17 ms·

I'm so sad to see Mozilla move forward with this massive attack on user privacy. Firefox DoH is snake oil, plain and simple. It sends all the users DNS querie

by nullc 7y ago

I'm so sad to see Mozilla move forward with this massive attack on user privacy. Firefox DoH is snake oil, plain and simple. It sends all the users DNS queries to Cloudflare, adding a new party which can surveil the user's traffic (and can be legally compelled to do so and not disclose this fact)-- providing a convenient choke point to save spies and hackers the trouble and exposure of extracting the data from tens of thousands of individual ISPs. Simultaneously, it does not protect the user from monitoring by their ISP or parties situated there because the user's destination IPs remain unencrypted, as well as the hostnames via SNI (for cases of shared hosting, e.g. on cloudflare, where the IP alone wouldn't be enough). At the moment you can disable this across your whole lan by blocking traffic to 104.16.248.249, 104.16.249.249, 2606:4700::6810:f8f9, and 2606:4700::6810:f9f9 and by DNS blackholing use-application-dns.net and cloudflare-dns.com. iptables -t raw -A PREROUTING -d 104.16.248.249 -j DROP iptables -t raw -A PREROUTING -d 104.16.249.249 -j DROP ip6tables -t raw -A PREROUTING -d 2606:4700::6810:f8f9 -j DROP ip6tables -t raw -A PREROUTING -d 2606:4700::6810:f9f9 -j DROP And if you're using bind: zone "use-application-dns.net" { type master; file "/etc/bind/db.empty"; }; zone "cloudflare-dns.com" { type master; file "/etc/bind/db.empty"; }; Or unbound: local-zone: "use-application-dns.net" static local-zone: "cloudflare-dns.com" static But there is no guarantee that these mitigations will continue to work. [Edit: Aside, this comment and many/most(?) comments on this thread were moved from a more recent thread with a headline "Firefox turns on DoH as default for US users". The new title which omits the on-as-default, is kinda burying the lead.]

