43 ms·

> In practice ISPs are the almost universally reprehensible in how they collect, track, and sell your data ... in your country. For me it's the other way arou

> In practice ISPs are the almost universally reprehensible in how they collect, track, and sell your data ... in your country. For me it's the other way around; i'd rather trust my ISP because privacy laws in my country/EU are much better vs the US. I interpret the move by Mozilla as hostile in regards of privacy, and i can't understand why EU politics don't intervene when a US company starts hijacking all Firefox users DNS requests (opt-out instead of opt-in.)

the8472 7y ago
> and i can't understand why EU politics don't intervene Maybe it is as simple as nobody having filed a complaint with a data protection agency yet.
- jannes 7y ago
  Interesting question... How would I file a complaint against Mozilla? Their privacy policy is only available in English and lists Mozilla Corporation in Mountain View as the legal entity. They probably don't conduct many business activities in the EU. However, it looks like they are providing a website for "data subject access requests" which means they might fall under EU regulation as it sounds like a GDPR compliance thing. https://app.onetrust.com/app/#/webform/4ba08202-2ede-4934-a89e-f0b0870f95f0 https://app.onetrust.com/app/#/webform/4ba08202-2ede-4934-a8...
- mfer 7y ago
  Maybe because the rollout of DoH by default doesn't include the EU. https://www.theregister.co.uk/2019/09/24/mozilla_backtracks_doh_for_uk_users/ https://www.theregister.co.uk/2019/09/24/mozilla_backtracks_... It looks like they are exploring how to handle things in the EU and looking for partners there.
pingyong 7y ago
The Cloudflare DNS servers you connect to are in the EU and are subject to EU regulation just like your ISP. You don't have 11 ms (or anything sub-~90 ms) latency to the US. One thing to consider also is that unencrypted DNS means that virtually anyone can read (and modify) those requests, not just your ISP. That can be before the data enters your ISPs network, or at any point that isn't physically or technically well protected. Or, in the case of state actors, at any point really.
- judge2020 7y ago
  > or at any point that isn't physically or technically well protected Kind of off topic, but I was wondering if ISPs use any encryption whatsoever between the home and their IX/servers. Could you theoretically attach something to the wire in the ground, or monitor a satellite-based internet signal, and observe the HTTP/unencrypted data?
  - missosoup 7y ago
    There's no additional encryption layer if that's what you're asking. There will still be multiplexing and whatnot, but if you can recover a particular stream from that, it'll be the same stream that the endpoints see.
    - Hikikomori 7y ago
      There is macsec, probably not that common but the ISP I was working for was looking to implement it in their network. Multiplexing on what?
      - tialaramex 7y ago
        > Multiplexing on what? Light. Optical fibres can move _way_ more data than actual households need, so you use one fibre to move data for, say, 16 endpoints until you get closer, and split it later, saving the cost of 15 long fibres. You can do everything so that there are no active components out in the field where it's annoying except at the customer site, a passive splitter is quite capable of shoving frequencies A-A' to Alice, B-B' to Bob and so on, it's not just solid state it's completely passive, no more likely to need maintenance than, say, the fibre itself.
        Hikikomori 7y ago
        Not sure how that is relevant to OP's question then. You're describing PON, ONT-OLT communication is typically encrypted as well which makes the response make even less sense. Wouldn't say that the cost benefits are from that, majority of the cost is going to be from putting fibre into the ground or on poles, same cost for 1 or 200 pairs. The real benefit is that you don't need any active equipment like in an ethernet distribution network.
Kuinox 7y ago
In EU the ISP are forced to use lying DNS to block websites.
- rocqua 7y ago
  AFAIK the piratebay block works at more than the DNS level. As in, navigating to the correct IP still gets you blocked.
  - Avamander 7y ago
    Depends on the country. The Internet freedom index talks about what each country limits, not all do in any significant manner.
- throw0101a 7y ago
  First, these things are generally country specific. Is there an EU Directive that makes it continent-wide? Second, given countries in the EU are fairly democratic, this is done via acceptance of the voting public because they elected the representatives. They can always have the law changed if they don't like it.
- zajio1am 7y ago
  In Czechia, ISPs are forced to block certain websites, but exact method is not speficied. Today, they just block it on DNS level, as that is simplest and effective enough (although easy to circumvent). If ordinary users were using DoH, then ISPs would be forced to use IP based blocking
  - throw0101a 7y ago
    This was one of the concerns brought up at the UKNOG panel: Currently there is DNS blocking (e.g. gambling sites in Poland), and it handles most cases. If (too many?) people start circumventing that, will a government start insisting on more invasive measure (e.g., DPI)?
    - tialaramex 7y ago
captn3m0 7y ago
I reached out to Mozilla, and they've confirmed that DoH is being enabled by default only for installations inside US. So, if you are in the EU, Firefox won't switch you to DoH. You can still enable it if you wish, but your DNS queries will reach your local resolver unless you change it.
- throw0101a 7y ago
  I was under the impression that it was people with "en_US" locale. What if you're in UK/CA/AU/NZ and running that particular language variant instead of the "correct" one?
- ti_ranger 7y ago
  > I reached out to Mozilla, and they've confirmed that DoH is being enabled by default only for installations inside US. How do they know? What is the likelihood of them getting it wrong? What protections do they have in place for their geo-location, to ensure that they don't leak unnecessary information when determining whether a user is in the U.S. or not?
