5 ms·

How is concentrating DNS to even less "points of possible collection" of any advantage to user's privacy? My opinion is not far from nullc's: https://news.ycom

by acqq 7y ago

How is concentrating DNS to even less "points of possible collection" of any advantage to user's privacy? My opinion is not far from nullc's: https://news.ycombinator.com/item?id=22415794 https://news.ycombinator.com/item?id=22415794 https://news.ycombinator.com/item?id=22419657 https://news.ycombinator.com/item?id=22419657 "I see this as massively centralizing DNS request data (onto cloudflare) and this change is the most problematic part of the whole thing." The less companies and locations one have to intrude to be able to "see" or influence DNS responses, the easier it is for a competent attacker. And from a legal standpoint, at once even more information which would have before remained in some other countries is easily (even trivially) obtainable.

robin_reala 7y ago
You’re focusing on CloudFlare, but already I have a choice of a couple of DNS-over-HTTPS providers in my preferences, and I see no reason why it would stick at just two.
- acqq 7y ago
  > already I have a choice of a couple of DNS-over-HTTPS providers in my preferences Can you please cite that "couple" and also how you believe a typical user would ever change the default?
  - robin_reala 7y ago
    The dropdown has CloudFlare, NextDNS and Custom (that opens a text input). As for users changing this, sure, that’s not going to happen. But I can imagine a world where the default is that your requests are fanned out randomly to a choice of hundreds or thousands of providers, with no clear and complete picture of a single user in the event that a single provider is compromised.
    - ThePhysicist 7y ago
      Yes, that would be a good option. They should've just waited for more providers switching to DoH before they turned this on by default, IMO.
      - justinclift 7y ago
        Probably a chicken-and-egg thing. As long as we get there? :)
        deleted 7y ago
        [deleted]
  - audessuscest 7y ago
    > How is concentrating DNS to even less "points of possible collection" of any advantage to user's privacy? Firefox nightly (not sure with other version) propose already NextDNS as an alternative in pref. and an easy way to add a custom one. I can see for example big companies requiring their employees to use a custom one.
  - Arnt 7y ago
    If you disregard the few people who change from the defaults and simplify a little, then moving from plain old DNS to DNS-over-HTTPS is moving from some DSL provider's resolver to Cloudflare's. The DSL provider has your real name and street address, Cloudflare does not.
    - acqq 7y ago
      > The DSL provider has your real name and street address, Cloudflare does not. Some readers probably aren’t aware of the fact that even with DNS over TLS to Cloudflare the DSL provider can still collect exact info of which sites one visits. The name of the site is visible in the clear in the TLS communication with the site, independently of DNS.
  - jakelazaroff 7y ago
    How do you think this compares to the present default, "whatever DNS my ISP chose for me"?
- nullc 7y ago
  Yes, but you always also had the "choice" of running your own resolver and running any outbound queries (or just using a recursive resolver) over a VPN. You might protest that since that's complicated and takes effort the 'choice' isn't that meaningful, particularly when it comes to our collective privacy. You might also protest that it's easy to mess up and hard apply consistently to all hosts, and that few people would bother. Exactly. The same applies to "you don't have to use cloudflare" for DOH. You also could have already used your choice of DOH by running DOH proxy-- and bonus: all software would be protected rather than just the browser. ... so if "choice" was the only criteria, we already had it, and there was no reason to default many millions of people to sending all their DNS requests to a single point of observation.
  - yipbub 7y ago
    Why wouldn't firefox be able to add those preferences by default?
    - vetinari 7y ago
      Why should it? There's already a preference, called system setting. The system administrator configured something, it is not app job to duplicate or override that.
      - WorldMaker 7y ago
        In the early days of web browsers, the browsers like Firefox implemented early SSL/TLS ahead of OS vendors. To this day, Firefox still maintains and bundles its own Root CA list, and by default prefers its own list over OS provided lists. There's certainly precedence for web browsers doing things ahead of OS/system support because they can do it faster, and because maybe they think their users' (privacy and/or security) needs can't wait for deeper OS/system support. (Also, for an increasing number of people, a browser isn't just "an app", it is their real OS where they spend the most time.)
- ThePhysicist 7y ago
  NextDNS (the other provider) is a startup / Delaware C-Corp that has been around for less than a year. I'm not sure if I trust them more than my local ISP (at least in Europe, for the US this might be different). There's a long Twitter discussion initiated by Paul Vixie that discusses the problem in more detail: https://twitter.com/paulvixie/status/1232427484202688512 https://twitter.com/paulvixie/status/1232427484202688512
  - comex 7y ago
    Mozilla is not rolling out DoH by default in Europe, and probably won't do so until they have suitable European provider(s).
  - Avamander 7y ago
    Just enter your own resolver then, it's not enabled by default for you anyways. Out of all the problems with Firefox, this isn't one.
Yoric 7y ago
I'm pretty sure that mozilla is currently negotiating with other DNS providers to get them onboard. Hopefully, within a few months, you'll be able to pick from dozens, in addition to rolling your own.

