTTPS. No, it isn't. 1)It is common to HTTP-redirect to HTTPS, and none of the DoH proponents have proposed/standardised discovery of DoH, as far as I can tell. 2)DoH means that suddenly many "features" of HTTP infect DNS, such as cookies. The RFCs allow for cookies, the question is, what cookies does Mozilla send in DoH requests, and what does Cloudflare do with them? > Somehow, groups that stand to gain a lot by continuing to be able to read and intercept DNS traffic have led a successful astroturfing campaign against DoH by conflating it with one specific implementation in Firefox that happens to use Cloudflare as default provider (though of course with the ability to choose other providers, as you can for search engine). Not only "groups that stand to gain", but users who stand to lose more privacy by exposing their DNS requests to Cloudflare by default. DoH may be good (I think DoT would be better), and surely Mozilla could do a better job of encouraging DoT and/or DoH support by working to get better discovery of DoH and/or DoT instead of forcing all DNS traffic (for users it has identified are in the U.S., and by the way, how does it do that without additional privacy concerns) to a (to me) un-trusted third party. Actually, I think in my country, if they do this, Mozilla would fall afoul of traffic interception laws.
  • yc12340 7y ago
• jiveturkey 7y ago
  This would only be true if your ISP couldn't otherwise violate your privacy. Which they can. That they don't see your DNS requests is an extremely low barrier. They see all the subsequent traffic. Using DoH increases your privacy attack surface, not reduces it.
  • eloff 7y ago
    No, I don't see that. Either way your subsequent unencrypted requests are visible. Your encrypted requests are not. DoH is strictly better.
    • jiveturkey 7y ago
      I think you misunderstand. I'm not talking about the contents of the packets. I'm talking about the IP address destinations. You know -- the part that DNS tells you. The ISP has that info anyway as they transit the traffic for you. DoH is strictly worse.
      • eloff 7y ago
        > I'm talking about the IP address destinations That's true, that will leak either way. > DoH is strictly worse. Still waiting for your argument for how it's worse. The way I see it it's at the very least no worse, but in practice much better for most people. I have an open-mind on the subject, convince me.
        • jiveturkey 7y ago
          I'm confused, because I've already presented my argument. Here it is again: Hiding your DNS requests from the ISP is pointless. The ISP sees where your traffic is going. This the result of those DNS requests. It doesn't matter that they didn't see the actual DNS request; they see what the answer was. They know what sites (DNS addresses) you are visiting. So sending your DNS requests to a 3rd party (multiple ones in the recent RR version proposed!) simply spreads wider the folks that can profile your traffic. As unrelated 3rd parties, those people would otherwise have had no idea where you, private citizen, were sending traffic. Now you have explicitly told them. You have given up privacy, not enhanced it. Please keep in mind, I'm not arguing against DoH wholesale. Just that it is worse for privacy. The primary consensus argument in favor of DoH is about privacy, which is flat out wrong.
• mr__y 7y ago
  >I'd much rather trust Cloudflare than my ISP. And I'd prefer a solution that does not rely on trusting any single entity, irrelevant of how "trustworthy" that entity is.
• mfer 7y ago
  If I understand it right, the current rollout is US only. I know some folks outside the US trust their ISP more than a US company. Right now it appears the rollout isn't hitting you unless you opt in. Mozilla recently clarified this to politicians in Britain [1] US ISPs are all subject to NSL and the US gov the same way Cloudflare is. What's different is privacy. When I'm at a coffee shop or some other place my DNS traffic is normally unencrypted. ISPs have gotten a reputation for doing shady monitoring. This doesn't stop all of it but removes a method to watch things. For US folks the question becomes, do you trust Cloudflare under a special agreement negotiated with Mozilla with a goal of protecting privacy or do you trust your ISP and the ISPs of all the places you connect? For folks outside the US I'd wonder if or when this would come to me. If I'm incorrect on something please let me know. I'm just now learning about the reach and implications. [1] https://www.theregister.co.uk/2019/09/24/mozilla_backtracks_doh_for_uk_users/ https://www.theregister.co.uk/2019/09/24/mozilla_backtracks_...
• JohnFen 7y ago
  > so you can have peace of mind about it You can have peace of mind about it, but I can't.
  • eloff 7y ago
    And your ISP and coffee shop do regular audits? What are you doing for DNS that's so much better right now?
    • JohnFen 7y ago
      The quality of my ISP and coffee shops isn't relevant. I was talking about "peace of mind" when using Cloudflare, not about the alternatives. Even if Cloudflare is the best option, that doesn't automatically mean I can relax about it. That said... Coffee shops or other open WiFi APs don't enter into it, since I use my own VPN server when I'm out and about.
      • xref 7y ago
        So you’re sending your traffic to some other cloud host or your ISP, his question still stands
        • JohnFen 7y ago
          His question is not relevant to my statement, though, so I answered it to the best of my ability without changing subjects: even if Cloudflare is the best available option, that does not mean I can have "peace of mind" about using it.
• parliament32 7y ago
  Cloudflare and their servers are also based in a country where secret court orders can force CF to collect and stream out request logs, lie on their privacy policy, and force "third-party audits" to say everything is OK with basically zero checks and balances. I don't give a triangular fuck if local ISP X is selling DNS statistics to marketing corp Y. If they're getting something useful from the 101 domains every web page load seems to contact nowadays, power to them. But I'm not okay with some shadowy alphabet-soup-esque mire of "public servants" building a profile about me from a conflagration of data sources, and using it against me when they feel like it.
• rocqua 7y ago
  You can still set 1.1.1.1 as your DNS resolve in your DHCP server if you want to trust your ISP. If enough people switch to DoH (as would be needed for DoH by default to have a measurable effect) and the data is even slightly valuable, unscrupulous ISPs could still use SNI, or even just reverse IP lookups to track your movements.
  • ti_ranger 7y ago
    > You can still set 1.1.1.1 as your DNS resolve in your DHCP server if you want to trust your ISP. It's not that I necessarily trust my ISP, I don't want to be forced to also trust Cloudflare (both for privacy and availability). So no, I don't use 1.1.1.1, I run my own recursive name server.
    • rocqua 7y ago
      That also works for avoiding your ISP serving your DNS requests.
      • chopin 7y ago
        I also run my own recursive resolver but this doesn't prevent snooping by the ISP as the recursive requests go through its network.
• snowwrestler 7y ago
  Am I the only one who remembers "Cloudbleed"? I can't understand why people are so eager to trust Cloudflare with more and more of their HTTPS traffic.
  • jgrahamc 7y ago
    I remember it very well and I've written and spoken about it extensively.
• feanaro 7y ago
  Well, you can only trust a third-party audit as much as you trust the third party auditor, which usually isn't very much. What good does it really do that company X, which I know very little about, said that Y does such and such?
• yosefzeev 7y ago
  I just wrote a post yesterday about why you should not, in fact, trust cloudflare. https://www.jbschirtzinger.com/post/doh/ https://www.jbschirtzinger.com/post/doh/
• nullc 7y ago
  Your ISP can see the endpoints you are connecting to regardless. So you get a strict reduction in privacy. Has cloudflare ever gone to court to fight an administrative subpoena? More than a few ISPs have. DoH seems like fine technology. Tying it to cloudflare is kind of shocking, since many technologists have long suspected that cloudflare is regularly being used to intercept traffic.