fmajid 7y ago
Depends where in the EU. In the UK, DNS snooping by ISPs is universal, and in fact required by law under the pretext of blocking minors' access to porn.
- throw0101a 7y ago
  > ... in fact required by law under the pretext of blocking minors' access to porn. [citation needed] Which law specifically? I was under the impression that this was currently being done voluntarily by the ISPs so that the government wouldn't start drafting legislation. (I could be wrong; I just want a referenced/definitive answer either way.)
  - tialaramex 7y ago
    Digital Economy Act 2017 http://www.legislation.gov.uk/ukpga/2017/30/contents/enacted http://www.legislation.gov.uk/ukpga/2017/30/contents/enacted The idea was, Porn sites need to obey UK government rules, if they /don't/ (and why would, for example, a Canadian porn site obey those rules?) then a censor (the BBFC that took on this role for video got that job) directs that ISPs should block the offending site using DNS blocks. In practice it keeps getting pushed out because it's hopeless from all angles.
    - throw0101a 7y ago
      I wonder why PICS/POWDER never took off: * https://en.wikipedia.org/wiki/Platform_for_Internet_Content_Selection https://en.wikipedia.org/wiki/Platform_for_Internet_Content_... * https://en.wikipedia.org/wiki/Protocol_for_Web_Description_Resources https://en.wikipedia.org/wiki/Protocol_for_Web_Description_R... Self-labeling could then perhaps help third-party software filter things.
wbl 7y ago
I've got some great news for you: firefox is only doing DoH in the US.
magashna 7y ago
Yet you're still using online resources that are within the 5 eyes.
bigiain 7y ago
> > In practice ISPs are the almost universally reprehensible in how they collect, track, and sell your data > ... in your country. In my country, they are legally required to be reprehensible in those ways... Yay Australia... :-/ (Where I'm pretty sure my VPN use puts me own a list. Another list...)
zaarn 7y ago
If you're in the EU then there is no concern since CF will only be used as a default provider in the US for US users using the US version of Firefox.
jillesvangurp 7y ago
In most countries, including the EU. If you have a laptop and configure your DNS automatically, you are using whatever DNS is configured by hotels, airports, coffee shops, etc. You have no privacy whatsoever when it comes to DNS requests and you have no control over this until you manually configure your DNS (which most users don't even know how to do). The default configuration of laptops is to use whatever they are told to use automatically. In most places the only safe assumption is that multiple nation states are actively monitoring and aggregating every single DNS request you make and the practical reality is that that is actually exactly what happens. The sad reality is that ISPs in most places don't lift a finger to protect the privacy of their users and actively facilitate policing, censoring, and monitoring of their user's DNS traffic; even when they are not required to (which they are in most places). Your trust in them is completely misguided. I live in Germany. I know that my ISP works with the German government to help them censor me accessing certain websites by blocking DNS. I also know that they collaborate with lawyers going after individual p2p users. And I know it has a history of serving advertisements on domains that don't resolve (something I opted out of years ago). I also know DNS traffic data is routinely shared between different nation states and that this practice has little or no oversight. In so far they are not actively sharing data (which they are), they can also be relied apon to be generally incompetent when it comes to operating and securing their infrastructure and you'd have to assume that foreign intelligence agencies have been actively helping themselves to whatever information they can extract that way for decades. If you are wondering, my ISP is O2. I'd switch but Germany has a state protected ISP oligarchy and the other ISPs are not really much better. Mozilla protecting users from their privacy being violated like this by default is a net improvement in most places in the world. Anyone who cares about their privacy enough already configures their DNS manually and probably also uses a VPN and can continue to do so. But for those not capable of figuring this out, this is a massive improvement of their default level of privacy. The status quo for that is that they have none whatsoever in most places when it comes to DNS. It's hard to do worse than that.
- pergadad 7y ago
  > I know that my ISP works with the German government to help them censor me accessing certain websites by blocking DNS. Citation on o2/Telekom/etc blocking domains? > I also know that they collaborate with lawyers going after individual p2p users. Kind of hard not to do if you're legally obliged. But not per se a privacy violation and not a matter of snooping on content. > And I know it has a history of serving advertisements on domains that don't resolve (something I opted out of years ago). > Ok but again not really a major privacy leak, just stupid/bad/user-hostile practice. > I also know DNS traffic data is routinely shared between different nation states and that this practice has little or no oversight. And who is the main party spying on/in Germany? Snowden leaks tells us the NSA, with active but idiotically unaware cooperation by the BND. So you're giving data directly to a US cloud provider instead.
antpls 7y ago
So I also live in EU and, regarding DNS, I trust NA way more than the ISP of my country. Your local intelligence agency and local ads network can probably way more easily and legally look into the local DNS records of the same country than the records stored on another continent. What's more, I don't mind the USA having my browsing habits because they can't easily use it against me, as EU is a different market. It's all about splitting the data about yourself to different competing entities, rather than trusting only one entity with everything.

