50 ms·

Mozilla’s DNS over HTTPs

• Vinnl 7y ago
  I think this is generally a good thing. Two questions I've often seen surface on HN though weren't answered: 1. Isn't this better implemented at the OS level? 2. Isn't centralisation to two DoH providers more centralised than five large ISPs? Others are probably better suited to answer, but the answers I can think of: 1. Yes, but it is not, so this solution is second-best. If Operating Systems decide to tackle this problem at some point in the future, Firefox can always be changed again to use that. 2. Given that Firefox doesn't own the full market, the net result is indeed less centralisation: five ISPs that handle traffic by other browsers, and two DoH providers that handle Firefox's. That said, the main factor here is that the track record of ISPs in the US is abysmal, whereas the current (and hopefully potential future other ones) DoH providers have committed to far stronger privacy protections.
  • pingyong 7y ago
    In addition to 1) ideally the user can just choose here. Which the user currently sort of can, so I don't see a problem with it.
  • nothrabannosir 7y ago
    FWIW, wrt 1: you can use dnscrypt and a bitbar plugin to have this at the OS level on Mac. It’s a faff to setup but once it works it really does work. https://www.dnscrypt.org/ https://www.dnscrypt.org/ Optional for menu icon: https://getbitbar.com/ https://getbitbar.com/ and https://github.com/jedisct1/bitbar-dnscrypt-proxy-switcher https://github.com/jedisct1/bitbar-dnscrypt-proxy-switcher
    • hunter2_ 7y ago
      I think 1 is about OS defaults, not stuff users must know to do. People knowledgeable about privacy could always bolt things on, and that's quite orthogonal to this discussion. Rather, this is all about the people who do no installation/configuration beyond an OS and a browser.
    • jedisct1 7y ago
      https://www.dnscrypt.info https://www.dnscrypt.info The .org is not legit.
      • nothrabannosir 7y ago
        So sorry, my bad. Mobile Google fail :( thanks for vetting !
  • smichel17 7y ago
    In addition to (2), I imagine it's easier to set up a completing DoH service and get it included in Firefox than an ISP that can reach a similar number of users. So it may not always be so centralized.
  • alexis_fr 7y ago
    > DoH providers have committed to far stronger privacy protections. What about DNS tampering? In many countries there are different rules for taking down a website. My ISP applies different rules than 8.8.8.8, which is handy when required by law in France but not in USA. Effectively, government-mandated tampering will be applied with much less granularity because of centralization (or bi-centralization).
  • im3w1l 7y ago
    The ISP can just check which IP you contact, so I don't see this increasing privacy.
    • jeltz 7y ago
      And until ESNI gets high adoption they can also just look at the SNI header. I do not see how DoH gives any significant amount of extra privacy.
      • Someone1234 7y ago
        DoH doesn't need to provide extra privacy to make sense (although it is a mandatory stepping stone to good privacy). It also provides a difficult to block security upgrade (as opposed to DoT, which is easy to block). We've seen regular US ISPs hijack unencrypted DNS to insert content or replace sites entirely. We've also seen bad actors do far worse on public WiFi. So acting like DoH is a waste of time unless every part of the privacy puzzle is online is wrong-headed. It is a huge step in the right direction for privacy, increase their costs, and will be much needed when eSNI is online. In the meantime "all" we get is a huge security improvement.
        • corford 7y ago
          Except, not really. If you're worried about DNS tampering, DNSSEC already exists all the way up to the root servers. If you're worried about ISPs snooping on what sites you visit, they'll continue to be able to do this even with widespread DoH/DoT and ESNI adoption. You still need to connect to an IP and TLS certs still have unique serials (most of which appear on public CT logs). Correlated over a large user population, that's more than enough to get a pretty decent, aggregate view of what sites you're browsing (certainly enough to tailor ads/marketing towards you). As for random third party networks (e.g. Starbucks wifi), if you're not using a VPN then I don't see what expectation of privacy/security you had in the first place. Ultimately, if you don't trust your ISP (or whatever network you happen to be connected to), the only meaningful option is a VPN. Encrypting your DNS traffic to a resolver (whether with DoH or DoT) is, at best, a very incremental improvement in the arms race. It protects users against some of the most egregious ISP abuses (assuming said ISP doesn't also spoof the cert...) at the expense of potentially misleading them into thinking they have more privacy than they actually do. In the case of DoH it will also likely inadvertently end up centralising a huge chunk of DNS lookups in to the hands of a few large corporations thanks to it being opt-out rather than opt-in. At least DoT avoids that (and offers server-to-server encryption). Much better for users who want unfettered internet access and privacy to encrypt the whole lot with a VPN and use a resolver that validates DNSSEC. If the chain of resolvers were all DoT enabled that would definitely be a nice extra but hardly essential. Alternatively, if you're in a country with a healthy ISP market (and government you're not afraid of), there's always the option to simply move to a provider that doesn't tamper with and monetise user traffic.
  • deleted 7y ago
    [deleted]
  • jfindley 7y ago
    For 1, you're spot on. For 2, the one thing that's missing from here is that we _know_ many ISPs are selling your data. I'm really uncertain why people are so determined to villify Cloudflare - who don't really stand to gain that much more useful info about you from this than they already have - and give a totally clear pass to their ISP despite years of proven bad behaviour. Yeah this (by default) uses CF's DoH service - note that you can change this if you want - but in my view that's strictly better than continuing to allow your ISP to to sell your browsing history. In other words - a bit of by-default centralisation is in my view an acceptable price to pay for the increases in privacy and security (especially as it's trivial to switch away from CF if they behave badly).
    • judge2020 7y ago
      A good solution would be to do DoH upgrade to their existing provider if the user already has DNS set to a non-ISP resolver (eg. Google, openDNS), only using CF as a default for ISP dns. That or racing multiple DoH providers for the first few queries to choose the fastest one for the user.
      • zrm 7y ago
        Internet gateways commonly give out the gateway's IP address as the DNS and then forward requests upstream from there. How does the application know which DNS the gateway is configured to use?
        • judge2020 7y ago
          In [currently only] Chrome, it doesn't upgrade if the DNS advertised is the router. This proposed Firefox system then would default to CF [or default to the fastest one].
    • syshum 7y ago
      >who don't really stand to gain that much more useful info about you from this than they already have that is absolutely untrue. Today they only have data for websites already using CloudFlare Services. DoH they can info on ALL websites users for FF visit. and while their "contract" with mozilla requires they "anonymize" the data, they are admitted to collecting aggregate data which is VERY valuable in itself, plus I never trust companies when they say they will "anonymize" the data Further I have not see what if any penalties are imposed on cloudfare for any violations of the "contract" they have with Mozilla, if there are no penalties then the contract is pointless and not an assurance of anything As to why people villify Cloudflare, it is what CloudFlare represents that is a problem for people like me. The Internet is best serviced by decentralization. in the last 10 to 20 years we have seen and continue to see MASSIVE centralization of core infrastructure. FF move here represents another step on that path. CloudFare already has too much of the net behind their infrastructure. They are an inherit threat to the free and open web
  • bepvte 7y ago
    For point 1, Windows 10 plans to implement this.
• drenginian 7y ago
  Why are people so down on DNS over HTTPS? DNS is the primary way governments control and spy on web access.
  • deadbunny 7y ago
    I'm not down on encrypting DNS, I'm down on moving DNS from a network/system level to an application level.
    • falcolas 7y ago
      Java poisoned this well a decade ago by not respecting DNS TTL settings.
  • Legogris 7y ago
    And now they have a one-stop shop for all their DNS surveillance needs.
    • drenginian 7y ago
      Well it’s absolutely happening right now to every unencrypted DNS server, so what’s your point? DNS is the most openly insecure aspect of the entire internet. It’s wide open.
      • teddyh 7y ago
        So you’re arguing that everybody should switch to DNS over TLS (DoT), then? Sounds great!
        • bepvte 7y ago
          DNS over TLS is just DoH but with an easily blocked separate port
          • Legogris 7y ago
• davidu 7y ago
  Doth protest too much. People don’t take issue with DoH, they take issue with an advertising supported browser like Mozilla’s unicast (and now bicast) centralization of DNS traffic that was previously distributed. We invented DNSCrypt. There’s also DNS over TLS. Lots of ways to encrypt DNS without centralization. They make this about DoH when really the primary issues are with how they went about it.