mtberatwork 7y ago
> We continue to explore enabling DoH in other regions, and are working to add more providers as trusted resolvers to our program. DoH is just one of the many privacy protections you can expect to see from us in 2020. Cloudflare is just one of the initial providers and they indicate that they are adding more. Also, I'm assuming you can add your own custom provider based on the screenshot in the article. You can just disable the feature as well.
- ThePhysicist 7y ago
  99 % of users won’t touch default values, so it’s not a valid excuse. I really have come to the conclusion that privacy is just a marketing feature for Mozilla. They e.g. also do nothing against data exfiltration by popular extensions although they have known that issue for years. If they’re really serious about privacy they should have waited to implement DoH as an open standard and allow more DNS providers to support it. The browser could then simply see if your default DNS supports it and if yes switch to DoH. This really smells like some kind of data deal between them and Cloudflare. This is not surprising because DNS data is really valuable and passive DNS monitoring is used for many purposes, e.g. security and marketing. Controlling this data gives you many interesting business opportunities, hence I can understand why Cloudflare and Google are after it. It’s also revealing that they don’t enable this in the EU, because they rightfully fear that it’s not compliant.
  - cnst 7y ago
    > I really have come to the conclusion that privacy is just a marketing feature for Mozilla. They e.gg. also do nothing against data exfiltration by popular extensions although they have known that issue for years. I thought about this recently, and the move to HTTPS-Everywhere is the biggest issue here. In the old days, you could have something like the @guard firewall on Windows, which could examine all outgoing HTTP connections, and block ads and malware by examining not just the hostname, but also the URI of each request. This meant it was separate from the browser, worked with all browsers, and didn't break every time your browser is updated. It's pretty easy to write a similar tool on UNIX to act as a proxy, too, and make it network-wide through your OSS router. Nowdays, because it's all encrypted with certificate authorities and all, it's much more problematic to block ads and malware, because then you'd also have to intercept HTTPS, and manage certificate authorities and such. I guess it's still doable in principle, just more involved, with a considerably worse UI? Has anyone tried anything like that in the HTTPS world, do any solutions exist as FLOSS at all?
    - munchbunny 7y ago
      Intercepting HTTPS is possible, but not easy. It just requires configuring your browser to use a known key pair for client authentication so that you can MITM yourself from a local or network proxy. On the consideration of trade-offs, I think HTTPS-Everywhere is completely worth it. It may be more complex to intercept your own traffic, but since you are in control of one of the endpoints and the ISPs (which in the US are openly trying to market your browsing data) are not, I still consider it an overall win for privacy.
Jerry2 7y ago
> It sends all the users DNS queries to Cloudflare I wonder how much Cloudflare paid for this 'privilege' of being the default DNS provider.
- nullc 7y ago
  Mozilla claims that Cloudflare is not paying them, and claims that they have a contract with cloudflare which prohibits them from selling the data. I don't think that this improves the situation substantially. The history of internet privacy failures is full of empty and unrealized promises, and no amount of contracts or promises can trump a court order or a NSL. "Has no ability to collect" is the gold standard, and the only level of protection that guards against compromise and blanket state surveillance activities. AFAIK they also have never published the contract itself, though doing so wouldn't address the above points. Edit: After carefully reading the cloudflare privacy statement ( https://developers.cloudflare.com/1.1.1.1/commitment-to-privacy/privacy-policy/firefox/ https://developers.cloudflare.com/1.1.1.1/commitment-to-priv... ) I believe it unambiguously states they will collect "aggregate data" such as how much traffic each specific domain is receiving and use it for their own 'development' purposes. To me this seems extraordinarily valuable by itself, quite a windfall.
  - Karunamon 7y ago
    Agreed. Unless that contract includes heavy penalties for selling and/or losing that data, its toothless nonsense. The fact that the contract hasn't been published is also problematic. If everything is above board, why hide?
    - nullc 7y ago
      To be fair, publishing contracts like that isn't a standard practice. That alone is a sufficient explanation. It still would be better if it were.
      - Karunamon 7y ago
        Mozilla isn't a standard company and this isn't a standard situation.
cnst 7y ago
> But there is no guarantee that these mitigations will continue to work. This is the biggest problem. It used to be that Firefox was on your side, but now it's turning into the we-know-better-than-our-users Chrome, where they don't even feel like guaranteeing that disabling this malicious and unwarranted service today will continue to leave it disabled tomorrow.
JohnFen 7y ago
My concern about DoH is that it gives marketers and other spies the ability to do DNS lookups while evading my defenses -- regardless of whether or not I'm allowing my browser or other software to use DoH. The only solution to the problem that I could come up with was to install a MITM proxy in my LAN so that I can detect and filter any sneaky DNS lookups. I'm still very peeved that Mozilla has forced me to take such measures.
- shawnz 7y ago
  How does DoH allow marketers to do anything they couldn't have done before by just hardcoding their own DNS server? It might make it harder to block queries by deep packet inspection, but do you actually do that on your network right now?
  - JohnFen 7y ago
    Marketers using hardcoded private servers are the easiest thing to defend against: just block those servers. That fact is one of the big reasons why marketers and other spies don't do that -- they use DNS lookups to find the mother ship. However, now marketers can use DoH, combined with public servers that would cause disruption to block, to be able to engage in lookups without a means of detecting or blocking them short of doing a MITM setup. > do you actually do that on your network right now? Yes, I installed it months ago to defend myself against DoH. I MITM all HTTPS connections, detect DoH lookups, and block them.
    - shawnz 7y ago
      If you are going to that level of effort then why not just block the IPs of the marketing servers themselves?
      - JohnFen 7y ago
        That is an ineffective approach for a number of reasons. This is essentially a blacklist approach, and blacklist approaches are very weak. The number of such servers is in the several thousands, at least. They also move and new ones spin up, requiring constant updating of the blacklist. It's much more effective to take a whitelist approach or, what I do, just block the DNS lookups for them all. (That said, I do keep such a blacklist, as one small part of my multilayered security approach.)
ajross 7y ago
This seems unnecessarily alarmist. DNS over HTTP doesn't protect against state-level legally-mandated surveillance because it's not designed to protect against state-level legally-mandated surveillance. There are no solutions to the problem you posit that don't involve SOME kind of trusted name authority somewhere that is, effectively by argumentative fiat (i.e. not really) "out of the reach" of whatever government it is that you don't trust. That's not something you're going to find a technical solution for. The real problem addressed by DoH is the routine surveillance and hijacking of "presumptively public" names by local network operators. And it works comparatively well for that.
- nullc 7y ago
  By "comparatively well" you mean defeated in bulk by deploying sampled netflow with a couple lines of router configuration-- which almost all major ISPs already have deployed for monitoring purposes.
Seenso 7y ago
