6 ms·
“For most users, it’s very hard to know where their DNS requests go and what the resolver is doing with them.” said Eric Rescorla, Firefox CTO. “Firefox’s Trust
by 3xblah 7y ago
“For most users, it’s very hard to know where their DNS requests go and what the resolver is doing with them.” said Eric Rescorla, Firefox CTO. “Firefox’s Trusted Recursive Resolver program allows Mozilla to negotiate with providers on your behalf and require that they have strong privacy policies before handling your DNS data. We’re excited to have NextDNS partner with us in our work to put people back in control of their data and privacy online.”
It sounds more like the work is to put Mozilla and their partners in control of users' data and privacy online.
Let's be honest. This is really a transfer of control from one third party, e.g., a company providing internet service (ISP), to another third party, e.g., a company/organization providing a browser (Mozilla, Google, etc.), not to mention their "TRR" partners.
Surely it is only a fortuitous coincidence, but DOH in the browser makes it easier to track users by device, which appears to be the Holy Grail of the internet ad industry.
Putting Mozilla (and their partners) in charge of user privacy is different from putting users in charge of their own privacy.
Also, the "back in control" language is interesting. It implies the author believes users were "in control" in the past.
- fabrice_d 7y agoIt's about trust: would you rather trust your ISP, or Mozilla's choice of DoH partners? Users never really had a reasonable (ie. non geek) opportunity to be in charge of their DNS privacy, and for most it's not something they can be bothered with.
- davidu 7y agoThis is the wrong dichotomy and it's a false one perpetuated by Mozilla. Users can have end to end encrypted DNS and browsers shouldn't be hijacking it. To put it another way, you don't want the people who only care about eyeballs (Google, Mozilla, etc.) picking your DNS provider.
- icebraining 7y agoSo disable DoH in Firefox, or change the provider? If you know enough to choose a DoH provider, the browser defaults are not very relevant, presumably.
- Karunamon 7y agoThat's great for the handful of people that read Hacker News and understand DNS, it's a trash solution for the rest of the world. Defaults matter because they are rarely changed.
- 7786655 7y agoRight now the defaults are unencrypted DNS handled by ISPs which in the US have explicit legal permission to sell your data.
- deleted 7y ago[deleted]
- devit 7y agoProbably the ISP, since it already has a working business model unrelated to selling your DNS query data and doing so is probably illegal in several countries.
- heavyset_go 7y agoIf you're in the US, read your ISP's privacy policy sometime: part of their business model involves selling the data about the sites you visit.
- sciurus 7y agoThe terms of the Trusted Recursive Resolver program explicitly disallow selling your DNS query data. > Your DNS data can reveal a lot of sensitive information about you, and currently DNS providers aren’t subject to any limits on what they can do with that data; we want to change that. Our policy requires that your data will only be used for the purpose of operating the service, must not be retained for longer than 24 hours, and cannot be sold, shared, or licensed to other parties. https://blog.mozilla.org/netpolicy/2019/12/09/trusted-recursive-resolvers-protecting-your-privacy-with-policy-technology/ https://blog.mozilla.org/netpolicy/2019/12/09/trusted-recurs... https://wiki.mozilla.org/Security/DOH-resolver-policy https://wiki.mozilla.org/Security/DOH-resolver-policy (Disclosure: I work for Mozilla, but not on this)
- 3xblah 7y agoNextDNS purports to be a DNS provider that will use public blocklists and filter queries and block ads and tracking like a PiHole. The Mozilla TRR policy states that the DNS provider must not filter any queries unless the user explicitly opts-in. How would a user selecting NextDNS as a TRR indicate that she wants NextDNS to filter queries in order to block ads and tracking. The TRR policy also states that the provider must not use the EDNS Client Subnet extension. It looks like NextDNS does use some modified version of ECS, at least in its plaintext DNS service. The FAQ states users can submit a query with class CHAOS instead of IN to get some diagnostics, e.g., drill -t example.com @45.90.28.0 a chaos Unfortunately, someone who ISP is filtering port 53 cannot make this query.
- 7y ago
- fiysp 7y agoMy ISP, since I have a contract with them, I can switch to another ISP anytime, and they are bound to lots of data protection laws. On the other hand, the Mozilla Corporation clearly is desperate to find alternate sources of funding.
- gpm 7y agoOften, I don't have a contract with my ISP. Since my ISP is a random coffee shop, the public transit provider, or so on.
- type0 7y agoYou should be using a VPN in a random coffee shop anyway, not that I particularly like how falsely advertised those are, and their security (Nord cough cough), still it's usually better than nothing.
- gpm 7y agoIt doesn't matter what I should do, it matters what a random firefox user who finds themselves in a coffee shop is doing. Some of the public transit I've been on disagrees strongly with VPNs because they do heavy traffic shaping and VPNs fall into the "make this really slow" category. Reasonably so. I also disagree with this advice. For myself and the vast majority of people $5/month is not worth it for the negligible difference in security and privacy over https, and DNS over https. This becomes even more true with encrypted SNI. In fact, a VPN is largely worse privacy wise because "random coffee shop internet with random MAC address" is pretty anonymous unless you sign into anything over http.