the8472 7y ago

> and i can't understand why EU politics don't intervene Maybe it is as simple as nobody having filed a complaint with a data protection agency yet.

jannes 7y ago
Interesting question... How would I file a complaint against Mozilla? Their privacy policy is only available in English and lists Mozilla Corporation in Mountain View as the legal entity. They probably don't conduct many business activities in the EU. However, it looks like they are providing a website for "data subject access requests" which means they might fall under EU regulation as it sounds like a GDPR compliance thing. https://app.onetrust.com/app/#/webform/4ba08202-2ede-4934-a89e-f0b0870f95f0 https://app.onetrust.com/app/#/webform/4ba08202-2ede-4934-a8...
mfer 7y ago
Maybe because the rollout of DoH by default doesn't include the EU. https://www.theregister.co.uk/2019/09/24/mozilla_backtracks_doh_for_uk_users/ https://www.theregister.co.uk/2019/09/24/mozilla_backtracks_... It looks like they are exploring how to handle things in the EU and looking for partners there.

pingyong 7y ago

The Cloudflare DNS servers you connect to are in the EU and are subject to EU regulation just like your ISP. You don't have 11 ms (or anything sub-~90 ms) latency to the US. One thing to consider also is that unencrypted DNS means that virtually anyone can read (and modify) those requests, not just your ISP. That can be before the data enters your ISPs network, or at any point that isn't physically or technically well protected. Or, in the case of state actors, at any point really.