> Firefox DoH is snake oil, plain and simple... Correct me if I'm wrong, but the concern I have about browser-controlled DoH is that it seems like it could make it harder for a tech-savvy user to assert control over their own network. IIRC, most network-level ad-blocking operates at the DNS level. I've also personally blocked telemetry by setting my router's DNS proxy to resolve certain telemetry servers to 0.0.0.0. It's my understanding that DoH would bypass that. Couple that with Google's planned neutering of Chrome's ad-blocking API, and it seems like it will become increasingly hard for end-users to avoid ads. And the fact that DoH uses HTTP seems like it would make it impractical to block as a protocol. I think I would have preferred an encrypted DNS protocol that ran on its own port, at least.
- pretty_bubbles 7y ago
  If you use the nextdns DoH provider in Firefox you can actually configure your own adblocking domains even when you're moving around across networks. Just FYI
  - nullc 7y ago
    > If you use the nextdns DoH provider in Firefox you can actually configure your own adblocking domains even when you're moving around across networks. Uh. Doesn't this prove that Firefox's DOH implementation is sending strong per-user identifying information to the server?
    - plttn 7y ago
      That’s what nextDNS offers (basically pihole in the cloud). And that only works by hitting a specific subdomain or endpoint on nextdns.io. If you’re hitting cloudflare, it’s just hitting the regular endpoint so no user identifying information.
      - nullc 7y ago
        Ah. Thanks! Makes sense.
    - 7y ago
noja 7y ago
It's a balance. Do you want your plaintext DNS request sent to starbucks or your local unsecured public wifi, or do you want it sent encrypted to your DoH server of choice?
- jp_sc 7y ago
  I can use a VPN when browsing on those kind of networks.
  - raesene9 7y ago
    That's fine for more technical users who are aware of how to mitigate this kind of issue, but then those same more technical users will also likely know how to disable DoH. For the majority of users who may not understand the risks around plain text DNS, there are advantages to it being encrypted.
    - syshum 7y ago
      This has always been a poor argument. Especially for FF which is mainly used by Technical people Chrome a d IE are used by people that do not understand the risks around DNS I use FF because I am / was tried of IE and Chrome telling me how I should use thier software, now Mozilla is making the same moronic choices for me instead of empowering users DoH should be Opt-In, not Opt-Out
      - raesene9 7y ago
        You using FFox because you're technical, doesn't mean a majority of FFox's user base is technical. Technical users (like yourself) can just easily disable DoH, problem, for you, solved :)
    - ethagnawl 7y ago
      "Good" VPNs also aren't usually/ever? free.
      - 7y ago
Jonahgay 7y ago
You know you can put your own doh server into the browser.
geophertz 7y ago
Unfortunately it's not so easy to black hole `use-application-dns.net` for parental control. (people don't run their own DNS server).
- nullc 7y ago
  FWIW, I've found that running a local unbound server with moderately aggressive caching makes a visible improvement in browsing speed. For us technical folks, it worth doing for the speed up even without getting into the configurability/privacy implications.
  - basilgohar 7y ago
    I have had the exact same experience. It's one of the first things I verify whenever I connect from a new location – are my queries being resolved by my local unbound or not.
simias 7y ago
It's also yet an other instance of the web browser taking over something that (IMO) ought to belong to the OS. Now with DoH if I have DNS issues I have to figure out if it's related to the browser's DNS or the system DNS. I can't use command line tools like dig or ping to troubleshoot the issue because it's not what the browser is doing. If DoH is so great I want to enable it for all my applications, not just my web browser. People, let's just rip off the bandaid and make Chrome and Firefox bootable already, who needs the kernel overhead when the browser is going to reimplement the entire stack itself anyway. Also let's just make TCP only work on ports 80 and 443 because clearly the rest doesn't really serve any purpose anymore.
- mondoshawan 7y ago
  Chrome is bootable already. ChromeOS. :P
- ecnahc515 7y ago
  You can definitely do DNS over HTTPS/TLS for everything if you run your own DNS server, either locally or somewhere on your network. I do this, and it works great, both methods have their own advantages and disadvantages of course.
deg4uss3r 7y ago
I use cloud nine because I dont' like CF: https://dns9.quad9.net/dns-query https://dns9.quad9.net/dns-query
sneak 7y ago
> Firefox DoH is snake oil, plain and simple. This is not an accurate statement, for the commonly accepted definition of "snake oil". Your privacy concerns are, from an angle, legitimate (although encrypted protocols, as a general rule, are more private than plaintext protocols), but this is a bit over the top. TFA also mentions that they are partnering with NextDNS, so your claims about centralization are on shaky ground, too. I personally use NextDNS on my whole LAN. They're great!
- freeAgent 7y ago
  I think his point is about the default behavior pointing to Cloudflare. Unless the user changes the DNS provider setting, everyone will be on Cloudflare. With that said, I think this is pretty over-the-top. Part of the reason Cloudflare is the default (and NextDNS is an option) is because they are abiding by Mozilla's Trusted Recursive Resolver policy: https://wiki.mozilla.org/Security/DOH-resolver-policy https://wiki.mozilla.org/Security/DOH-resolver-policy The only way Cloudflare itself can cause users a privacy issue through the use of its DNS service is by lying to them. They have already agreed not to sell or grant the data to any third party or use it for advertising, etc. The other concern nullc has is that hackers will infiltrate Cloudflare because it will now contain data on all US Firefox users' DNS queries unless those users change default settings. OK. I guess. However, I will say that I trust Cloudflare a whole heckuva lot more than I trust Comcast, Charter, AT&T, Verizon, etc. to be practicing good security. There are also probably more people on the mega ISPs than there are Firefox users, and many DNS queries these days originate from platforms that aren't even PCs (such as home theater streaming sticks) which will still be pinging default DHCP-received DNS providers. If anything, I see this decentralizing DNS request data.
  - nullc 7y ago
    The mozilla policy allows cloudflare to permanently store and exploit per-domain-name but not per user data. So even going by the letter of the policy and considering cloudflare alone there is still a privacy loss. Moreover, the current legal standard in the US is that users have no expectation of privacy for data that third parties have stored about their activity. As a result there is potentially limited to no due process protection for user information in this scheme. Cloudflare could be required to turn the information over via an administrative subpoena and without the oversight of even a court or any ability for the impacted users to learn about or challenge the surveillance. > I will say that I trust Cloudflare a whole heckuva lot more than I trust Comcast, Charter, AT&T, Verizon, etc. to be practicing good security Than any one of them? I could imagine that. Than all? Cloudflare is a much bigger target. > I see this decentralizing DNS request data. Could you elaborate on that? I see this as massively centralizing DNS request data (onto cloudflare) and this change is the most problematic part of the whole thing.
j0057 7y ago
SNI is not a good argument, there is work being done to encrypt that as well in TLS 1.3 with Encrypted SNI[1]. [1] https://blog.cloudflare.com/encrypted-sni/ https://blog.cloudflare.com/encrypted-sni/
- the8472 7y ago
  ESNI only helps if you're fronting through things like cloudflare, again putting more eggs and information into a single basket and making them a more valuable target for TLAs.
  - comex 7y ago