  • drenginian 7y ago
    >> We invented DNSCrypt. There’s also DNS over TLS. Lots of ways to encrypt DNS without centralization. Ummm so what’s the downside then? Are those services arcane and hard to use and utterly forbidding blackest black magic, like almost all crypto stuff? If you’re thinking browser users will just do this then that then this and x and y and z to “get dns crypto going”, then I’ll take Mozilla’s “it just works” approach. It’s a much much better approach for the browsers to implement it rather than wait for everyone’s operating system to implement secure dns because that’ll happen .... well I can’t imagine any time in the future you could say everyone’s OS is using crypto DNS, whereas if browsers implement it for themselves, instant massive adoption.
    • davidu 7y ago
      Not sure what any of your reply means. Adding OS support isn’t required. People just run a local resolver that supports these things. No different than any other application. Nothing arcane. Certainly no more than HTTP and SSL. I think you have some reading to do.
      • drenginian 7y ago
        >> People just run a local resolver that’s support’s these things. Nowhere do “people just run a local resolver”. Grandma and aunty Beryl certainly don’t, nor does any other ordinary person. If you want secure DNS you have to build it in to the browser. Only systems people think that this is the sort of thing that ordinary people do.
        • 7y ago
• protomyth 7y ago
  Does the disable code still work in the about:config? I would rather not have the trusted providers see all our internal server names (which is wasted bandwidth and time) and our controls in the library work. DNS resolution is the OS's job. This hijacking of function is a pain. Has no one at Mozilla ever had to deal with the realities of using their browser in an organization?
  • bepvte 7y ago
    AFAIK the ESR (business release) does not have this on by default
    • protomyth 7y ago
      ESR is extended support and we use the regular Firefox. Firefox was never required by any vendor we use to remain compatible so we didn't have to be on the ESR branch.
      • bepvte 7y ago
        https://support.mozilla.org/en-US/kb/canary-domain-use-application-dnsnet https://support.mozilla.org/en-US/kb/canary-domain-use-appli... You can use this if you run a DNS server
  • Xylakant 7y ago
    Network/Organization Operators have various ways to disable DoH in their orgs or networks, for example via a canary domain or enterprise policies. https://support.mozilla.org/en-US/kb/configuring-networks-disable-dns-over-https https://support.mozilla.org/en-US/kb/configuring-networks-di...
• sschueller 7y ago
  For people in Switzerland I recommend using the DNS/DoH services provided by the Digitale Gesellschaft [2]. There is no logging and no block list. [1] [1] https://www.digitale-gesellschaft.ch/2019/04/11/oeffentliche-dns-over-tls-und-https-dns-resolver-neuer-service-der-digitalen-gesellschaft/ https://www.digitale-gesellschaft.ch/2019/04/11/oeffentliche... [2] https://www.digitale-gesellschaft.ch/dns/ https://www.digitale-gesellschaft.ch/dns/
• andridk 7y ago
  Why isn't this being solved on an operating system level instead?
  • rciorba 7y ago
    It could be. Since Mozilla makes a browser it was natural they'd try to solve it at the application level and not wait until M$ and other privacy loving OS vendors solve the problem.
    • supernovae 7y ago
      Microsoft has already said they're moving to encrypted DNS. Windows Core team announced this to insiders last year.
  • jaas 7y ago
    If operating systems had taken care of the problem already then Mozilla might not have to. I'm glad Mozilla isn't waiting around for them to protect my privacy.
    • strunz 7y ago
      Isn't this gonna cause a bunch of headaches though? What about people who connect to VPN and rely on the local DNS server to resolve non-public hosts? It'll work in everything but Firefox? Seems confusing.
  • bArray 7y ago
    > Why isn't this being solved on an operating system level > instead? It probably should be, but the undertaking is massive (cross platform) and browsers want a quick turn around. A lot of people would think that VPNs solve such issues, but it just pushes the problem further up the network. In my opinion Linux would be a good candidate for such an initial implementation - but you wouldn't pick DoH, you would likely offer DNSCrypt or DoT.
  • m-p-3 7y ago
    That would be the best outcome, but until then Mozilla is making an effort to fill the gap until OSes supports DoH, DoT or DNScrypt out of the box and by default.
• josteink 7y ago
  Can someone at Mozilla explain why they present what is purely textual content as a PNG? I mean, this is ridiculous: https://ffp4g1ylyit3jdyti1hqcvtb-wpengine.netdna-ssl.com/netpolicy/files/2020/02/Final-DNS-over-HTTPS-05-1.png https://ffp4g1ylyit3jdyti1hqcvtb-wpengine.netdna-ssl.com/net...
  • jasoncartwright 7y ago
    When you click on it then the text gets smaller. Bizarre choice.
  • ComputerGuru 7y ago
    It’s to keep with the theme of breaking the web while ostensibly replacing it with something better.
  • Jonnax 7y ago
    For sharing on social media / chat apps.
  • Yoric 7y ago
    For sharing on Twitter?
  • tomashubelbauer 7y ago
    Apparently, screen reader users do not deserve to be able to learn about the future of the web Mozilla is envisioning.
  • Aissen 7y ago
    The fun part is that this seems to have been copied from an HTML FAQ and a link "see relevant documentation here" has simply disappeared in the process.
  • johnp_ 7y ago
    It even seems to break inline links, like in the "split-horizon" section: > System administrators can find relevant documentation here. I'm pretty sure "here" should be a link, but of course that doesn't work when the marketing department uses a PNG instead of HTML. I'm also surprised that Mozilla / the CDN don't optimize the PNG. `zopflipng` reduces the size from 285K to 153K. And of course it's named "Final-DNS-over-HTTPS-05-1.png".
• ComputerGuru 7y ago
  Can someone please explain why there can’t be a DHCP or RA option for which DoH server to use? Why are we going out of our way to make sure the sysadmin has to configure each and every piece of software on each and every single PC rather than just set it one in a centralized location, like every other networking option? DoH will leave my machines unable to resolve all my internal domain names, right?
  • Jonnax 7y ago
    https://support.mozilla.org/en-US/kb/canary-domain-use-application-dnsnet https://support.mozilla.org/en-US/kb/canary-domain-use-appli... There is. You configure your DNS resolve this "canary" domain to disable it.
    • ComputerGuru 7y ago
      All that does is block DoH entirely, right? Not allow me to say “use this DoH server” or “don’t use DoH for this domain.”
      • Jonnax 7y ago
        I think if you want to get that detailed you'd be pushing a custom managed Firefox profile.
        • ComputerGuru 7y ago
          You have twenty different applications using DoH for “increased security” and you need a custom profile for each? Why not a single line in resolv_doh.conf?
          • zaarn 7y ago
            What local resolver supports resolv_doh.conf at this time? At the moment, Mozilla wants to push this for users where DoH just works, for people it doesn't providing options to disable it. Once resolv_doh.conf becomes a thing for all platforms (Linux, OSX and Windows) they can use that.
• aduitsis 7y ago
  If you are a network administrator and want none of this, look at that: https://support.mozilla.org/en-US/kb/canary-domain-use-application-dnsnet https://support.mozilla.org/en-US/kb/canary-domain-use-appli... Basically, make use-application-dns.net. return an error (any kind will do). Filter it in your recursor for example. Having the browser change a fundamental behaviour that used to stand for decades is highly problematic. If nothing else, it is the network administrator who should have the final say on WHEN (if ever) DoH will get deployed inside their network.
  • techdevangelist 7y ago
    I wonder if we’ll start to see Comcast and other large snooping ISPs start to filter the resolution of this domain in the name of stability...
    • jeroenhd 7y ago
      If they do that, Mozilla will probably immediately update the check or remove it all together. I don't understand why systems administrators don't just use their existing policy management to disable DoH if it really causes an issue. There's a group policy specifically for DNS over HTTPS [1] The only reason I can think of is that they can't because of BYOD or Firefox being part of the company's dark IT. The DNS workaround doesn't help much in those cases because the underlying problem is a lack of oversight, not an issue with Firefox. [1] https://github.com/mozilla/policy-templates/blob/master/README.md#dnsoverhttps https://github.com/mozilla/policy-templates/blob/master/READ...
  • jfk13 7y ago
    I'd guess that the overwhelming majority of Mozilla's users do not have a "network administrator" looking after issues like this for them. All they have is an ISP, and the ISP is not on the user's side.
