4 ms·

It's about trust: would you rather trust your ISP, or Mozilla's choice of DoH partners? Users never really had a reasonable (ie. non geek) opportunity to be in

It's about trust: would you rather trust your ISP, or Mozilla's choice of DoH partners? Users never really had a reasonable (ie. non geek) opportunity to be in charge of their DNS privacy, and for most it's not something they can be bothered with.

davidu 7y ago
This is the wrong dichotomy and it's a false one perpetuated by Mozilla. Users can have end to end encrypted DNS and browsers shouldn't be hijacking it. To put it another way, you don't want the people who only care about eyeballs (Google, Mozilla, etc.) picking your DNS provider.
- icebraining 7y ago
  So disable DoH in Firefox, or change the provider? If you know enough to choose a DoH provider, the browser defaults are not very relevant, presumably.
  - Karunamon 7y ago
    That's great for the handful of people that read Hacker News and understand DNS, it's a trash solution for the rest of the world. Defaults matter because they are rarely changed.
    - 7786655 7y ago
      Right now the defaults are unencrypted DNS handled by ISPs which in the US have explicit legal permission to sell your data.
      - deleted 7y ago
        [deleted]
devit 7y ago
Probably the ISP, since it already has a working business model unrelated to selling your DNS query data and doing so is probably illegal in several countries.
- heavyset_go 7y ago
  If you're in the US, read your ISP's privacy policy sometime: part of their business model involves selling the data about the sites you visit.
- sciurus 7y ago
  The terms of the Trusted Recursive Resolver program explicitly disallow selling your DNS query data. > Your DNS data can reveal a lot of sensitive information about you, and currently DNS providers aren’t subject to any limits on what they can do with that data; we want to change that. Our policy requires that your data will only be used for the purpose of operating the service, must not be retained for longer than 24 hours, and cannot be sold, shared, or licensed to other parties. https://blog.mozilla.org/netpolicy/2019/12/09/trusted-recursive-resolvers-protecting-your-privacy-with-policy-technology/ https://blog.mozilla.org/netpolicy/2019/12/09/trusted-recurs... https://wiki.mozilla.org/Security/DOH-resolver-policy https://wiki.mozilla.org/Security/DOH-resolver-policy (Disclosure: I work for Mozilla, but not on this)
  - 3xblah 7y ago
    NextDNS purports to be a DNS provider that will use public blocklists and filter queries and block ads and tracking like a PiHole. The Mozilla TRR policy states that the DNS provider must not filter any queries unless the user explicitly opts-in. How would a user selecting NextDNS as a TRR indicate that she wants NextDNS to filter queries in order to block ads and tracking. The TRR policy also states that the provider must not use the EDNS Client Subnet extension. It looks like NextDNS does use some modified version of ECS, at least in its plaintext DNS service. The FAQ states users can submit a query with class CHAOS instead of IN to get some diagnostics, e.g., drill -t example.com @45.90.28.0 a chaos Unfortunately, someone who ISP is filtering port 53 cannot make this query.
- 7y ago
fiysp 7y ago
My ISP, since I have a contract with them, I can switch to another ISP anytime, and they are bound to lots of data protection laws. On the other hand, the Mozilla Corporation clearly is desperate to find alternate sources of funding.
- gpm 7y ago
  Often, I don't have a contract with my ISP. Since my ISP is a random coffee shop, the public transit provider, or so on.
  - type0 7y ago
    You should be using a VPN in a random coffee shop anyway, not that I particularly like how falsely advertised those are, and their security (Nord cough cough), still it's usually better than nothing.
    - gpm 7y ago
      It doesn't matter what I should do, it matters what a random firefox user who finds themselves in a coffee shop is doing. Some of the public transit I've been on disagrees strongly with VPNs because they do heavy traffic shaping and VPNs fall into the "make this really slow" category. Reasonably so. I also disagree with this advice. For myself and the vast majority of people $5/month is not worth it for the negligible difference in security and privacy over https, and DNS over https. This becomes even more true with encrypted SNI. In fact, a VPN is largely worse privacy wise because "random coffee shop internet with random MAC address" is pretty anonymous unless you sign into anything over http.
- tptacek 7y ago
  You have a contract with your ISP not to collect and monetize your DNS queries to their DNS servers? Are you in the US on a mainstream ISP? If so, you surely do not, unlike with the Mozilla TRR program, where you in fact do.
  - Aaargh20318 7y ago
stiray 7y ago
I am mozillas diehard fan as firefox goes but I DO NOT trust them. I still remember some company with best search engine that got vapirised over the years and I am not prepared to trust anyone. Mozilla has some shady practices with their "research add-ons" and I am blocking their domains from firefox and using another browser to download addons. And I will surely not allow some firm in a country with vague laws allow to do all my name resolution. Not to mozilla, not to google, not to cloudflare or anyone else (currently running unbind with caching on huge list of DNSs all over EU in random order). ISP? They are obligated to follow the law in my country. Spying on its user would make it a criminal offense investigation, potentionally bringing their management behind bars. No, they wont even try, it is too dangerous for them. I trust my ISP way more than mozilla. Based on law in my country. It is not DNS system to change (actually it is but convincing me that adding ssl layer on top of highly efficient protocol is worse than rolling everything trough https and changing all existing systems? I'll pass, sounds like a complex solution for simple non-problem, I am sick of looking on those in last decade), it is a law in YOUR country that allows your ISPs to spy on users and this is something that needs to change.