judge2020 7y ago
> or at any point that isn't physically or technically well protected Kind of off topic, but I was wondering if ISPs use any encryption whatsoever between the home and their IX/servers. Could you theoretically attach something to the wire in the ground, or monitor a satellite-based internet signal, and observe the HTTP/unencrypted data?
- missosoup 7y ago
  There's no additional encryption layer if that's what you're asking. There will still be multiplexing and whatnot, but if you can recover a particular stream from that, it'll be the same stream that the endpoints see.
  - Hikikomori 7y ago
    There is macsec, probably not that common but the ISP I was working for was looking to implement it in their network. Multiplexing on what?
    - tialaramex 7y ago
      > Multiplexing on what? Light. Optical fibres can move _way_ more data than actual households need, so you use one fibre to move data for, say, 16 endpoints until you get closer, and split it later, saving the cost of 15 long fibres. You can do everything so that there are no active components out in the field where it's annoying except at the customer site, a passive splitter is quite capable of shoving frequencies A-A' to Alice, B-B' to Bob and so on, it's not just solid state it's completely passive, no more likely to need maintenance than, say, the fibre itself.
      - Hikikomori 7y ago
        Not sure how that is relevant to OP's question then. You're describing PON, ONT-OLT communication is typically encrypted as well which makes the response make even less sense. Wouldn't say that the cost benefits are from that, majority of the cost is going to be from putting fibre into the ground or on poles, same cost for 1 or 200 pairs. The real benefit is that you don't need any active equipment like in an ethernet distribution network.

Kuinox 7y ago

In EU the ISP are forced to use lying DNS to block websites.

rocqua 7y ago
AFAIK the piratebay block works at more than the DNS level. As in, navigating to the correct IP still gets you blocked.
- Avamander 7y ago
  Depends on the country. The Internet freedom index talks about what each country limits, not all do in any significant manner.
throw0101a 7y ago
First, these things are generally country specific. Is there an EU Directive that makes it continent-wide? Second, given countries in the EU are fairly democratic, this is done via acceptance of the voting public because they elected the representatives. They can always have the law changed if they don't like it.
zajio1am 7y ago
In Czechia, ISPs are forced to block certain websites, but exact method is not speficied. Today, they just block it on DNS level, as that is simplest and effective enough (although easy to circumvent). If ordinary users were using DoH, then ISPs would be forced to use IP based blocking
- throw0101a 7y ago
  This was one of the concerns brought up at the UKNOG panel: Currently there is DNS blocking (e.g. gambling sites in Poland), and it handles most cases. If (too many?) people start circumventing that, will a government start insisting on more invasive measure (e.g., DPI)?
  - tialaramex 7y ago

captn3m0 7y ago

I reached out to Mozilla, and they've confirmed that DoH is being enabled by default only for installations inside US. So, if you are in the EU, Firefox won't switch you to DoH. You can still enable it if you wish, but your DNS queries will reach your local resolver unless you change it.

throw0101a 7y ago
I was under the impression that it was people with "en_US" locale. What if you're in UK/CA/AU/NZ and running that particular language variant instead of the "correct" one?
ti_ranger 7y ago
> I reached out to Mozilla, and they've confirmed that DoH is being enabled by default only for installations inside US. How do they know? What is the likelihood of them getting it wrong? What protections do they have in place for their geo-location, to ensure that they don't leak unnecessary information when determining whether a user is in the U.S. or not?

fmajid 7y ago

Depends where in the EU. In the UK, DNS snooping by ISPs is universal, and in fact required by law under the pretext of blocking minors' access to porn.

throw0101a 7y ago
> ... in fact required by law under the pretext of blocking minors' access to porn. [citation needed] Which law specifically? I was under the impression that this was currently being done voluntarily by the ISPs so that the government wouldn't start drafting legislation. (I could be wrong; I just want a referenced/definitive answer either way.)
- tialaramex 7y ago
  Digital Economy Act 2017 http://www.legislation.gov.uk/ukpga/2017/30/contents/enacted http://www.legislation.gov.uk/ukpga/2017/30/contents/enacted The idea was, Porn sites need to obey UK government rules, if they /don't/ (and why would, for example, a Canadian porn site obey those rules?) then a censor (the BBFC that took on this role for video got that job) directs that ISPs should block the offending site using DNS blocks. In practice it keeps getting pushed out because it's hopeless from all angles.
  - throw0101a 7y ago
    I wonder why PICS/POWDER never took off: * https://en.wikipedia.org/wiki/Platform_for_Internet_Content_Selection https://en.wikipedia.org/wiki/Platform_for_Internet_Content_... * https://en.wikipedia.org/wiki/Protocol_for_Web_Description_Resources https://en.wikipedia.org/wiki/Protocol_for_Web_Description_R... Self-labeling could then perhaps help third-party software filter things.