    True, centralization is a downside. But the alternative is having no privacy from government agencies. Even if you somehow believe your ISP won't be subject to these hypothetical interception orders that CloudFlare would be subject to (why?), there are plenty of points to tap in between your ISP and the website you're visiting.
- throw0101a 7y ago
  There's a tcp/443 connection to 208.80.153.224, what site could it be? $ whois 208.80.153.224 NetRange: 208.80.152.0 - 208.80.155.255 CIDR: 208.80.152.0/22 NetName: WIKIMEDIA NetHandle: NET-208-80-152-0-1 Parent: NET208 (NET-208-0-0-0-0) NetType: Direct Assignment OriginAS: AS14907 Organization: Wikimedia Foundation Inc. (WIKIM) RegDate: 2007-07-23 Updated: 2014-01-29 Comment: http://www.wikimediafoundation.org http://www.wikimediafoundation.org Ref: https://rdap.arin.net/registry/ip/208.80.152.0 https://rdap.arin.net/registry/ip/208.80.152.0
  - mike-cardwell 7y ago
    mike@blob:~$ host 208.80.153.224 224.153.80.208.in-addr.arpa domain name pointer text-lb.codfw.wikimedia.org. mike@blob:~$ openssl s_client -connect 208.80.153.224:443 2>&1 | openssl x509 -text|grep Subject: Subject: C = US, ST = California, L = San Francisco, O = "Wikimedia Foundation, Inc.", CN = *.wikipedia.org Yeah, our ISPs are going to be totally in the dark thanks to DoH. /s
rogueresearch 7y ago
Looks like people are also working on block lists that work with pfBlockerNG and pfSense, ex: https://old.reddit.com/r/pfBlockerNG/comments/d3p1gf/doh_server_blocklist/ https://old.reddit.com/r/pfBlockerNG/comments/d3p1gf/doh_ser...
badrabbit 7y ago
Your ISP is literally selling this information right now in the US. What are you even talking about? Use google if you don't like CF, or just disable it! Do a little threat modeling here please. Let's say CF sells this data, what do they know about you other than your IP and the sites you visit? While your ISP,employer,school,etc... Can tie that activity to you as a person. Being compelled legally? I did not know privacy meant breaking laws, suddenly law enforcement can't do the same thing with your ISP dns? This is not adding a new party that can surveil you, this is reducing risk by separating who can see your DNS from who can see your traffic. The idea is to have eSNI ubiquity to where TLS traffic will conceal the sites you visit while DoH will conceal the traffic metadata. Oh, and beauty of DoH: you can run it through a web proxy, and if you have alot of users behind a NAT it becomes very hard to pin point which actual machine generated the DNS lookup.
- OrgNet 7y ago
  Your ISP can still see the IPs that you are talking to... What are you talking about? They can even see the url even if you dont use them as your DNS
  - e12e 7y ago
    > They can even see the url Only for plaintext http. For ssl/https - the hostname/ip can leak with SNI, but should be safe with ESNI (encrypted SNI). The URL should be in the request, which comes after the TLS handshake (hence SNI, so that the server can pick a certificate before knowing the HTTP HOST header). SNI is a problem - but not much worse than the fact that a mitm can see who talks to who (IP) - IMNHO.
    - nullc 7y ago
      ESNI is not in use yet (or just doesn't work). Start up tcpdump and check yourself. At best even it were currently use it only provides protection for sites which are hosted behind DOS mitigation services. (usually cloudflare...)
      - 7y ago
demarq 7y ago
> It sends all the users DNS queries to Cloudflare, adding a new party it removes many parties (some unknown) who have no legal oversight, and adds a select parties who are legally bound to respect your privacy. > because the user's destination IPs remain unencrypted This makes no sense. your ISP cannot see that you are visiting facebook because the IP shows up us cloudflare urrrghhh! > At the moment you can disable this across your whole lan now that is a "massive attack on user privacy"
- nullc 7y ago
  > who are legally bound to respect your privacy. Come on, this is an overstatement. They have a non-public contract with mozilla. What happens if they break it and get caught? Probably the only consequence is that firefox stops using cloudflare ... eventually. Look at what has happened with misbehaving CAs. The responses have ranged between nothing and removing them 5 years later. > your ISP cannot see that you are visiting facebook because the IP shows up us cloudflare Yes they can, it's visible directly in the https requests as SNI. (not to mention in the sizes of traffic that go through). > now that is a "massive attack on user privacy" How so? If anything it's just another example at how this DoH approach does not actively protect users from ISPs.
  - tialaramex 7y ago
    > Look at what has happened with misbehaving CAs. OK. Perhaps you have some examples in mind? > The responses have ranged between nothing and removing them 5 years later. Certainly you've got an example of "nothing" and of "removing them 5 years later" to start with, right? DigiNotar is the most obvious example of a "misbehaving CA" that you might be concerned about. In June 2011 their services were broken into and they decided not to tell anybody. There were no technologies in place at that time which could detect problems like this without DigiNotar's assistance. At the end of August a google.com certificate issued this way was used to attack Iranian web users, but Google's Chrome browser had pinning protection (only for Google's own services) and so at this point it detected the attack in progress. Mozilla shipped updated Firefox versions which distrusted DigiNotar's public root in about 48 hours (not "5 years") and over subsequent days distrusted the entire DigiNotar hierarchy including those parts the Dutch national government had insisted were fine (they were not fine). The public reactions at the time mirror your incredulity by the way, people who grep'd their newly updated Firefox and discovered DigiNotar's CA certificate (in fact blacklisted explicitly) as "proof" of a conspiracy by Mozilla to send all their traffic to some scary foreign company. Perhaps DigiNotar just isn't recent enough for you. So let's look at rather smaller deviations from the more recent past. In 2015 WoSign (a QiHoo 360 company which operated a CA) acquired the Israeli CA StartCom in secret. No significant countries have any mechanism in place to detect this (a potentially hostile acquisition of a private company) and so the browser vendors had no idea until mid-2016. Not telling Mozilla about this was already a violation of both agreements (for WoSign and for StartCom). But in 2016 WoSign/ StartCom (now one shared controlling mind) minted new certificates using SHA-1 signatures for several outfits, notably an Australian financial services company named Tyro. Since new SHA-1 certificates were prohibited in browsers in 2016 these certificates were back-dated to appear they'd been issued in 2015, another violation of the rules. The Tyro cert was probably actually issued in June 2016. After conducting an investigation which included having Israeli documents assessed by a Hebrew-speaking lawyer and a bunch of digital forensics work, by September of that year Mozilla was instituting partial distrust of WoSign and StartCom, and in 2017 the browser distrusted them entirely. Other vendors followed suit (very belatedly in the case of Microsoft).
abstractbarista 7y ago
I don't care if my ISP knows I visit reddit.com. I do care if they know I visit reddit.com/r/something I'm already protected by TLS for the latter. Newer TLS will eventually protect me from the former (in combination with DNS encryption).
- mike-cardwell 7y ago
  > I'm already protected by TLS for the latter. True > Newer TLS will eventually protect me from the former (in combination with DNS encryption). False. Your ISP will see a port 443 connection to 151.101.121.140 and then lookup that IP in whichever of the numerous IP->Website DB's they're using and discover you visited Reddit. DoH didn't hide from your ISP that you visited Reddit. It just added Cloudflare to the list of orgs that know about it. Potential fix: Centralise HTTP behind a handful of shared IP addresses so the IP->Website mapping isn't so easy. Did somebody say Cloudflare?
pitterpatter 7y ago
If you can run iptable commands or run bind you can certainly go to the Firefox options and disable/change DoH there?