    • pbhjpbhj 7y ago
      The ISPs can easily be swapped out, they're was much on the client side as Cloudflare, probably more so.
• larrysalibra 7y ago
  Questions I couldn’t find answers to in the post or linked info about the Trusted Resolver Program: What’s in it for the Cloudflare & NextDNS? Are they getting paid to handle this traffic or paying to have the opportunity to access this data? Can users outside the US opt-in? The comment about having “no plans” to enable this outside the USA seems a bit disingenuous. Hard to believe they built this program / feature and have no plan to eventually roll out to all users. Perhaps what they wanted to say was they have no fixed timeline for roll out to other locations.
  • bepvte 7y ago
    Yes, if you press the network and proxy settings in the preferences page, you will see a DNS over HTTPS setting. You can also use this to set your own resolver in case you dont trust cloudflare.
  • close04 7y ago
    > The comment about having “no plans” to enable this outside the USA seems a bit disingenuous The comment actually very clearly says "we do not have plans to roll out the feature in Europe or other regions at this time". Also I have mixed feelings about this. On one hand yeah, encryption is great and someone sitting between me and my ISP will no longer be able to monitor my DNS queries. On the other hand I don't feel like this is protecting me from anything at this time. Instead of trusting my ISP, I have to trust Cloudflare. And in the meantime my ISP still knows where I am connecting to, between looking at the IP and the SNI (they mention ESNI but we're not there yet and it still just a partial fix). DoH (in general, not Mozilla's problem) just enables any piece of software or hardware on my network to bypass any security controls I have in place. No more filtering DNS with things like PiHole, no more blocking DNS port on your firewall. This tends to work out great for Google and any random IoT device manufacturer. I could cover this with more enterprisey setups but that's the last thing I want to do at home. So the average user probably sees no difference either way, nothing lost, nothing gained. But for me it's a clear regression because I lose the little control I had over that traffic and I just spread more data around to yet more companies. Some may even be in legal jurisdictions that are even less trustworthy than where my ISP is located.
• gumby 7y ago
  The overhead of setting up and using an https connection is massive compared to DNS which can fit in a UDP transaction. Do they establish a connection and leave it open for a long period? Supporting that would be a big commitment on the part of the resolvers.
  • tialaramex 7y ago
    Small DNS queries and answers fit in one UDP packet, but larger ones don't and have to be retried as TCP. HTTPS/2 over TLS 1.3 (which is the baseline you should assume for these relatively new services) is one TCP setup plus potentially 0-RTT TLS on all but the first visit. 0-RTT is safe here because a DNS query is just a question with no side effects. Replay attacks (the risk 0-RTT incurs) don't do anything: Gumby: "What is the IPv4 address of news.ycombinator.com?" encrypted so that only DoH Server and you can read it Server: "209.216.230.240" encrypted so that only Gumby and the DoH server can read it Attacker: Replays Gumby's packet with no knowledge what it means Server: Same reply, also unintelligible to attacker just like the original For HTTPS/3 (over QUIC rather than TLS+TCP) it's UDP so the only "overhead" is from the crypto setup which is modest on even a relatively weak machine.
    • gumby 7y ago
      Thanks. I hadn't followed the development of 0-RTT which allows the server to tear down the connection.
• rebolek 7y ago
  Until recently, I was working at CZ.NIC and people who are working on Knot DNS resolver were in the next office. The easiest way to get them crazy was to mention DNS over HTTPS. They hated it passionately.
  • vetinari 7y ago
    Many DNS folks hate it; https://twitter.com/paulvixie/status/1053765281917661184 https://twitter.com/paulvixie/status/1053765281917661184
• maxwellito 7y ago
  I'm really looking forward to enable the feature on my personal computer. But as long as Firefox DoH ignores my /etc/hosts configuration, I won't use it. I hope it's just a matter of time before they fix this :)
  • pmontra 7y ago
    Yes please, I'm using /etc/hosts all the time when I setup new servers and to access some servers with no name on customer VPNs.
• bad_user 7y ago
  Great. I already enabled it explicitly.
• lovelearning 7y ago
  As a resident of a country whose government and ISPs heavily and habitually censor the Internet for political reasons, I for one truly appreciate Firefox's DoH. They should also enable 'network.security.esni.enabled' by default because the censors here have upgraded from DNS to SNI-based blocking. I get it that better solutions are possible, but got to teach people to first walk before teaching them to run. AFAIK, Chrome still doesn't support this kind of simple user-friendly privacy options for the average non-technical user.
  • deleted 7y ago
    [deleted]
  • bepvte 7y ago
    I've noticed some problems with eSNI so far unfortunately. Some domains like discordapp.com have some access points with eSNI enabled and some without, so when clients access the ones without eSNI, they believe that they are under attack. I cannot wait for it to be finished and implemented though, it would be a huge benefit for the privacy of millions.
    • judge2020 7y ago
      Currently only Cloudflare implements it but that's due to eSNI still being a draft.
  • vetinari 7y ago
    Chrome uses opportunistic DoT - it uses your system configured resolver, and if it supports DoT, it will use DoT, if not, it will fall back to 53/udp. I like Chrome's approach much better; it doesn't force you to statically configure DNS server - it is a PITA, especially when roamining and you want to resolve hostnames available only in local networks.
    • ignoramous 7y ago
      > ...it is a PITA, especially when roamining and you want to resolve hostnames available only in local networks. Not really. If you're not blackholing traffic at the dns-layer via DoH, set Firefox's trr.mode to 2. Per documentation, at the cost of additional latency incurred, system-level / network-level resolvers should pick up the slack, provided they've been set as appropriate via DHCP or otherwise. Ref: https://wiki.mozilla.org/Trusted_Recursive_Resolver#network.trr.mode https://wiki.mozilla.org/Trusted_Recursive_Resolver#network....
• BiteCode_dev 7y ago
  Cloud flare is American and we know since the PRISM scandal that US based tech companies are directly plugged into the NSA, and everybody in the chain will deny it under the threat of prison. So, if this rolls out 'as-is' in any other country than the US, we will go from "all DNS requests are clear text, but dispatched among many entities" to "DNS requests are encrypted, but all read and controlled by american agencies". We (may) have gain (some) privacy (maybe). But we also (certainly) gained a serious dependency.
  • rndgermandude 7y ago
    They only enabled it by default for US users, so at this time it doesn't really matter. shrugs When they roll out in the EU, I will pay close attention to how they are doing it, what partners they use under what jurisdictions etc.
    • BiteCode_dev 7y ago
      Same. Gotta also make sure I don't get a US Firefox build somehow.
      • rndgermandude 7y ago
        You can always disable DNS-over-HTTPS in the network preferences, or set or own resolver, e.g. https://news.ycombinator.com/item?id=22412656 https://news.ycombinator.com/item?id=22412656 But good point, now I am curious how they detect US-ness. Probably a combination of using the en-US and some geo lookup?
  • dralley 7y ago
    The page, which you didn't read, specifically makes the point that they have no plans to roll this out (by default) anywhere except for the US.
    • BiteCode_dev 7y ago
      Nowhere it says they have no plan of doing it. They just release it only for the US __build__, __by default__, __now__. But to make things more honest, I'll edit my comment.
• throw7 7y ago
  This thing should never be on by default. Mozilla here has decided for me that it is an acceptable layering violation on my system/network. IMHO, this thing is bordering on malware.
• sumanthvepa 7y ago
  I run my own DNS server. So I trust my own DNS way more than I trust Cloudflare. Is there a way to stop Firefox from using DNS over HTTP?
  • kibwen 7y ago
    Yes, it supports custom resolvers, see the section "Switching Providers": https://support.mozilla.org/en-US/kb/firefox-dns-over-https https://support.mozilla.org/en-US/kb/firefox-dns-over-https
• mike-cardwell 7y ago
  Anybody have any stats on what percentage of websites and or percentage of global web-traffic hits websites that are hosted on their own personal unshared IP, vs those that are hosted on shared IPs? Because if 90% of websites are hosted on unshared IPs, then this whole thing about DoH and/or ESNI providing some sort of privacy is complete bunk. An ISP can still see exactly what website you're visiting when connecting to an unshared IP by virtue of which IP you're connecting to. The methods for mapping a raw IP to a website when that IP is unshared, are numerous and effective. DoH/ESNI only provide privacy if the vast majority of websites are on shared IPs. DoH/ESNI only provides privacy if we have already (or are planning to) centralise web traffic behind a handful of gatekeepers.
