6 ms·
Death to PiHole and every other DNS-based ad block and security system. At least, by Mozilla's plan.
by tbyehl 7y ago
Death to PiHole and every other DNS-based ad block and security system. At least, by Mozilla's plan.
- munchbunny 7y agoIf I get the choice between finding a different way to do DNS based ad blocking and hiding my traffic from ISPs' advertising divisions, I will happily find a new PiHole alternative.
- wbl 7y agoDid you read their plan? Because you can block a certain domain to stop DoH resolution.
- xvector 7y agoWhat’s stopping your PiHole or DMS adblocker from functioning as a MITM proxy? You’d just terminate HTTPS at the PiHole and perform the filtering there, right? Regardless, it’s a tiny thing to give up for more privacy.
- rodgerd 7y agoAh yes, Google and CloudFlare, those well-known bastions of privacy.
- tptacek 7y agoI hate to respond to low-effort snark but will do so here to remind people that Google's plan doesn't default you to Google's servers, will honor your own nameservers, and will upgrade you to DoH if any of those servers support it. It's really hard to see what more you could ask for.
- deleted 7y ago[deleted]
- tbyehl 7y agoRunning a MITM HTTPS proxy means running a CA, means the proxy gets to decide what to do about certificate errors instead of the client, means maintaining a whitelist of sites that can't be MITM'd, means segregating all the devices that I can't put a CA signing certificate on, and is just in general an ugly thing that should be avoided wherever possible. Mozilla's method of implementing this has also created a blueprint for malware to avoid network-level detection. I don't like it. In my view, what's being given up is significant and the privacy gain minimal. (Right now, Mozilla has a DNS-based killswitch, but how long until all the 'bad actors' Mozilla is targeting have implemented it? I know of one public DNS provider already doing that. They'll take away the killswitch, then all the 'bad countries' will force their populations to install MITM certificates [along with the UK] and the world is going to end up worse off thanks to Mozilla)
- xvector 7y agoThanks. I was also thinking... how does DoH prevent an ISP from spying on you? Even though the DNS requests and responses are encrypted, content requests are still routed via the ISP, right? So the ISP still has a log of which IPs you’ve visited. They can resolve this back to site names and get the same information on you they had before. Edit: answer here: https://security.stackexchange.com/questions/200201/how-does-dns-over-tls-prevent-your-isp-from-seeing-the-websites-you-visit https://security.stackexchange.com/questions/200201/how-does...
- shakna 7y agoPiHole supports DoH [0], via the cloudflared daemon. This won't change anything. [0] https://docs.pi-hole.net/guides/dns-over-https/ https://docs.pi-hole.net/guides/dns-over-https/
- dcow 7y agoThis is incorrect. Mozilla is ignoring your os/dhcp configured server and using Cloudflare. Your PiHole no longer sees the traffic. There is a way to configure your network to make Firefox not do this, so that's good. But it's not the default.
- turdnagel 7y agoPeople who bother to set up a PiHole almost certainly know how to change DNS settings on their (and their family members') browsers.
- tomschlick 7y agoThats also false. Mozilla added a canary domain (use-application-dns.net) that if blocked will default to the local dns resolver. There are several threads in the pihole community about blocking it by default so I expect that will be done before mozilla turns int on for the masses.
- Thorrez 7y agoI think there are multiple definitions of "using DoH". I think that guide sets this up: Browser -[regular DNS]-> pihole -[regular DNS]-> cloudflared -[DoH]-> 1.1.1.1 So of the 3 hops, only 1 uses DoH. And specifically, the browser itself doesn't talk DoH.
- morpheuskafka 7y agoCompletely untrue. Those services just need to serve their own DoH endpoint and the user can add it in Firefox preferences. No harder than and arguably easier than the complicated procedure for changing system DNS, and it allows you to block things in your browser that you may not want blocked at the system level for all users.
- tptacek 7y agoIf your PiHole servers a DoH endpoint, you're probably back to exposing plaintext DNS to your ISP. The whole point of DoH is to tunnel DNS out of your untrusted ISP network to anywhere else in the world where it can be trusted more. What is the case, however, is that you could set up a DoH endpoint on some other network and route your DNS there.
- cyphar 7y agoWhy can't the PiHole create it's own DoH connection upstream? Y'know, the most classic way of doing a MitM on encrypted traffic?
- tptacek 7y agoOh, it totally can, and there's nothing wrong with that. I would just hate for someone to terminate DoH on their home network and expose direct-to-the-roots DNS to their ISP, which is, if anything, marginally more attributable than normal ISP DNS. I'm definitely not talking down the idea of doing a PiHole setup.
- eikenberry 7y agoI don't get why you'd think direct to the root DNS servers would be worse than using your ISPs servers. Using the root servers means you get DNSSEC which would prevent the greatest threats, hijacking and injection.
- tptacek 7y ago
- jbotz 7y agoFork.