3 ms·

I'm not sure how I feel about Firefox's strategy for DoH. On the one hand, moving DNS out of the hands of ISPs that (at least in the US) have no real incentive

by thayne 7y ago

I'm not sure how I feel about Firefox's strategy for DoH. On the one hand, moving DNS out of the hands of ISPs that (at least in the US) have no real incentive to respect user privacy is probably a good thing. On the other hand, circumventing the system DNS will cause problems for anyone who has explicitly configured DNS, such as corporate networks, schools, households that use DNS for security/adblocking/parental controls, etc. I realize firefox has some heuristics to try and detect these cases, but heuristics aren't perfect.

tptacek 7y ago
It's probably a good thing? US ISPs actively collect data from DNS lookups. They're an actual according-to-Hoyle threat actor in the IETF's supposed threat model.
- josteink 7y ago
  > It's probably a good thing? US ISPs The world is hella lot bigger than the US. And Firefox runs in the rest of the world too.
  - icebraining 7y ago
    > And Firefox runs in the rest of the world too. But Firefox only enabled DoH by default in the US.
    - catalogia 7y ago
      Is it only enabled in the US, or is it only enabled in the en-US build? How does firefox actually know what country I'm in? If I downloaded firefox in Washington and then drive up into BC, does Firefox disable DoH? How does it know?
  - dictum 7y ago
    It's also a lot bigger than the EU.
dblohm7 7y ago
> circumventing the system DNS will cause problems for anyone who has explicitly configured DNS, such as corporate networks, schools, households that use DNS for security/adblocking/parental controls, etc. This is configurable via group policy.
- thayne 7y ago
  Sure, if all the machines you care about are windows boxes managed with Active Directory. There are ways to configure it on linux and mac too by putting a json file in the firefox installation folder, but it is one more thing IT needs to worry about. I don't know of any IT professional that would be excited at the prospect of having to configure DNS for individual applications.
  - icebraining 7y ago
    They can just configure their internal DNS server to return NXDOMAIN for use-application-dns.net, which is a canary domain that Firefox checks before using DoH: https://support.mozilla.org/en-US/kb/canary-domain-use-application-dnsnet https://support.mozilla.org/en-US/kb/canary-domain-use-appli...
morpheuskafka 7y ago
Enterprise use cases can easily manage this through Group Policy. Households (keep in mind we are only talking about people who knew enough to change DNS settings in the first place) can just change the setting on each of their five or so computers. And if you are using DNS as parental controls, that's not a great solution as nothing stops someone from getting the IPs out of band (ex. a website that does DNS lookups) and connecting directly to the blocked sites.
- vetinari 7y ago
  > Enterprise use cases can easily manage this through Group Policy. That's Windows-only mechanism. > Households (keep in mind we are only talking about people who knew enough to change DNS settings in the first place) can just change the setting on each of their five or so computers. And not forget to do that for every new device they get. And after reinstalls. And occasionally just to be sure, as we know how software tends to "forget" user preferences sometimes. That's all only up until Mozillas' telemetry will show, that nobody changes the default anyway, so the preference will be removed entirely. > And if you are using DNS as parental controls, that's not a great solution as nothing stops someone from getting the IPs out of band (ex. a website that does DNS lookups) and connecting directly to the blocked sites. For the user, it's more complicated than that. He has to persuade the browser to send the right Host header when connecting to the obtained-out-of-band IP address. If you have rights to modify hosts file, you might change the DNS as well and spare the effort.
- thayne 7y ago
  > And if you are using DNS as parental controls, that's not a great solution as nothing stops someone from getting the IPs out of band You are assuming a rather narrow use case for "parental controls". For many people it is less about draconian control and more about not wanting someone (whether a child or the individual themselves) from accidentally stumbling on porn or other unwanted content.

by thayne 7y ago

tptacek 7y ago

It's probably a good thing? US ISPs actively collect data from DNS lookups. They're an actual according-to-Hoyle threat actor in the IETF's supposed threat model.

josteink 7y ago
> It's probably a good thing? US ISPs The world is hella lot bigger than the US. And Firefox runs in the rest of the world too.
- icebraining 7y ago
  > And Firefox runs in the rest of the world too. But Firefox only enabled DoH by default in the US.
  - catalogia 7y ago
    Is it only enabled in the US, or is it only enabled in the en-US build? How does firefox actually know what country I'm in? If I downloaded firefox in Washington and then drive up into BC, does Firefox disable DoH? How does it know?
- dictum 7y ago
  It's also a lot bigger than the EU.

dblohm7 7y ago

> circumventing the system DNS will cause problems for anyone who has explicitly configured DNS, such as corporate networks, schools, households that use DNS for security/adblocking/parental controls, etc. This is configurable via group policy.

thayne 7y ago
Sure, if all the machines you care about are windows boxes managed with Active Directory. There are ways to configure it on linux and mac too by putting a json file in the firefox installation folder, but it is one more thing IT needs to worry about. I don't know of any IT professional that would be excited at the prospect of having to configure DNS for individual applications.
- icebraining 7y ago
  They can just configure their internal DNS server to return NXDOMAIN for use-application-dns.net, which is a canary domain that Firefox checks before using DoH: https://support.mozilla.org/en-US/kb/canary-domain-use-application-dnsnet https://support.mozilla.org/en-US/kb/canary-domain-use-appli...

morpheuskafka 7y ago

Enterprise use cases can easily manage this through Group Policy. Households (keep in mind we are only talking about people who knew enough to change DNS settings in the first place) can just change the setting on each of their five or so computers. And if you are using DNS as parental controls, that's not a great solution as nothing stops someone from getting the IPs out of band (ex. a website that does DNS lookups) and connecting directly to the blocked sites.

vetinari 7y ago
> Enterprise use cases can easily manage this through Group Policy. That's Windows-only mechanism. > Households (keep in mind we are only talking about people who knew enough to change DNS settings in the first place) can just change the setting on each of their five or so computers. And not forget to do that for every new device they get. And after reinstalls. And occasionally just to be sure, as we know how software tends to "forget" user preferences sometimes. That's all only up until Mozillas' telemetry will show, that nobody changes the default anyway, so the preference will be removed entirely. > And if you are using DNS as parental controls, that's not a great solution as nothing stops someone from getting the IPs out of band (ex. a website that does DNS lookups) and connecting directly to the blocked sites. For the user, it's more complicated than that. He has to persuade the browser to send the right Host header when connecting to the obtained-out-of-band IP address. If you have rights to modify hosts file, you might change the DNS as well and spare the effort.
thayne 7y ago
> And if you are using DNS as parental controls, that's not a great solution as nothing stops someone from getting the IPs out of band You are assuming a rather narrow use case for "parental controls". For many people it is less about draconian control and more about not wanting someone (whether a child or the individual themselves) from accidentally stumbling on porn or other unwanted content.