davidu 7y ago

This is the wrong dichotomy and it's a false one perpetuated by Mozilla. Users can have end to end encrypted DNS and browsers shouldn't be hijacking it. To put it another way, you don't want the people who only care about eyeballs (Google, Mozilla, etc.) picking your DNS provider.

icebraining 7y ago
So disable DoH in Firefox, or change the provider? If you know enough to choose a DoH provider, the browser defaults are not very relevant, presumably.
- Karunamon 7y ago
  That's great for the handful of people that read Hacker News and understand DNS, it's a trash solution for the rest of the world. Defaults matter because they are rarely changed.
  - 7786655 7y ago
    Right now the defaults are unencrypted DNS handled by ISPs which in the US have explicit legal permission to sell your data.
    - deleted 7y ago
      [deleted]

devit 7y ago

Probably the ISP, since it already has a working business model unrelated to selling your DNS query data and doing so is probably illegal in several countries.

heavyset_go 7y ago
If you're in the US, read your ISP's privacy policy sometime: part of their business model involves selling the data about the sites you visit.
sciurus 7y ago
The terms of the Trusted Recursive Resolver program explicitly disallow selling your DNS query data. > Your DNS data can reveal a lot of sensitive information about you, and currently DNS providers aren’t subject to any limits on what they can do with that data; we want to change that. Our policy requires that your data will only be used for the purpose of operating the service, must not be retained for longer than 24 hours, and cannot be sold, shared, or licensed to other parties. https://blog.mozilla.org/netpolicy/2019/12/09/trusted-recursive-resolvers-protecting-your-privacy-with-policy-technology/ https://blog.mozilla.org/netpolicy/2019/12/09/trusted-recurs... https://wiki.mozilla.org/Security/DOH-resolver-policy https://wiki.mozilla.org/Security/DOH-resolver-policy (Disclosure: I work for Mozilla, but not on this)
- 3xblah 7y ago
  NextDNS purports to be a DNS provider that will use public blocklists and filter queries and block ads and tracking like a PiHole. The Mozilla TRR policy states that the DNS provider must not filter any queries unless the user explicitly opts-in. How would a user selecting NextDNS as a TRR indicate that she wants NextDNS to filter queries in order to block ads and tracking. The TRR policy also states that the provider must not use the EDNS Client Subnet extension. It looks like NextDNS does use some modified version of ECS, at least in its plaintext DNS service. The FAQ states users can submit a query with class CHAOS instead of IN to get some diagnostics, e.g., drill -t example.com @45.90.28.0 a chaos Unfortunately, someone who ISP is filtering port 53 cannot make this query.
7y ago

fiysp 7y ago

My ISP, since I have a contract with them, I can switch to another ISP anytime, and they are bound to lots of data protection laws. On the other hand, the Mozilla Corporation clearly is desperate to find alternate sources of funding.

gpm 7y ago
Often, I don't have a contract with my ISP. Since my ISP is a random coffee shop, the public transit provider, or so on.
- type0 7y ago
  You should be using a VPN in a random coffee shop anyway, not that I particularly like how falsely advertised those are, and their security (Nord cough cough), still it's usually better than nothing.
  - gpm 7y ago
    It doesn't matter what I should do, it matters what a random firefox user who finds themselves in a coffee shop is doing. Some of the public transit I've been on disagrees strongly with VPNs because they do heavy traffic shaping and VPNs fall into the "make this really slow" category. Reasonably so. I also disagree with this advice. For myself and the vast majority of people $5/month is not worth it for the negligible difference in security and privacy over https, and DNS over https. This becomes even more true with encrypted SNI. In fact, a VPN is largely worse privacy wise because "random coffee shop internet with random MAC address" is pretty anonymous unless you sign into anything over http.
tptacek 7y ago
You have a contract with your ISP not to collect and monetize your DNS queries to their DNS servers? Are you in the US on a mainstream ISP? If so, you surely do not, unlike with the Mozilla TRR program, where you in fact do.
- Aaargh20318 7y ago

stiray 7y ago

I am mozillas diehard fan as firefox goes but I DO NOT trust them. I still remember some company with best search engine that got vapirised over the years and I am not prepared to trust anyone. Mozilla has some shady practices with their "research add-ons" and I am blocking their domains from firefox and using another browser to download addons. And I will surely not allow some firm in a country with vague laws allow to do all my name resolution. Not to mozilla, not to google, not to cloudflare or anyone else (currently running unbind with caching on huge list of DNSs all over EU in random order). ISP? They are obligated to follow the law in my country. Spying on its user would make it a criminal offense investigation, potentionally bringing their management behind bars. No, they wont even try, it is too dangerous for them. I trust my ISP way more than mozilla. Based on law in my country. It is not DNS system to change (actually it is but convincing me that adding ssl layer on top of highly efficient protocol is worse than rolling everything trough https and changing all existing systems? I'll pass, sounds like a complex solution for simple non-problem, I am sick of looking on those in last decade), it is a law in YOUR country that allows your ISPs to spy on users and this is something that needs to change.