by nullc 7y ago

mtberatwork 7y ago

> We continue to explore enabling DoH in other regions, and are working to add more providers as trusted resolvers to our program. DoH is just one of the many privacy protections you can expect to see from us in 2020. Cloudflare is just one of the initial providers and they indicate that they are adding more. Also, I'm assuming you can add your own custom provider based on the screenshot in the article. You can just disable the feature as well.

ThePhysicist 7y ago
99 % of users won’t touch default values, so it’s not a valid excuse. I really have come to the conclusion that privacy is just a marketing feature for Mozilla. They e.g. also do nothing against data exfiltration by popular extensions although they have known that issue for years. If they’re really serious about privacy they should have waited to implement DoH as an open standard and allow more DNS providers to support it. The browser could then simply see if your default DNS supports it and if yes switch to DoH. This really smells like some kind of data deal between them and Cloudflare. This is not surprising because DNS data is really valuable and passive DNS monitoring is used for many purposes, e.g. security and marketing. Controlling this data gives you many interesting business opportunities, hence I can understand why Cloudflare and Google are after it. It’s also revealing that they don’t enable this in the EU, because they rightfully fear that it’s not compliant.
- cnst 7y ago
  > I really have come to the conclusion that privacy is just a marketing feature for Mozilla. They e.gg. also do nothing against data exfiltration by popular extensions although they have known that issue for years. I thought about this recently, and the move to HTTPS-Everywhere is the biggest issue here. In the old days, you could have something like the @guard firewall on Windows, which could examine all outgoing HTTP connections, and block ads and malware by examining not just the hostname, but also the URI of each request. This meant it was separate from the browser, worked with all browsers, and didn't break every time your browser is updated. It's pretty easy to write a similar tool on UNIX to act as a proxy, too, and make it network-wide through your OSS router. Nowdays, because it's all encrypted with certificate authorities and all, it's much more problematic to block ads and malware, because then you'd also have to intercept HTTPS, and manage certificate authorities and such. I guess it's still doable in principle, just more involved, with a considerably worse UI? Has anyone tried anything like that in the HTTPS world, do any solutions exist as FLOSS at all?
  - munchbunny 7y ago
    Intercepting HTTPS is possible, but not easy. It just requires configuring your browser to use a known key pair for client authentication so that you can MITM yourself from a local or network proxy. On the consideration of trade-offs, I think HTTPS-Everywhere is completely worth it. It may be more complex to intercept your own traffic, but since you are in control of one of the endpoints and the ISPs (which in the US are openly trying to market your browsing data) are not, I still consider it an overall win for privacy.

Jerry2 7y ago

> It sends all the users DNS queries to Cloudflare I wonder how much Cloudflare paid for this 'privilege' of being the default DNS provider.

nullc 7y ago
Mozilla claims that Cloudflare is not paying them, and claims that they have a contract with cloudflare which prohibits them from selling the data. I don't think that this improves the situation substantially. The history of internet privacy failures is full of empty and unrealized promises, and no amount of contracts or promises can trump a court order or a NSL. "Has no ability to collect" is the gold standard, and the only level of protection that guards against compromise and blanket state surveillance activities. AFAIK they also have never published the contract itself, though doing so wouldn't address the above points. Edit: After carefully reading the cloudflare privacy statement ( https://developers.cloudflare.com/1.1.1.1/commitment-to-privacy/privacy-policy/firefox/ https://developers.cloudflare.com/1.1.1.1/commitment-to-priv... ) I believe it unambiguously states they will collect "aggregate data" such as how much traffic each specific domain is receiving and use it for their own 'development' purposes. To me this seems extraordinarily valuable by itself, quite a windfall.
- Karunamon 7y ago
  Agreed. Unless that contract includes heavy penalties for selling and/or losing that data, its toothless nonsense. The fact that the contract hasn't been published is also problematic. If everything is above board, why hide?
  - nullc 7y ago
    To be fair, publishing contracts like that isn't a standard practice. That alone is a sufficient explanation. It still would be better if it were.
    - Karunamon 7y ago
      Mozilla isn't a standard company and this isn't a standard situation.

cnst 7y ago

> But there is no guarantee that these mitigations will continue to work. This is the biggest problem. It used to be that Firefox was on your side, but now it's turning into the we-know-better-than-our-users Chrome, where they don't even feel like guaranteeing that disabling this malicious and unwarranted service today will continue to leave it disabled tomorrow.