  • mike-cardwell 7y ago
    Multiple downvotes because I pointed out that the whole promise of DoH is that it stops ISP's from being able to see and sell which websites you're visiting, but ISP's will still be able to see and sell which websites you're visiting, unless we stick most websites behind shared IPs. I guess that's step 2 in "advancing" the web.
• sandGorgon 7y ago
  is this only on desktop ? i cant find this setting on android
• excalibur 7y ago
  Bottom of the infographic appears to contain a new Firefox logo. Looking at their website, it appears this is actually the logo for the larger (and somewhat confusingly named) Firefox suite of products, to distinguish them from the Firefox browser. Which is nice I guess, but what most people see is the browser icon, and this logo would be far preferable to the current one in that capacity.
• luizfzs 7y ago
  Is there a way to ensure the ISP opt-in parent control is not going to be abused, effectively turning it into a way to bypass DoH at all?
  • zzzcpan 7y ago
    No, well, maybe, depending on your country. I know some countries have laws preventing ISPs from interfering with content, but even those laws do not apply to technical measures, like DoH, they are still completely free to block it.
• deleted 7y ago
  [deleted]
• jeffdavis 7y ago
  There aren't that many DNS names out there. Eventually we should be able to just replicate the entire DNS database (or large parts of it) to routers or even local devices. Then your lookups don't go outside of your network.
  • speedgoose 7y ago
    Well, it can be quite a lot of data for many network devices and then you may have outdated replication. The current system using a cache works relatively well until you want privacy.
• hnasr 7y ago
  A great step indeed for websites that use static IP for a single resource. Websites that uses Server Name Indication TLS extension for shared hosting force clients to send the hostname in plain-text during TLS handshake which could be sniffed. (Reliance Jio in India is already doing it https://cis-india.org/internet-governance/blog/reliance-jio-is-using-sni-inspection-to-block-websites https://cis-india.org/internet-governance/blog/reliance-jio-...). The Same thing OCSP Stapling (Online Certificate Status Protocol) extension which also sends the hostname. Cloudflare crafted a solution for this by storing the public key of the target website along with the DNS record. So during DoH when the user asks for IP of a given host, it can also get the public key of the host. User then establishes the TCP, encrypt the SNI extension & OCSP with the public key and starts the TLS handshake. Though ESNI doesn't seem to provide perfect forward secrecy it is a leap forward.
• ck2 7y ago
  So basically instead of hundreds of different DNS systems, all an unsupervised person in government or law enforcement has to do is search one or two distinct DNS services for all your queries over the past years. They can claim all they want it's not logged or anonymized but that's like believing the same claims by your VPN service, you have no idea if they are operating under a silent security order from some agency. And unless I am missing something, unless you are tunneling though VPN, proxy, etc. your ISP is well aware of every IP connection you do, they simply just rDNS if they want to know.
• techntoke 7y ago
  If you want to control this via Group Policy, or system-wide, you can use the following policy: https://github.com/mozilla/policy-templates#dnsoverhttps https://github.com/mozilla/policy-templates#dnsoverhttps
• mox1 7y ago
  I recently upgraded my home router to DNS over HTTP (pfSense now supports it pretty easily). I started with Quad9 (9.9.9.9) and Cloudflare as a backup (1.1.1.1). One thing I noticed right away was that my ping times to Cloudflare ended up being way faster (15ms) compared to Quad9 (50ms). Cloudflare seems to have a presence in my local area. Now both are good, but adding a 50ms delay (+TCP handshake + TLS setup and teardown) seemed like a non-trivial amount. I ended up putting Cloudflare first. There was a noticeable difference, something to think about if you decide to set this up.
  • ignoramous 7y ago
    > Cloudflare seems to have a presence in my local area. In case you're interested in rolling out your own low-latency DoH: I run a DoH stub-resolver on Cloudflare Workers [0]. Their free-tier covers one device's worth traffic. You could do so on stackpath, too [1]. [0] https://news.ycombinator.com/item?id=22208988 https://news.ycombinator.com/item?id=22208988 [1] https://news.ycombinator.com/item?id=19514791 https://news.ycombinator.com/item?id=19514791
• deleted 7y ago
  [deleted]
• travisgriggs 7y ago
  Does anyone know when something like this might come to Brave?
  • Operyl 7y ago
    If I recall correctly, brave://flags should have "Secure DNS" or something like that.
    • travisgriggs 7y ago
      Sweet! Did not know about that. Ask a question, learn something new. Now I have knobs to play with. :)
  • fludlight 7y ago
    I know Brave is supposed to be a privacy-centric browser, but their plan for advertising seems at odds with that. Advertising is a slippery slope and I wonder how long before these promises are eroded or outright reversed. > 100% of your ad spend is placed for active users that opt-in to a rewarding private ad experience. > Craft effective offers and provide captivating full-page experiences directly with consumers in Brave’s Private Ad Tabs. > Brave uses local machine learning with the browser profile to only place ads in optimal conditions. Ads are matched to opportunities, and users become partners instead of targets. > Private ad matching efficiently matches ads directly from the device, without breaching personal information. https://brave.com/brave-ads-waitlist/ https://brave.com/brave-ads-waitlist/
    • hombre_fatal 7y ago
      I think the only reason Brave wasn't immediately laughed out of the room on HN as a browser that literally shows you its own ads is because they brilliantly have their own cryptocoin (BAT) so that anyone who thinks their $10 investment will buy them a lambo one day will come out of the woodwork to mention the browser. The same thing you saw happen to any other cryptocurrency. It basically kills all earnest conversation. The Brave thought this was worthwhile makes the whole thing feel scummy to me. But we are way off topic.
• ryuukk_ 7y ago
  another reason to uninstall firefox
• travisgriggs 7y ago
  Does anyone know when Brave Browser might get something like this? I like the thing that on issues like this, folks at Brave and Mozilla are in similar pages (pun?).
• StreamBright 7y ago
  Can you disable this?
  • jasonlotito 7y ago
    Yes. The article linked to explains how.
  • ReverseCold 7y ago
    https://support.mozilla.org/en-US/kb/firefox-dns-over-https#w_about-the-us-rollout-of-dns-over-https https://support.mozilla.org/en-US/kb/firefox-dns-over-https#...
  • jszymborski 7y ago
    Yes, instructions to do so are in the article.
  • mfer 7y ago
    In preferences search for DNS. You'll find a checkbox to enable/disable it along with a select for choosing a provider.
  • mysterypie 7y ago
    What are some reasons why someone would prefer to or need to disable it. Just curious.
    • StreamBright 7y ago
      I have Pi-hole on my network and I do not want to use any other DNS provider other than my own (with my own blacklist/whitelist).
    • djsumdog 7y ago
      I'm not sure if disabling it is the right way to go, but I do not plan on letting Firefox ship all my DNS queries to CloudFlare. I do not trust Cloudflare any more (and maybe a little less honestly) than my ISP. I do want a container with my own DNS-over-HTTP running on my own hosted VM (or Digital Ocean, or Vultr or Linode or whoever) and I'll ship my DNS queries there.
• rasengan 7y ago
  I’m wondering, is the US a phased roll out or is this in light of government mandated censorship in the UK, Australia, New Zealand, India, China, etc.?
  • floatingatoll 7y ago
    The last entry at their FAQ posted today indicates that they’re focusing on US-only and does not commit to worldwide plans. (But it’s also buried in an image where I can’t copy-paste, ugh.) Link to that FAQ: https://blog.mozilla.org/netpolicy/2020/02/25/the-facts-mozillas-dns-over-https-doh/ https://blog.mozilla.org/netpolicy/2020/02/25/the-facts-mozi...
    • fireattack 7y ago
      I think OP's question is why it is US only. The only reason I can think of (or I can understand) is regulation and laws, but it doesn't seem to be the case.
• leeoniya 7y ago
  how long does Cloudflare or NextDNS retain dns query logs?
  • kevin_thibedeau 7y ago
    24h except for "sampling".
    • djsumdog 7y ago
      I still don't trust them. Clouldflare is simply way too big and has done a lot of shady controversial stuff. I also feel like this is breaking something fundamental about the operating system. DNS queries are now going to be different between your browser and ... the rest of your operating system. How does Firefox deal with corporate installations and internal DNS?