by acqq 7y ago

robin_reala 7y ago

You’re focusing on CloudFlare, but already I have a choice of a couple of DNS-over-HTTPS providers in my preferences, and I see no reason why it would stick at just two.

acqq 7y ago
> already I have a choice of a couple of DNS-over-HTTPS providers in my preferences Can you please cite that "couple" and also how you believe a typical user would ever change the default?
- robin_reala 7y ago
  The dropdown has CloudFlare, NextDNS and Custom (that opens a text input). As for users changing this, sure, that’s not going to happen. But I can imagine a world where the default is that your requests are fanned out randomly to a choice of hundreds or thousands of providers, with no clear and complete picture of a single user in the event that a single provider is compromised.
  - ThePhysicist 7y ago
    Yes, that would be a good option. They should've just waited for more providers switching to DoH before they turned this on by default, IMO.
    - justinclift 7y ago
      Probably a chicken-and-egg thing. As long as we get there? :)
      - deleted 7y ago
        [deleted]
- audessuscest 7y ago
  > How is concentrating DNS to even less "points of possible collection" of any advantage to user's privacy? Firefox nightly (not sure with other version) propose already NextDNS as an alternative in pref. and an easy way to add a custom one. I can see for example big companies requiring their employees to use a custom one.
- Arnt 7y ago
  If you disregard the few people who change from the defaults and simplify a little, then moving from plain old DNS to DNS-over-HTTPS is moving from some DSL provider's resolver to Cloudflare's. The DSL provider has your real name and street address, Cloudflare does not.
  - acqq 7y ago
    > The DSL provider has your real name and street address, Cloudflare does not. Some readers probably aren’t aware of the fact that even with DNS over TLS to Cloudflare the DSL provider can still collect exact info of which sites one visits. The name of the site is visible in the clear in the TLS communication with the site, independently of DNS.
- jakelazaroff 7y ago
  How do you think this compares to the present default, "whatever DNS my ISP chose for me"?
nullc 7y ago
Yes, but you always also had the "choice" of running your own resolver and running any outbound queries (or just using a recursive resolver) over a VPN. You might protest that since that's complicated and takes effort the 'choice' isn't that meaningful, particularly when it comes to our collective privacy. You might also protest that it's easy to mess up and hard apply consistently to all hosts, and that few people would bother. Exactly. The same applies to "you don't have to use cloudflare" for DOH. You also could have already used your choice of DOH by running DOH proxy-- and bonus: all software would be protected rather than just the browser. ... so if "choice" was the only criteria, we already had it, and there was no reason to default many millions of people to sending all their DNS requests to a single point of observation.
- yipbub 7y ago
  Why wouldn't firefox be able to add those preferences by default?
  - vetinari 7y ago
    Why should it? There's already a preference, called system setting. The system administrator configured something, it is not app job to duplicate or override that.
    - WorldMaker 7y ago
      In the early days of web browsers, the browsers like Firefox implemented early SSL/TLS ahead of OS vendors. To this day, Firefox still maintains and bundles its own Root CA list, and by default prefers its own list over OS provided lists. There's certainly precedence for web browsers doing things ahead of OS/system support because they can do it faster, and because maybe they think their users' (privacy and/or security) needs can't wait for deeper OS/system support. (Also, for an increasing number of people, a browser isn't just "an app", it is their real OS where they spend the most time.)
ThePhysicist 7y ago
NextDNS (the other provider) is a startup / Delaware C-Corp that has been around for less than a year. I'm not sure if I trust them more than my local ISP (at least in Europe, for the US this might be different). There's a long Twitter discussion initiated by Paul Vixie that discusses the problem in more detail: https://twitter.com/paulvixie/status/1232427484202688512 https://twitter.com/paulvixie/status/1232427484202688512
- comex 7y ago
  Mozilla is not rolling out DoH by default in Europe, and probably won't do so until they have suitable European provider(s).
- Avamander 7y ago
  Just enter your own resolver then, it's not enabled by default for you anyways. Out of all the problems with Firefox, this isn't one.

Yoric 7y ago

I'm pretty sure that mozilla is currently negotiating with other DNS providers to get them onboard. Hopefully, within a few months, you'll be able to pick from dozens, in addition to rolling your own.