JohnFen 7y ago

My concern about DoH is that it gives marketers and other spies the ability to do DNS lookups while evading my defenses -- regardless of whether or not I'm allowing my browser or other software to use DoH. The only solution to the problem that I could come up with was to install a MITM proxy in my LAN so that I can detect and filter any sneaky DNS lookups. I'm still very peeved that Mozilla has forced me to take such measures.

shawnz 7y ago
How does DoH allow marketers to do anything they couldn't have done before by just hardcoding their own DNS server? It might make it harder to block queries by deep packet inspection, but do you actually do that on your network right now?
- JohnFen 7y ago
  Marketers using hardcoded private servers are the easiest thing to defend against: just block those servers. That fact is one of the big reasons why marketers and other spies don't do that -- they use DNS lookups to find the mother ship. However, now marketers can use DoH, combined with public servers that would cause disruption to block, to be able to engage in lookups without a means of detecting or blocking them short of doing a MITM setup. > do you actually do that on your network right now? Yes, I installed it months ago to defend myself against DoH. I MITM all HTTPS connections, detect DoH lookups, and block them.
  - shawnz 7y ago
    If you are going to that level of effort then why not just block the IPs of the marketing servers themselves?
    - JohnFen 7y ago
      That is an ineffective approach for a number of reasons. This is essentially a blacklist approach, and blacklist approaches are very weak. The number of such servers is in the several thousands, at least. They also move and new ones spin up, requiring constant updating of the blacklist. It's much more effective to take a whitelist approach or, what I do, just block the DNS lookups for them all. (That said, I do keep such a blacklist, as one small part of my multilayered security approach.)

ajross 7y ago

This seems unnecessarily alarmist. DNS over HTTP doesn't protect against state-level legally-mandated surveillance because it's not designed to protect against state-level legally-mandated surveillance. There are no solutions to the problem you posit that don't involve SOME kind of trusted name authority somewhere that is, effectively by argumentative fiat (i.e. not really) "out of the reach" of whatever government it is that you don't trust. That's not something you're going to find a technical solution for. The real problem addressed by DoH is the routine surveillance and hijacking of "presumptively public" names by local network operators. And it works comparatively well for that.

nullc 7y ago
By "comparatively well" you mean defeated in bulk by deploying sampled netflow with a couple lines of router configuration-- which almost all major ISPs already have deployed for monitoring purposes.

Seenso 7y ago

> Firefox DoH is snake oil, plain and simple... Correct me if I'm wrong, but the concern I have about browser-controlled DoH is that it seems like it could make it harder for a tech-savvy user to assert control over their own network. IIRC, most network-level ad-blocking operates at the DNS level. I've also personally blocked telemetry by setting my router's DNS proxy to resolve certain telemetry servers to 0.0.0.0. It's my understanding that DoH would bypass that. Couple that with Google's planned neutering of Chrome's ad-blocking API, and it seems like it will become increasingly hard for end-users to avoid ads. And the fact that DoH uses HTTP seems like it would make it impractical to block as a protocol. I think I would have preferred an encrypted DNS protocol that ran on its own port, at least.

pretty_bubbles 7y ago
If you use the nextdns DoH provider in Firefox you can actually configure your own adblocking domains even when you're moving around across networks. Just FYI
- nullc 7y ago
  > If you use the nextdns DoH provider in Firefox you can actually configure your own adblocking domains even when you're moving around across networks. Uh. Doesn't this prove that Firefox's DOH implementation is sending strong per-user identifying information to the server?
  - plttn 7y ago
    That’s what nextDNS offers (basically pihole in the cloud). And that only works by hitting a specific subdomain or endpoint on nextdns.io. If you’re hitting cloudflare, it’s just hitting the regular endpoint so no user identifying information.
    - nullc 7y ago
      Ah. Thanks! Makes sense.
  - 7y ago

noja 7y ago

It's a balance. Do you want your plaintext DNS request sent to starbucks or your local unsecured public wifi, or do you want it sent encrypted to your DoH server of choice?

jp_sc 7y ago
I can use a VPN when browsing on those kind of networks.
- raesene9 7y ago
  That's fine for more technical users who are aware of how to mitigate this kind of issue, but then those same more technical users will also likely know how to disable DoH. For the majority of users who may not understand the risks around plain text DNS, there are advantages to it being encrypted.
  - syshum 7y ago
    This has always been a poor argument. Especially for FF which is mainly used by Technical people Chrome a d IE are used by people that do not understand the risks around DNS I use FF because I am / was tried of IE and Chrome telling me how I should use thier software, now Mozilla is making the same moronic choices for me instead of empowering users DoH should be Opt-In, not Opt-Out
    - raesene9 7y ago
      You using FFox because you're technical, doesn't mean a majority of FFox's user base is technical. Technical users (like yourself) can just easily disable DoH, problem, for you, solved :)
  - ethagnawl 7y ago
    "Good" VPNs also aren't usually/ever? free.
    - 7y ago

Jonahgay 7y ago

You know you can put your own doh server into the browser.

geophertz 7y ago

Unfortunately it's not so easy to black hole `use-application-dns.net` for parental control. (people don't run their own DNS server).

nullc 7y ago
FWIW, I've found that running a local unbound server with moderately aggressive caching makes a visible improvement in browsing speed. For us technical folks, it worth doing for the speed up even without getting into the configurability/privacy implications.
- basilgohar 7y ago
  I have had the exact same experience. It's one of the first things I verify whenever I connect from a new location – are my queries being resolved by my local unbound or not.

simias 7y ago

It's also yet an other instance of the web browser taking over something that (IMO) ought to belong to the OS. Now with DoH if I have DNS issues I have to figure out if it's related to the browser's DNS or the system DNS. I can't use command line tools like dig or ping to troubleshoot the issue because it's not what the browser is doing. If DoH is so great I want to enable it for all my applications, not just my web browser. People, let's just rip off the bandaid and make Chrome and Firefox bootable already, who needs the kernel overhead when the browser is going to reimplement the entire stack itself anyway. Also let's just make TCP only work on ports 80 and 443 because clearly the rest doesn't really serve any purpose anymore.