      • Avamander 7y ago
        > How does Firefox deal with corporate installations and internal DNS? Everything is configurable and there are canaries to override that.
        • asymptotically2 7y ago
          > Everything is configurable But how many people are going to change it from the default?
          • Jonnax 7y ago
            A corporate environment or internal DNS is already changing the defaults.
          • jedieaston 7y ago
            It is disabled by default in Firefox ESR and enterprise environments are already using GPO to manage it anyway.
      • 7y ago
• mehmetkose 7y ago
  I do not trust Cloudflare.
• hinkley 7y ago
  I don’t know why DNS over HTTPS breaks my brain. I understand how DNS, HTTP, and most of HTTPS work at the wire level (a little fuzzy on how the decisions are made, though). It’s just using a different transport strategy to acquire an IP address from a FQDN. Every step of that process has a logic to it, and none are mutually incompatible. And yet... my brain keeps alerting, asking what kind of madman does the HTTP before the DNS. Maybe it’s the “to make an HTTP connection, first you must make an HTTP connection” part that gets me. I can’t say. But it just feels wrong, despite being more sustainable.
• jimmaswell 7y ago
  Seems very marginal for privacy when people in the middle can still see the IP you're connecting to, just not which DNS record you may have retrieved the IP with.
  • morrbo 7y ago
    It's actually quite massive. Most sites (well not most, but a lot) sit behind something like cloudflare, so your scummy intercepting ISP would only see a connection to cloudflare. Of course none of this really means too much until encrypted SNI is a thing but it's a definitely a lot more than marginal imo
    • deleted 7y ago
      [deleted]
      • deleted 7y ago
        [deleted]
    • RL_Quine 7y ago
      You can sort of assume anybody paying any attention to traffic is sniffing the SNI information, it's pretty obvious.
      • middleclick 7y ago
        Not all ISPs around the world have the resources to do that. It also doesn't have to be 100%, we just have to make it difficult (or more expensive) and that helps.
        • organsnyder 7y ago
          Good point. Sniffing traffic is orders of magnitude more expensive than simply logging DNS queries.
          • 7y ago
• xoraes 7y ago
  I may be late to this, but here [1] is some commentary on why DoH (DNS over HTTPS) may not be as affective as it is perceived. The article also talks about DoT (DNS over TLS) mechanism which is apparently less disruptive for network monitoring tools compared to DoH. Can some security minded folks from the community chime in about the claims made in the linked article? (Disclaimer: English is my second language) [1]: https://www.zdnet.com/article/dns-over-https-causes-more-problems-than-it-solves-experts-say/ https://www.zdnet.com/article/dns-over-https-causes-more-pro...
  • metalliqaz 7y ago
    The article has several good points but also some weak ones. For example, it points out that DoH doesn't really protect privacy from ISPs because ISPs can still see what the users are doing because the ISPs route the traffic. Then, it claims that DoH weakens security because it would let users get around malware blacklists. However, this is mostly nonsense for the same reason. Malware (and other legitimate blacklisting) can and should be blocked even when hard-coded IP addresses are used. The point about the logistics is very true, though. I won't use DoH at home because I operate my own DNS that contains intranet addresses not accessible from the outside Internet. DoH in Firefox would break those services.
  • Ajedi32 7y ago
    When end-user privacy is your goal, disrupting network monitoring tools is a feature, not a bug.
• alwillis 7y ago
  The underlying issue is that a DoH provider can craft the DNS answers individual users get if it wants to. Think about it: a Firefox DoH user could get different DNS answers than other apps get on the same machine using standard DNS on port 53, if Google or Cloudflare wanted to, because they’re essentially talking to different versions of the internet. Remember, all of the properties that allows HTTPS to be trackable—cookies, fingerprinting and the rest—is in play for DNS over HTTPS as well. DoT doesn’t allow for that. If all these providers wanted was encrypted DNS, they’d be pushing DNS over TLS, which is just standard DNS using TLS as the transport. Sure, it uses port 853, but given time, enterprises and other security-conscious organizations would have adjusted, especially if the entire DNS ecosystem got behind it. But because Google, Cloudflare and NextDNS see an opportunity of some kind, they are pushing for DoH. The DNS is an open, global, distributed hierarchical database; DoH starts to break this because apps can bypass most of this and that’s not how the internet was designed to work. The same way Gmail broke the model of federated SMTP servers to a large extent, there’s the potential for the major DoH providers to do the same to DNS. Imagine if Cloudflare decided to block certain DNS records from their users. Certain services that worked fine pre-DoH would break. Take a look at the article DNS Wars; it’s eye opening: https://blog.apnic.net/2019/11/04/dns-wars/ https://blog.apnic.net/2019/11/04/dns-wars/
  • ryanisnan 7y ago
    > Think about it: a Firefox DoH user could get different DNS answers than other apps get on the same machine using standard DNS on port 53, if Google or Cloudflare wanted to, because they’re essentially talking to different versions of the internet. How is that different than existing DNS servers?
    • sp332 7y ago
      There's no difference that a DNS server can see between a browser on your computer making a DNS request vs. any other app. But if the browser is using DoH and other apps don't, then it can tell.
      • ryanisnan 7y ago
• snodnipper 7y ago
  Having just manually enabled DoH, it is pretty tricky to see that DoH is enabled (e.g. from padlock/shield). In the end I saw the necessary flags from: https://www.bleepingcomputer.com/news/software/mozilla-enables-dns-over-https-by-default-for-all-usa-users/ https://www.bleepingcomputer.com/news/software/mozilla-enabl... Under about:config, it seems like network.trr.mode with values 2 or 3 are good choices, https://wiki.mozilla.org/Trusted_Recursive_Resolver#network.trr.mode https://wiki.mozilla.org/Trusted_Recursive_Resolver#network.... UPDATE: network.trr.mode with 3 is not working for me in Australia.
• jlarocco 7y ago
  I wish they wouldn't do this. I trust my ISP more than I trust Firefox and whatever company they chose for DNS over HTTP. This "We know better than you" attitude is why I stopped using Firefox so many years ago. I switched back recently, to stop using Chromium, but I have a growing list of annoyances, and it might be time to give NeXt Browser a chance again, or see what else is out there.
  • arebop 7y ago
    "Firefox defaults to Cloudflare, though you can change this." So it's whichever company you choose for DNS, rather than the company chosen by your ISP. Many of us were already choosing not to use the ISP's DNS, for reliability, but with this feature the ISP can't eavesdrop on that.
    • pbhjpbhj 7y ago
      Most of us chose a company already, our ISP (or in my case a mixture of first + third party). Firefox are defaulting to their choice, no? Presumably they give an option page on which to choose it - even they wouldn't be so egregious as to hide such a massive change without positive user consent, surely?
    • jlarocco 7y ago
      Well, honestly, I don't use my ISP's DNS, either, but that just highlights another way this is annoying: Firefox is overriding my decision with their own. And like I said, I trust my ISP more than I trust Firefox and CloudFlare, so their spying on my DNS (if they even are) is less of a concern to me than CloudFlare or Firefox spying on the requests.
  • kyleee 7y ago
    Agreed, I dislike the paternalism and wish competition in the browser space was much more robust. I'm Google averse and hooked on Tree Style Tabs so Firefox it is for the time being
  • jjeaff 7y ago
    While I may or may not trust cloudflare more than my isp, the fact is that my isp has my billing information and address on file. I do not pay anything or provide any personal information to cloudflare. So to me, there is an advantage to not having all my eggs in one basket. While I'm sure cloudflare could tie your DNS lookups to your identity, it would be much less trivial for them than your isp.
