4 ms·

> It sends all the users DNS queries to Cloudflare, adding a new party it removes many parties (some unknown) who have no legal oversight, and adds a select p

• nullc 7y ago
  > who are legally bound to respect your privacy. Come on, this is an overstatement. They have a non-public contract with mozilla. What happens if they break it and get caught? Probably the only consequence is that firefox stops using cloudflare ... eventually. Look at what has happened with misbehaving CAs. The responses have ranged between nothing and removing them 5 years later. > your ISP cannot see that you are visiting facebook because the IP shows up us cloudflare Yes they can, it's visible directly in the https requests as SNI. (not to mention in the sizes of traffic that go through). > now that is a "massive attack on user privacy" How so? If anything it's just another example at how this DoH approach does not actively protect users from ISPs.
  • tialaramex 7y ago
    > Look at what has happened with misbehaving CAs. OK. Perhaps you have some examples in mind? > The responses have ranged between nothing and removing them 5 years later. Certainly you've got an example of "nothing" and of "removing them 5 years later" to start with, right? DigiNotar is the most obvious example of a "misbehaving CA" that you might be concerned about. In June 2011 their services were broken into and they decided not to tell anybody. There were no technologies in place at that time which could detect problems like this without DigiNotar's assistance. At the end of August a google.com certificate issued this way was used to attack Iranian web users, but Google's Chrome browser had pinning protection (only for Google's own services) and so at this point it detected the attack in progress. Mozilla shipped updated Firefox versions which distrusted DigiNotar's public root in about 48 hours (not "5 years") and over subsequent days distrusted the entire DigiNotar hierarchy including those parts the Dutch national government had insisted were fine (they were not fine). The public reactions at the time mirror your incredulity by the way, people who grep'd their newly updated Firefox and discovered DigiNotar's CA certificate (in fact blacklisted explicitly) as "proof" of a conspiracy by Mozilla to send all their traffic to some scary foreign company. Perhaps DigiNotar just isn't recent enough for you. So let's look at rather smaller deviations from the more recent past. In 2015 WoSign (a QiHoo 360 company which operated a CA) acquired the Israeli CA StartCom in secret. No significant countries have any mechanism in place to detect this (a potentially hostile acquisition of a private company) and so the browser vendors had no idea until mid-2016. Not telling Mozilla about this was already a violation of both agreements (for WoSign and for StartCom). But in 2016 WoSign/ StartCom (now one shared controlling mind) minted new certificates using SHA-1 signatures for several outfits, notably an Australian financial services company named Tyro. Since new SHA-1 certificates were prohibited in browsers in 2016 these certificates were back-dated to appear they'd been issued in 2015, another violation of the rules. The Tyro cert was probably actually issued in June 2016. After conducting an investigation which included having Israeli documents assessed by a Hebrew-speaking lawyer and a bunch of digital forensics work, by September of that year Mozilla was instituting partial distrust of WoSign and StartCom, and in 2017 the browser distrusted them entirely. Other vendors followed suit (very belatedly in the case of Microsoft).
• mike-cardwell 7y ago
  "This makes no sense. your ISP cannot see that you are visiting facebook" There are many massive databases of ip to hostname mappings which can be trivially queried by an ISP to see what service you're connecting to. Or if they see you connecting to 185.60.216.35, they can just: curl http://185.60.216.35 -v 2>&1|grep Location Or: openssl s_client -connect 185.60.216.35:443 2>&1 | openssl x509 -text|grep Subject: Or one of a miriad of other ways to get a hint about the hostname of the service you're connecting to, at which point they can automatically do forward DNS lookups to confirm what matches. DoH only adds to the number of organisations that can see your web traffic. It does not reduce it, or shift it to a more trustworthy organisation. It just adds more leaks. DoH/ESNI don't stop your ISPs knowing exactly what sites you're visiting unless we centralise HTTP behind a handful of benevolant gateways the same way Mozilla is doing with DNS. Fuck that.
• ajsnigrutin 7y ago
  My ISP is legally bound to respect my privacy. I have regulatory bodies literally 10 minutes away, that can deal with tham, and a court system where I (and many more like me) can sue the ISP if they do something bad. What can I, citizen of small EU country, with an en_US firefox, do against cloudflare?