mondoshawan 7y ago
Chrome is bootable already. ChromeOS. :P
ecnahc515 7y ago
You can definitely do DNS over HTTPS/TLS for everything if you run your own DNS server, either locally or somewhere on your network. I do this, and it works great, both methods have their own advantages and disadvantages of course.

deg4uss3r 7y ago

I use cloud nine because I dont' like CF: https://dns9.quad9.net/dns-query https://dns9.quad9.net/dns-query

sneak 7y ago

> Firefox DoH is snake oil, plain and simple. This is not an accurate statement, for the commonly accepted definition of "snake oil". Your privacy concerns are, from an angle, legitimate (although encrypted protocols, as a general rule, are more private than plaintext protocols), but this is a bit over the top. TFA also mentions that they are partnering with NextDNS, so your claims about centralization are on shaky ground, too. I personally use NextDNS on my whole LAN. They're great!

freeAgent 7y ago
I think his point is about the default behavior pointing to Cloudflare. Unless the user changes the DNS provider setting, everyone will be on Cloudflare. With that said, I think this is pretty over-the-top. Part of the reason Cloudflare is the default (and NextDNS is an option) is because they are abiding by Mozilla's Trusted Recursive Resolver policy: https://wiki.mozilla.org/Security/DOH-resolver-policy https://wiki.mozilla.org/Security/DOH-resolver-policy The only way Cloudflare itself can cause users a privacy issue through the use of its DNS service is by lying to them. They have already agreed not to sell or grant the data to any third party or use it for advertising, etc. The other concern nullc has is that hackers will infiltrate Cloudflare because it will now contain data on all US Firefox users' DNS queries unless those users change default settings. OK. I guess. However, I will say that I trust Cloudflare a whole heckuva lot more than I trust Comcast, Charter, AT&T, Verizon, etc. to be practicing good security. There are also probably more people on the mega ISPs than there are Firefox users, and many DNS queries these days originate from platforms that aren't even PCs (such as home theater streaming sticks) which will still be pinging default DHCP-received DNS providers. If anything, I see this decentralizing DNS request data.
- nullc 7y ago
  The mozilla policy allows cloudflare to permanently store and exploit per-domain-name but not per user data. So even going by the letter of the policy and considering cloudflare alone there is still a privacy loss. Moreover, the current legal standard in the US is that users have no expectation of privacy for data that third parties have stored about their activity. As a result there is potentially limited to no due process protection for user information in this scheme. Cloudflare could be required to turn the information over via an administrative subpoena and without the oversight of even a court or any ability for the impacted users to learn about or challenge the surveillance. > I will say that I trust Cloudflare a whole heckuva lot more than I trust Comcast, Charter, AT&T, Verizon, etc. to be practicing good security Than any one of them? I could imagine that. Than all? Cloudflare is a much bigger target. > I see this decentralizing DNS request data. Could you elaborate on that? I see this as massively centralizing DNS request data (onto cloudflare) and this change is the most problematic part of the whole thing.

j0057 7y ago

SNI is not a good argument, there is work being done to encrypt that as well in TLS 1.3 with Encrypted SNI[1]. [1] https://blog.cloudflare.com/encrypted-sni/ https://blog.cloudflare.com/encrypted-sni/

the8472 7y ago
ESNI only helps if you're fronting through things like cloudflare, again putting more eggs and information into a single basket and making them a more valuable target for TLAs.
- comex 7y ago
  True, centralization is a downside. But the alternative is having no privacy from government agencies. Even if you somehow believe your ISP won't be subject to these hypothetical interception orders that CloudFlare would be subject to (why?), there are plenty of points to tap in between your ISP and the website you're visiting.
throw0101a 7y ago
There's a tcp/443 connection to 208.80.153.224, what site could it be? $ whois 208.80.153.224 NetRange: 208.80.152.0 - 208.80.155.255 CIDR: 208.80.152.0/22 NetName: WIKIMEDIA NetHandle: NET-208-80-152-0-1 Parent: NET208 (NET-208-0-0-0-0) NetType: Direct Assignment OriginAS: AS14907 Organization: Wikimedia Foundation Inc. (WIKIM) RegDate: 2007-07-23 Updated: 2014-01-29 Comment: http://www.wikimediafoundation.org http://www.wikimediafoundation.org Ref: https://rdap.arin.net/registry/ip/208.80.152.0 https://rdap.arin.net/registry/ip/208.80.152.0
- mike-cardwell 7y ago
  mike@blob:~$ host 208.80.153.224 224.153.80.208.in-addr.arpa domain name pointer text-lb.codfw.wikimedia.org. mike@blob:~$ openssl s_client -connect 208.80.153.224:443 2>&1 | openssl x509 -text|grep Subject: Subject: C = US, ST = California, L = San Francisco, O = "Wikimedia Foundation, Inc.", CN = *.wikipedia.org Yeah, our ISPs are going to be totally in the dark thanks to DoH. /s

rogueresearch 7y ago

Looks like people are also working on block lists that work with pfBlockerNG and pfSense, ex: https://old.reddit.com/r/pfBlockerNG/comments/d3p1gf/doh_server_blocklist/ https://old.reddit.com/r/pfBlockerNG/comments/d3p1gf/doh_ser...

badrabbit 7y ago

Your ISP is literally selling this information right now in the US. What are you even talking about? Use google if you don't like CF, or just disable it! Do a little threat modeling here please. Let's say CF sells this data, what do they know about you other than your IP and the sites you visit? While your ISP,employer,school,etc... Can tie that activity to you as a person. Being compelled legally? I did not know privacy meant breaking laws, suddenly law enforcement can't do the same thing with your ISP dns? This is not adding a new party that can surveil you, this is reducing risk by separating who can see your DNS from who can see your traffic. The idea is to have eSNI ubiquity to where TLS traffic will conceal the sites you visit while DoH will conceal the traffic metadata. Oh, and beauty of DoH: you can run it through a web proxy, and if you have alot of users behind a NAT it becomes very hard to pin point which actual machine generated the DNS lookup.