• nullc 7y ago
  I'm so sad to see Mozilla move forward with this massive attack on user privacy. Firefox DoH is snake oil, plain and simple. It sends all the users DNS queries to Cloudflare, adding a new party which can surveil the user's traffic (and can be legally compelled to do so and not disclose this fact)-- providing a convenient choke point to save spies and hackers the trouble and exposure of extracting the data from tens of thousands of individual ISPs. Simultaneously, it does not protect the user from monitoring by their ISP or parties situated there because the user's destination IPs remain unencrypted, as well as the hostnames via SNI (for cases of shared hosting, e.g. on cloudflare, where the IP alone wouldn't be enough). At the moment you can disable this across your whole lan by blocking traffic to 104.16.248.249, 104.16.249.249, 2606:4700::6810:f8f9, and 2606:4700::6810:f9f9 and by DNS blackholing use-application-dns.net and cloudflare-dns.com. iptables -t raw -A PREROUTING -d 104.16.248.249 -j DROP iptables -t raw -A PREROUTING -d 104.16.249.249 -j DROP ip6tables -t raw -A PREROUTING -d 2606:4700::6810:f8f9 -j DROP ip6tables -t raw -A PREROUTING -d 2606:4700::6810:f9f9 -j DROP And if you're using bind: zone "use-application-dns.net" { type master; file "/etc/bind/db.empty"; }; zone "cloudflare-dns.com" { type master; file "/etc/bind/db.empty"; }; Or unbound: local-zone: "use-application-dns.net" static local-zone: "cloudflare-dns.com" static But there is no guarantee that these mitigations will continue to work. [Edit: Aside, this comment and many/most(?) comments on this thread were moved from a more recent thread with a headline "Firefox turns on DoH as default for US users". The new title which omits the on-as-default, is kinda burying the lead.]
  • mtberatwork 7y ago
    > We continue to explore enabling DoH in other regions, and are working to add more providers as trusted resolvers to our program. DoH is just one of the many privacy protections you can expect to see from us in 2020. Cloudflare is just one of the initial providers and they indicate that they are adding more. Also, I'm assuming you can add your own custom provider based on the screenshot in the article. You can just disable the feature as well.
    • ThePhysicist 7y ago
      99 % of users won’t touch default values, so it’s not a valid excuse. I really have come to the conclusion that privacy is just a marketing feature for Mozilla. They e.g. also do nothing against data exfiltration by popular extensions although they have known that issue for years. If they’re really serious about privacy they should have waited to implement DoH as an open standard and allow more DNS providers to support it. The browser could then simply see if your default DNS supports it and if yes switch to DoH. This really smells like some kind of data deal between them and Cloudflare. This is not surprising because DNS data is really valuable and passive DNS monitoring is used for many purposes, e.g. security and marketing. Controlling this data gives you many interesting business opportunities, hence I can understand why Cloudflare and Google are after it. It’s also revealing that they don’t enable this in the EU, because they rightfully fear that it’s not compliant.
• oedmarap 7y ago
  Anecdata: I frequent a local café that only offers Facebook Wi-Fi, which requires you to "check in" on Facebook in order to receive Internet access. I don't have a Facebook account but with Firefox TRR, 'google.com' is the only address that resolves just fine — so I search Google (or directly from the address bar) for a website, click through to the result, and the ensuing session is allowed. Rinse and repeat for each new tab. Any direct attempt to browse otherwise (including to google.com with other browsers) always hits the FB captive portal.
• 6510 7y ago
  How will courts blocking domains work after this?
  • nullc 7y ago
    Much more effectively: A single party to issue an order to instead of a great number.
    • 6510 7y ago
      hah, that might actually be beneficial since it creates problems that must be addressed.
    • 6510 7y ago
      My ISP was ordered to block the pirate bay and its mirrors. I just enabled DNS over https and I'm able to access it again.
• Funes- 7y ago
  If I2P was widely used, we wouldn't need this.
• drummer 7y ago
  The most important thing this prevents are DNS based MITM attacks where they intercept your request and send you an IP address they control.
  • datenwolf 7y ago
    DNSSEC anyone? Or DNSCurve, or DNSCrypt.
    • tptacek 7y ago
      DNSSEC does nothing to provide DNS privacy, nor does it address MITM attacks between endpoints (your phone and laptop) and DNS servers; it's a server-to-server protocol. DNSSEC is moribund; practically no important sites run it. DNSCurve/DNSCrypt are directly competitive with DoH, but in a post-DoH world, both are probably dead-letter standards.
• 6d6b73 7y ago
  So now just one company will have access to all the data from 99% of firefox users? I don't see how giving so much power to just one entity is better for our privacy. Previously if I used my computer at home, coffee shop, work, hotel etc it would be very hard if not impossible for one company to get all of my browsing history. And giving it all to one company is a better idea?
  • fortran77 7y ago
    And many routers also cache local DNS requests. So unless someone can see every router that you were served by at every airport, hotel, coffeeshop, they really can't see where you've been browsing by examining DNS requests. We're _much_ less safe having cloudflare know all.
• noident 7y ago
  What difference does it make? Even if the DNS queries are completely encrypted, subsequent HTTPS requests made after domain resolution will contain the destination domain (but not the path or request body) in the clear. What makes you assume that ISPs aren't already collecting this information?
  • Arkanosis 7y ago
    The Host header is encrypted when using HTTPS and the SNI is encrypted when using ESNI. In the best scenario (DoH + HTTPS + ESNI), ISPs only get the destination IP, not the destination domain.
    • user639173 7y ago
      The how many IP does pornhub.com have?
      • Arkanosis 7y ago
        Quite a few, I guess, but you'd probably be more concerned about how many other domains share the same IP addresses rather than about how many IP addresses this domain resolves to. And the answer seems to be thousands of domains — which in this case doesn't help much as they seem to all be related, but which in other cases might (eg. shared hosting, CDNs…).
    • noident 7y ago
      That's not so great for a best case scenario, because destination IPs rarely change, and anyone can resolve any domain themselves, making it easy to associate a timestamped IP with a DNS record. I could walk the whole HSTS preload list to find domains.
• beardedman 7y ago
  Glad I don’t use it.
• 6510 7y ago
  I want it to do something when stuff doesn't work. Replacing one thing with another might improve the situation (or not) but the real problem is failure imho. To needlessly ramble on a bit: A simple header or html tag could "ok" all or specific alternative ways of distributing and provide conditions. Say, if my blog is unavailable for > 3 months you can p2p distribute it by [for example] fast, medium or supper slow means. Currently I look at articles I wrote long ago. I've carefully selected 10-30 links of which 20% still work(!?) I've picked them specifically because they are probably unfamiliar to those interested in the topic.
• Mister_Snuggles 7y ago
  I have some unusual, from the normal browser user perspective, DNS stuff and this just leads to a bunch of questions. My gateway has a bunch of static DNS entries for internal hosts, which are all in a fake top-level domain. How will resolving these work if the request goes to CloudFlare? CloudFlare obviously doesn't know about my internal domain. Currently my gateway resolves what it knows about and uses my ISP's DNS to resolve what it doesn't. Pi-Hole is presents a similar problem. Finally, if DoH is the future, how do I run my own DoH server which can resolve internal hosts? Does such software even exist yet? How do I point Firefox at this DoH server? The relevant Wikipedia article[0] points to a list of public DoH servers I can use, but offers no insight as to what software I'd use to run one for my own use. [0] https://en.wikipedia.org/wiki/DNS_over_HTTPS https://en.wikipedia.org/wiki/DNS_over_HTTPS
  • qmarchi 7y ago
    Your setup will still work. Firefox is configured with a "fallback" situation, where anything that doesn't resolve on the public resolver will be queried again using your system-configured DNS options. As for Pi-hole, my recommendation is to block NATed traffic to Cloudflare's DoH traffic (forcing it into Fallback mode) and then setting up Pi-Hole to use for it's recursive resolution. Alternatively, you can setup your own DoH server based off BIND: https://terminaladdict.com/networking/linux/2019/09/13/DoH.html https://terminaladdict.com/networking/linux/2019/09/13/DoH.h...
  • ignoramous 7y ago
    cloudflared, knot-resolver, stubby, unbound, CoreDNS can be run as DoH and/or DoT stub and/or recursive resolvers, locally. The easiest stub resolver to setup would be nextdns' client: https://github.com/nextdns/nextdns https://github.com/nextdns/nextdns
• gyrgtyn 7y ago
  How likely is it that the other browsers will eventually do this?
  • Seenso 7y ago
    Very likely. IIRC, it's working its way into Chromium, and once it's there it will be everywhere. https://www.chromium.org/developers/dns-over-https https://www.chromium.org/developers/dns-over-https
• dmd 7y ago
  How does this work with hosts that are not resolvable outside your own network? If I tell firefox to go to internalsite.mycompany.com - which resolves internally, but not outside our network - how is firefox going to resolve it, if it's not using our DNS servers?