- tptacek 7y agoYou have a contract with your ISP not to collect and monetize your DNS queries to their DNS servers? Are you in the US on a mainstream ISP? If so, you surely do not, unlike with the Mozilla TRR program, where you in fact do.
- Aaargh20318 7y ago
- stiray 7y agoI am mozillas diehard fan as firefox goes but I DO NOT trust them. I still remember some company with best search engine that got vapirised over the years and I am not prepared to trust anyone. Mozilla has some shady practices with their "research add-ons" and I am blocking their domains from firefox and using another browser to download addons. And I will surely not allow some firm in a country with vague laws allow to do all my name resolution. Not to mozilla, not to google, not to cloudflare or anyone else (currently running unbind with caching on huge list of DNSs all over EU in random order). ISP? They are obligated to follow the law in my country. Spying on its user would make it a criminal offense investigation, potentionally bringing their management behind bars. No, they wont even try, it is too dangerous for them. I trust my ISP way more than mozilla. Based on law in my country. It is not DNS system to change (actually it is but convincing me that adding ssl layer on top of highly efficient protocol is worse than rolling everything trough https and changing all existing systems? I'll pass, sounds like a complex solution for simple non-problem, I am sick of looking on those in last decade), it is a law in YOUR country that allows your ISPs to spy on users and this is something that needs to change.
- dessant 7y agoI think the endgame is to route everything through Tor or a similar anonymizing layer, nothing else will suffice in the face of pervasive tracking. Incidentally, Mozilla is showing interest in embedding Tor in Firefox [1], but they haven't yet publicly commited to it [2]. [1] https://www.zdnet.com/article/mozilla-offers-research-grant-for-a-way-to-embed-tor-inside-firefox/ https://www.zdnet.com/article/mozilla-offers-research-grant-... [2] https://www.techradar.com/news/firefox-isnt-getting-a-tor-private-browsing-mode-just-yet https://www.techradar.com/news/firefox-isnt-getting-a-tor-pr...
- userbinator 7y agoAlso, the "back in control" language is interesting. It implies the author believes users were "in control" in the past. The "putting users in control" phrasing is classic Mozilla doublespeak marketing; Mozilla wants you to think Firefox is the only web browser under your complete control, when a look at their bug tracker and their reaction to all the changes that users have vehemently opposed shows the complete opposite --- a small number of Mozilla employees are the ones making all the decisions. Maybe their interests align better with yours, but they are just as authoritarian-control-freaks as all the other big browser vendors (or indeed, it seems all software companies in general these days.) DoH behaves like only tunneling DNS over a VPN, and I wouldn't mind Mozilla working on VPN software, but IMHO something like that should really be a separate product (and one that not only their browser can use --- like most other VPN clients in general.)
- Eiriksmal 7y agoI didn't fully understand the cognitive dissonance and Orwellian doublespeak going on in Mozilla until I began researching the jabs n-gate's author embeds into everything he writes concerning the company. Beacons, Google's Safe Browsing lists, etc.: None of those defaults line up the company's actions with its branding. With Firefox 69, they broke 25% of the internet on Linux with a change to block what they call a MITM attack: Corporations and anti-virus software that add certificates to your computer to decrypt SSL traffic before passing it on to you. That's privacy-focused, I suppose?, but is a confusing change in comparison to more obvious victories such as blocking trackers and fingerprinters by default. Which they will certainly never do... until Google invents a technology that provides the same functionality with a different, less ominous name than "browser fingerprinting."
- deleted 7y ago[deleted]
- Eiriksmal 7y agoI could never think of why Mozilla and friends are so aggressively pushing DoH, but I think you nailed it when you pointed out they can tie a specific device's DNS requests to its other data. I run Unbound and Pi-Hole to do my own recursive resolving. Like a normal wireless router doing all the DNS lookups for its DHCP clients, Mozilla has no idea which particular device on my network is accessing duckduckgo.com. Once each browser happily sends requests to Mozilla, then on to NextDNS, there's a whole lot more data suddenly available to commingle in a data lake... The efficacy of browser fingerprinting means they won't even need cookies to distinguish between devices in those HTTP headers. As far as I know, good ol' Insight Communications (then Time Warner, now Spectrum) made money from selling me access to its high-speed internet service, and running ads on failed-to-find-your-website DNS hijacks. Heck, most of its money probably came from upselling people to buy bundled VoIP landlines and premium cable packages--whatever tiny slice of revenue came from those lookups surely pales in comparison to tens of thousands of unused phone subscriptions. For all the commenters here who think that Google and the other major tech companies are somehow more trustworthy than your ISP? Yeah, I just can't agree with those opinions. Edit: Less trustworthy should have been more trustworthy.
- stock_toaster 7y ago> For all the commenters here who think that Google and the other major tech companies are somehow less trustworthy than your ISP? Yeah, I just can't agree with those opinions. Additionally, at least my ISP is doing business in my state/country, so there may be _some_ legal recourse if they screw me too hard.