OrgNet 7y ago
Your ISP can still see the IPs that you are talking to... What are you talking about? They can even see the url even if you dont use them as your DNS
- e12e 7y ago
  > They can even see the url Only for plaintext http. For ssl/https - the hostname/ip can leak with SNI, but should be safe with ESNI (encrypted SNI). The URL should be in the request, which comes after the TLS handshake (hence SNI, so that the server can pick a certificate before knowing the HTTP HOST header). SNI is a problem - but not much worse than the fact that a mitm can see who talks to who (IP) - IMNHO.
  - nullc 7y ago
    ESNI is not in use yet (or just doesn't work). Start up tcpdump and check yourself. At best even it were currently use it only provides protection for sites which are hosted behind DOS mitigation services. (usually cloudflare...)
    - 7y ago

demarq 7y ago

> It sends all the users DNS queries to Cloudflare, adding a new party it removes many parties (some unknown) who have no legal oversight, and adds a select parties who are legally bound to respect your privacy. > because the user's destination IPs remain unencrypted This makes no sense. your ISP cannot see that you are visiting facebook because the IP shows up us cloudflare urrrghhh! > At the moment you can disable this across your whole lan now that is a "massive attack on user privacy"

nullc 7y ago
> who are legally bound to respect your privacy. Come on, this is an overstatement. They have a non-public contract with mozilla. What happens if they break it and get caught? Probably the only consequence is that firefox stops using cloudflare ... eventually. Look at what has happened with misbehaving CAs. The responses have ranged between nothing and removing them 5 years later. > your ISP cannot see that you are visiting facebook because the IP shows up us cloudflare Yes they can, it's visible directly in the https requests as SNI. (not to mention in the sizes of traffic that go through). > now that is a "massive attack on user privacy" How so? If anything it's just another example at how this DoH approach does not actively protect users from ISPs.
- tialaramex 7y ago
  > Look at what has happened with misbehaving CAs. OK. Perhaps you have some examples in mind? > The responses have ranged between nothing and removing them 5 years later. Certainly you've got an example of "nothing" and of "removing them 5 years later" to start with, right? DigiNotar is the most obvious example of a "misbehaving CA" that you might be concerned about. In June 2011 their services were broken into and they decided not to tell anybody. There were no technologies in place at that time which could detect problems like this without DigiNotar's assistance. At the end of August a google.com certificate issued this way was used to attack Iranian web users, but Google's Chrome browser had pinning protection (only for Google's own services) and so at this point it detected the attack in progress. Mozilla shipped updated Firefox versions which distrusted DigiNotar's public root in about 48 hours (not "5 years") and over subsequent days distrusted the entire DigiNotar hierarchy including those parts the Dutch national government had insisted were fine (they were not fine). The public reactions at the time mirror your incredulity by the way, people who grep'd their newly updated Firefox and discovered DigiNotar's CA certificate (in fact blacklisted explicitly) as "proof" of a conspiracy by Mozilla to send all their traffic to some scary foreign company. Perhaps DigiNotar just isn't recent enough for you. So let's look at rather smaller deviations from the more recent past. In 2015 WoSign (a QiHoo 360 company which operated a CA) acquired the Israeli CA StartCom in secret. No significant countries have any mechanism in place to detect this (a potentially hostile acquisition of a private company) and so the browser vendors had no idea until mid-2016. Not telling Mozilla about this was already a violation of both agreements (for WoSign and for StartCom). But in 2016 WoSign/ StartCom (now one shared controlling mind) minted new certificates using SHA-1 signatures for several outfits, notably an Australian financial services company named Tyro. Since new SHA-1 certificates were prohibited in browsers in 2016 these certificates were back-dated to appear they'd been issued in 2015, another violation of the rules. The Tyro cert was probably actually issued in June 2016. After conducting an investigation which included having Israeli documents assessed by a Hebrew-speaking lawyer and a bunch of digital forensics work, by September of that year Mozilla was instituting partial distrust of WoSign and StartCom, and in 2017 the browser distrusted them entirely. Other vendors followed suit (very belatedly in the case of Microsoft).

abstractbarista 7y ago

I don't care if my ISP knows I visit reddit.com. I do care if they know I visit reddit.com/r/something I'm already protected by TLS for the latter. Newer TLS will eventually protect me from the former (in combination with DNS encryption).

mike-cardwell 7y ago
> I'm already protected by TLS for the latter. True > Newer TLS will eventually protect me from the former (in combination with DNS encryption). False. Your ISP will see a port 443 connection to 151.101.121.140 and then lookup that IP in whichever of the numerous IP->Website DB's they're using and discover you visited Reddit. DoH didn't hide from your ISP that you visited Reddit. It just added Cloudflare to the list of orgs that know about it. Potential fix: Centralise HTTP behind a handful of shared IP addresses so the IP->Website mapping isn't so easy. Did somebody say Cloudflare?

pitterpatter 7y ago

If you can run iptable commands or run bind you can certainly go to the Firefox options and disable/change DoH there?