  • qmarchi 7y ago
    Correct. In order to preserve compatibility, Firefox's implementation has a "fallback" where if it sees that it can't resolve a domain, then it will fail back to using the system-configured DNS provider.
    • extra88 7y ago
      You can also exclude specific domains but at this point they have to be written in about:config. https://support.mozilla.org/en-US/kb/firefox-dns-over-https#w_excluding-specific-domains https://support.mozilla.org/en-US/kb/firefox-dns-over-https#... It looks like Firefox Policies can be used to enable, disable, or specify the DoH provider but cannot yet specify excluded domains. https://github.com/mozilla/policy-templates https://github.com/mozilla/policy-templates
  • colanderman 7y ago
    I wonder why they don't simply check if the user's resolv.conf is configured to resolve via a private IP address, and not use DoH if that's the case.
• ThePhysicist 7y ago
  I predict that DoH will break many enterprise infrastructures that rely on custom DNS servers. Unwary sysadmins that update Firefox will be in a lot of trouble when they switch this on by default. We ourselves have a custom DNS setup with an only internally resolvable TLD as a security measure, so this change will break our infra for all Firefox users (thankfully we’re in the EU so we’re spared, for now). Good thing that Cloudflare wants to centralize DNS and access control anyway, so those enterprises can just switch to their proprietary DNS service and VPN replacement, I guess ;)
  • snek 7y ago
    There is already support for enterprise situations like you describe: https://support.mozilla.org/en-US/kb/canary-domain-use-application-dnsnet https://support.mozilla.org/en-US/kb/canary-domain-use-appli...
    • ThePhysicist 7y ago
      Well, ok, but this requires updating all company DNS servers so it’s still far from ideal I would say. They should have done it the other way around: if the DNS returns a specific response enable DoH, otherwise leave it alone.
  • qmarchi 7y ago
    Firefox by default is configured with a fallback option, where if resolution would fail, it will fallback to the system-provided DNS servers. So your internal TLDs are safe. Additionally, if you've setup Firefox to be installed with Firefox for Enterprise, DoH is disabled by default and you've got nothing to worry about. DOH is able to be configured through GPO as well, allowing the use of a custom server.
    • alerighi 7y ago
      And that is even more dangerous, it would mean that if for some reason an identical domain extists on the internet (or somebody registers it to do an attack) then all the hosts will connect to the malicious external domain and not the correct host in the internal network. Local hosts should be resolved FIRST. Also cloudfare this way gets the DNS names of your internal hosts, you are leaking information that otherwise would be private, and system administrator will probably not think about that! Also with that option is not really secure at all, if somebody wants to intercept your DNS requests he can simply block the IPs of Cloudfare DNS over HTTPS server and then read the DNS requests unencrypted.
• snek 7y ago
  If you're about to comment on how dumb this is because SNI isn't encrypted please halt and search "ESNI"
  • gsich 7y ago
    Draft only. OpenSSL doesn't support it - because it's still a draft. So as of now, ESNI does not provide anything.
    • snek 7y ago
      It is moving forward, albeit slowly. With or without DoH/DoT, non encrypted SNI is a problem, and DoH/DoT have privacy improvements in their own right.
      • gsich 7y ago
        "moving forward" doesn't help anyone. Standards and more importantly, implementations count. In every DoH/DoT discussion there is someone who mentions ESNI, but without major level support this is a vague promise. Of course DNS encryption is still useful even without ESNI.
• mrtweetyhack 7y ago
  What's the point. All the Firefox extensions know ever site you visit. you're just denying it one but allowing others, sort of a gate keeper on who gets to pry
• raesene9 7y ago
  My feeling on this is that it's a pretty imperfect solution but unsurprising that the browser manufacturers are pushing it forward given ISPs dragging their heels on DoT. We saw the same problem with TLS. Until the browser makers started pushing it and Let's encrypt made it simple/free the take up of TLS was patchy at best. This will have negative effects on tools that use DNS for blocking/monitoring, but then those were a hack at best. If you want to understand the traffic flowing over your network, you need to invest in interception and parsing.
  • datenwolf 7y ago
    > ISPs dragging their heels on DoT WTH does DoT adoption by ISPs have to do with that?! One can run their own DNS recursive resolver-cache perfectly fine on their own hosts, or at the network edge, without relying on ISPs. Better yet: Since the Root zone and TLD zone DNS servers change only seldomly, you can prefetch and cache them locally just fine, and upon resolving a DNS skip two recursion steps. Apart from doing DPS, then ISPs will not "see" DNS queries, thus bypassing the privacy concerns of that.
    • ignoramous 7y ago
      > WTH does DoT adoption by ISPs have to do with that?! The ISPs need to support DoT server-side, at their end?
      • datenwolf 7y ago
        > The ISPs need to support DoT server-side, at their end? That's not how DNS works. Just put DoT capable cachine-resolvers onto each host, and you're golden. Those to even play nicely with enterprise infrastructure, like a local DNS.
    • raesene9 7y ago
      Most end users don't just "run their own recursive resolver-cache" They take whatever DNS server is provided by their ISP I'd guess that 99+% of Internet users have no idea how to run their own DNS server, let alone set up DoT.
• mattlutze 7y ago
  In order for Cloudflare (or anyone) to be a part of this program they have to comply with a particular set of rules. Limiting data. Your DNS data can reveal a lot of sensitive information about you, and currently DNS providers aren’t subject to any limits on what they can do with that data; we want to change that. Our policy requires that your data will only be used for the purpose of operating the service, must not be retained for longer than 24 hours, and cannot be sold, shared, or licensed to other parties. Yes, governments can secret around this with intelligence orders, just like they can do with any of the ISPs that will keep all of the data indefinitely instead of for 24 hours.
  • corford 7y ago
    Kind of sad when you need a private company to give your citizens the basic privacy they want (doubly so when you have to simply trust said company that the partners they are working with are honest). Maybe the US's privacy laws need a 21st Century make over?
  • the8472 7y ago
    > just like they can do with any of the ISPs There is a 3rd option: Operating your own recursive resolver.
    • kadoban 7y ago
      Doesn't that just move the problem one step away?
      • the8472 7y ago
        It removes a 3rd party that is a juicy target for TLAs. There is only you and the remote hosts that you're talking to. But yes, it would be really nice if we also had encryption between recursive resolvers and authoritative servers to remove the last place where they could harvest data.
    • kyuudou 7y ago
      I've found this harder and harder over the years. My usual MOD was installing and configuring the caching-nameserver BIND package in rpm-based RHEL-downstream distros and MaraDNS in everything else. I've just kind of given up because reasons but I'm still very supportive of any of these kinds of efforts.
• cracker_jacks 7y ago
  I guess most of the people against this change have been lucky enough to never live in a place where the internet is actively censored. It must be nice living in a place where you don't have to worry about access. But for many of us, there's no point in privacy without access.
  • bcrosby95 7y ago
    Why not make it opt in then?
• sandov 7y ago
  I think DoH itself is a good thing. What seems fishy though is hardcoding Cloudflare as the default DoH service.
  • sneak 7y ago
    It's absolutely not hardcoded.
    • sandov 7y ago
      Not technically, but you know what I mean.
      • sneak 7y ago
        In this forum, only you know what you mean until you write words. When you write a word like "hardcoded", which means a specific thing, is it not reasonable to expect people to think that you meant "not really hardcoded". As one of my favorite people told me once: words mean things. The words we use matter, as humans do not have telepathy.
        • sandov 7y ago
          Yeah, you're right.
• dheera 7y ago
  I wonder what the implications of DoH will be for TCP-over-DNS ...
• 0x49d1 7y ago
  Opera added the same option today too https://blogs.opera.com/desktop/2020/02/r2020-opera67-tidy-your-browsing/ https://blogs.opera.com/desktop/2020/02/r2020-opera67-tidy-y...
• LunaSea 7y ago
  Due to the Cloud Act, this is probably the end of Mozilla as a browser used in a business setting for non-US companies. A naïve protocol capsuled inside a stupid and dangerous protocol.