wbl 7y ago

I've got some great news for you: firefox is only doing DoH in the US.

magashna 7y ago

Yet you're still using online resources that are within the 5 eyes.

bigiain 7y ago

> > In practice ISPs are the almost universally reprehensible in how they collect, track, and sell your data > ... in your country. In my country, they are legally required to be reprehensible in those ways... Yay Australia... :-/ (Where I'm pretty sure my VPN use puts me own a list. Another list...)

zaarn 7y ago

If you're in the EU then there is no concern since CF will only be used as a default provider in the US for US users using the US version of Firefox.

jillesvangurp 7y ago

In most countries, including the EU. If you have a laptop and configure your DNS automatically, you are using whatever DNS is configured by hotels, airports, coffee shops, etc. You have no privacy whatsoever when it comes to DNS requests and you have no control over this until you manually configure your DNS (which most users don't even know how to do). The default configuration of laptops is to use whatever they are told to use automatically. In most places the only safe assumption is that multiple nation states are actively monitoring and aggregating every single DNS request you make and the practical reality is that that is actually exactly what happens. The sad reality is that ISPs in most places don't lift a finger to protect the privacy of their users and actively facilitate policing, censoring, and monitoring of their user's DNS traffic; even when they are not required to (which they are in most places). Your trust in them is completely misguided. I live in Germany. I know that my ISP works with the German government to help them censor me accessing certain websites by blocking DNS. I also know that they collaborate with lawyers going after individual p2p users. And I know it has a history of serving advertisements on domains that don't resolve (something I opted out of years ago). I also know DNS traffic data is routinely shared between different nation states and that this practice has little or no oversight. In so far they are not actively sharing data (which they are), they can also be relied apon to be generally incompetent when it comes to operating and securing their infrastructure and you'd have to assume that foreign intelligence agencies have been actively helping themselves to whatever information they can extract that way for decades. If you are wondering, my ISP is O2. I'd switch but Germany has a state protected ISP oligarchy and the other ISPs are not really much better. Mozilla protecting users from their privacy being violated like this by default is a net improvement in most places in the world. Anyone who cares about their privacy enough already configures their DNS manually and probably also uses a VPN and can continue to do so. But for those not capable of figuring this out, this is a massive improvement of their default level of privacy. The status quo for that is that they have none whatsoever in most places when it comes to DNS. It's hard to do worse than that.

pergadad 7y ago
> I know that my ISP works with the German government to help them censor me accessing certain websites by blocking DNS. Citation on o2/Telekom/etc blocking domains? > I also know that they collaborate with lawyers going after individual p2p users. Kind of hard not to do if you're legally obliged. But not per se a privacy violation and not a matter of snooping on content. > And I know it has a history of serving advertisements on domains that don't resolve (something I opted out of years ago). > Ok but again not really a major privacy leak, just stupid/bad/user-hostile practice. > I also know DNS traffic data is routinely shared between different nation states and that this practice has little or no oversight. And who is the main party spying on/in Germany? Snowden leaks tells us the NSA, with active but idiotically unaware cooperation by the BND. So you're giving data directly to a US cloud provider instead.

antpls 7y ago

So I also live in EU and, regarding DNS, I trust NA way more than the ISP of my country. Your local intelligence agency and local ads network can probably way more easily and legally look into the local DNS records of the same country than the records stored on another continent. What's more, I don't mind the USA having my browsing habits because they can't easily use it against me, as EU is a different market. It's all about splitting the data about yourself to different competing entities, rather than trusting only one entity with everything.