• corford 7y ago
  I'm getting pretty pissed off the with the arrogance of US internet tech companies sidestepping formal protocol design & industry adoption because it isn't moving "fast enough" for them. Without ESNI, DoH is essentially meaningless for the class of privacy invaders it is supposed to combat against. By the time ESNI is out, DoT would have had enough time to mature and gain wide enough adoption. DoT is better because at least it's obvious if your ISP/Gov is blocking port 853 (at which point you install a VPN or run your own resolver somewhere and tunnel to it or swap provider or move country). Meanwhile you get all the usual benefits of decentralised DNS resolution and don't have to worry about the unforeseen overhead and bullshit DoH is going to spwan. Firefox is an app for browsing websites. What business does it have pushing a half baked compromise solution that undermines core infrastructure, creates a false sense of privacy and introduces second order effects that will result in DNS lookups being centralised in to the hands of a few giant US corporations (at least changing to 1.1.1.1 or 8.8.8.8 was opt-in). Also can't wait for the inevitable instances of Cloudflare deciding not to resolve certain domains (effectively becoming the de-facto arbitrator of what most FF users can and cannot see on-line). For a preview of that, try going to archive.is with 1.1.1.1 as your resolver. Ultimately, all of this is moot anyway (even once ESNI arrives). Regardless of DNS, your device still needs to connect to an IP. Entities interested in where you are going will still be able to get reasonable insight by simply correlating IP addresses and CT logs (http://blog.seanmcelroy.com/2019/01/05/ocsp-web-activity-is-not-private/ http://blog.seanmcelroy.com/2019/01/05/ocsp-web-activity-is-...). The only decent solution to this, and available right now, is a VPN (at which point DNS privacy is automatically solved for you). If Paul Vixie thinks DoH is a bad idea then... it's a bad fucking idea: https://twitter.com/paulvixie/status/1053765281917661184 https://twitter.com/paulvixie/status/1053765281917661184
  • ajphdiv 7y ago
    Seems to be a trend lately. Google recently announced they will start blocking downloads from http websites. Doesn't sound like a bad idea -- but isn't this more a discussion for IETF as well?
    • corford 7y ago
      The discussion should be around improved UX/UI and better protocols rather than treating people like idiots and abusing your power to unilaterally force behaviour changes on web content providers and consumers. The more I think about it the more I realise Microsoft's and AOL's instincts were right. Make the internet a walled garden and insert yourself as the gatekeeper. Their mistake was to do this too early. ~25 years later and the people are now finally ready and willing to allow billion dollar coporates to overtly "manage" their on-line experience for them. Companies love this too because it removes yet one more unseemly shackle from their ambition (i.e. that of needing to work collaboratively with potential competitors) while at the same time providing them with a nice vector to defend their quasi monopoly.
• simias 7y ago
  This is kind of a sub-issue but from the infographic in TFA: >Q. Will DoH lead to a greater centralization of DNS, which will be bad for the Internet as a whole? >A. We agree that centralization is bad for the Internet. Today in practice, DNS is >centralized because consumer devices are locked to the DNS service of the ISPs. >And just five companies control over 80% of the US broadband internet market. For one thing, 5 independent providers within the same country is not exactly centralized in my opinion. As far as I understand it Americans don't always effectively have the choice of which ISP they can use, but that's not a technological problem. You won't solve monopolistic and anti-competitive practices with a new layer 7 protocol. Furthermore what does Mozilla mean by "locked to the DNS service of the ISPs", do they block DNS queries to other services? Here in Europe I can switch to a different DNS any time I want. Sure, it's easier to stick with the defaults and most people will do that but "locked" is a strong word which I suspect is inaccurate in this case. By that definition of "centralized" you could argue that email is effectively centralized since most people just use the free service provided by a handful of providers. >The immediate impact of Mozilla enabling DoH in Firefox will be less >centralization, not more because it shifts traffic away from large ISPs, and >provides users with more choice, while respecting enterprise DNS >configurations. So 5 ISPs meant that the service was effectively centralized, but (at this time) two competing DoH services with Cloudflare selected by default is "less centralization"?
  • jchw 7y ago
    > do they block DNS queries to other services? Some providers use MitM attacks on DNS queries, to do things like block content or replace NXDOMAIN with SPAM. (Probably obviously, this is not possible with DoH.)
• abstractbarista 7y ago
  So FireFox will now not simply query my internal DNS server? Good luck with that, because I've disabled outbound DNS except from that server. Guess I'm not using FireFox any more. :(
• chupa-chups 7y ago
  I just uninstalled firefox and switched to chromium for good (or bad).
• np_tokumei 7y ago
  We just published our proposal of a decentralized DoH resolution to address this exact problem of single-point-of-trust/failure. As Firefox is looking for more reliable partners for their "Trusted Recursive Resolver program", we strongly believe and hope that "K-resolver" will be seriously considered as an option to improve DNS privacy for not only Firefox users, but also the general Internet. https://twitter.com/NP_tokumei/status/1220802795512578048?s=20 https://twitter.com/NP_tokumei/status/1220802795512578048?s=... https://arxiv.org/pdf/2001.08901 https://arxiv.org/pdf/2001.08901
• tosh 7y ago
  More information about data retention requirements for DOH-resolver partners: https://wiki.mozilla.org/Security/DOH-resolver-policy https://wiki.mozilla.org/Security/DOH-resolver-policy
• therealmarv 7y ago
  So all WiFi logins which abuse & hack DNS weaknesses like airports & hotels don't work with Firefox anymore?
• justlexi93 7y ago
  In an effort to further protect the privacy of its users online, Firefox has begun rolling out encrypted DNS over HTTPS (DoH) by default for US-based users. To be honest I don't use Firefox that much compared to Chrome.
• dsr_ 7y ago
  https://bugzilla.mozilla.org/show_bug.cgi?id=1614751 https://bugzilla.mozilla.org/show_bug.cgi?id=1614751 Firefox won't bother checking the canary domain if the user clicked "OK" to the DNS-over-HTTPS question.
  • Spivak 7y ago
    ITT: Some very annoyed sysadmins that didn’t read the enterprise deployment guide and who apparently rely on “pretty please don’t exfiltrate data” as their enforcement mechanism. Are they surprised that a change made in the name of preventing your local network operator from slurping your DNS information doesn’t create a way for local network operators to just ignore DoH and slurp DNS information?
• gonational 7y ago
  I’m gonna get some heat for this, but that’s OK; it’s my honest opinion. I can’t really think of a better way to hamper progress on an open specification then by delegating the problem to some private corporation; especially one that has a penchant for censorship. If more than .0003% of people actually used Firefox, we would have to worry about Cloudflare taking over the entire Internet. So it’s probably a good thing Mozilla ruined their brand over the past decade. I would be willing to bet money that Mozilla is getting paid millions of dollars by Cloudflare for this. In the meantime, this is the final straw for me. I’m done with Firefox for life. I haven’t used anything but Firefox since 2007... 13 years...
• pctammela 7y ago
  Oh well, I just hope this enforcing new third parties to my internet browsing doesn't catch on. Guess I will disable it.
• neop1x 7y ago
  Will /etc/hosts still work? I was surprised it is ignored completely after DNS over HTTPS is enabled. I don't see why it can't first consult this standard local source regardless of DoH. This is making development more painful. Similarly to how Android stopped supporting locally-installed custom CA certificates globally for all apps, making HTTPS debugging impossible. :(
• dannyw 7y ago
  What's to stop ISPs from simply setting the canary and turning off DoH?
• xg15 7y ago
  One point I haven't seen covered yet is split-horizon DNS where there are actually servers listening on both sides of the horizon (though possibly different ones). Example #1: I have a personal server running at home that is reachable from the internet through a PageKite tunnel. It's reachable through a public address of the form https://xyz.pagekite.me https://xyz.pagekite.me. The connection is secured by a Let's Encrypt certificate, which means I have to use this address to avoid HTTPS errors and the domain has to be reachable from the internet so I can fulfill challenges. However, I'd also like to access the server from my LAN without an unnecessary round-trip through the internet: I might want to avoid unnecessary data costs or display certain content only available to LAN clients. So from the internet, the domain should resolve to the PageKite tunnel, but inside the LAN, the domain should resolve directly to the server's LAN address. This is relatively easy to accomplish using traditional DNS: Just set up a local DNS server that serves the LAN address. However, how do you do that with DoH? Example #2: You want to set up an internet router at home. The instructions ask you to connect to www.routerlogin.net to pull up the web interface. The domain is split-horizon: When requested through the router, it will resolve to the router's internal address and be served by the router's internal web server. When requested from the internet, it will point to a generic info page from the vendor. Now with DoH, you'd always see the generic info page, even when connecting through the router.