15 ms·

I’m surprised at the negative knee-jerk reaction. I actually love this idea immediately. It encapsulates something I kind of already wanted when using HTTPS Eve

• guitarlimeo 6y ago
  > This doesn’t guarantee the transport is end-to-end secure; I’m sure plenty will strip the encryption at an LB and then possibly send it back over the internet. Hijacking this a bit - If plenty are stripping the encryption at an LB (like Cloudflare for example), how can you be sure that NSA is not wiretapping in Cloudflare's infrastructure where it is not encrypted? Seems like a really easy way to get unencrypted data and not care about if everything is HTTPS or not. Are there any counterexamples to this? Do we know that Cloudflare or AWS is not doing this?
• arebhaibhai 6y ago
  I like the DoH initiative too. It's sad that Chrome doesn't support it for Linux yet and therefore Brave does not. HTTPS upgrade feature has always been there in Brave. Edit: I'm using system-wide DoT at the moment with CoreDNS but it doesn't work that well. Not sure why.
• new23d 6y ago
  Fully support this argument and Mozilla's initiative. I work for a firewall co and we had taken a strategic decision to not allow plaintext traffic onto the internet (from cloud deployments). It's just lazy on the client or server operator's part to not have it so.
  • cat199 6y ago
    this breaks caching of simple objects that do not require content security
    • new23d 6y ago
      From intermediate (MITM) caches, yes. But end-clients can still cache it though. Our market is more backend API traffic so doesn't impact as much.
      • wang_li 6y ago
        Since it's becoming harder and harder to implement transparent proxies and caches, someone should define a local cache protocol so that network administrators can configure explicit shared caches for the devices on their networks.
        • jlgaddis 6y ago
          > someone should define a local cache protocol Someone did, almost two and a half decades ago. It's called the Internet Cache Protocol. - Internet Cache Protocol (ICP), version 2 [0] - Application of Internet Cache Protocol (ICP), version 2 [1] -- [0]: https://tools.ietf.org/html/rfc2186 https://tools.ietf.org/html/rfc2186 [1]: https://tools.ietf.org/html/rfc2187 https://tools.ietf.org/html/rfc2187
    • taftster 6y ago
      Even "simple objects" can be MITM'd. I know I'm on the extreme theoretical edge, and so maybe your perspective is pragmatic enough to pass. But even small images, javascripts, etc. should be protected by HTTPS, not just "sensitive" pages. As an end user, I don't want the possibility of anything being tampered with along the route. As a content owner / webmaster, I want the same. So publisher and consumer are both aligned in their desire, making HTTPS ideal for everyone except for people reading/manipulating traffic along the way.
      • 6y ago
• pjc50 6y ago
  DoH changes who gets all your DNS traffic from your ISP and your router to (in practice) a single central DoH provider. Which of those you trust least depends on who you are.
  • Cthulhu_ 6y ago
    Can a user use multiple (fallback) DNS-over-HTTPS providers? Do the DoH providers supply fallbacks (which iirc most DNS providers do)?
    • livre 6y ago
      Depends on the client. Firefox doesn't support a fallback and tries unencrypted or fails depending on how you configured it. AdGuard Home can use fallbacks so you can run a local instance and point Firefox there. Some providers supply fallbacks (https://1.1.1.1/dns-query https://1.1.1.1/dns-query and https://1.0.0.1/dns-query https://1.0.0.1/dns-query for example).
  • danShumway 6y ago
    There is nothing preventing your ISP from providing DoH itself. Firefox (currently) does not use your ISPs settings by default (which imo is the correct move for now), but Chrome will use your ISP/router's DoH settings if it provides DoH. There is nothing about DoH that forces you to use a single company.
• tobylane 6y ago
  Could this or HTTPS Everywhere warn you when a site is known for encryption stripping? I think this happens on the free cloudflare tier and we can’t determine that.
  • ce4 6y ago
    How would you detect something like that? Thats at the discretion of the party running the webserver/service and it's not directly observable. Cloudflare acts as a reverse proxy in front of the real origin server (which uses https), but that affects really a lot of internet sites nowadays (Cloudflare, Akamai, aws/gcp/azure and so on). CDN-origin connectivity is also encrypted, afaik you cannot downgrade and strip ssl (at least not with Akamai)
  • iso1631 6y ago
    All HTTPS does is ensure security between your client and the server with the private key of the certificate. You typically trust certificate signers (globalsign, letsencrypt, etc) who have their own policies for ensuring who gets a certificate (in LE's case you have to prove ownership of the domain) If a domain owner gets a certificate and gives it, and a private key, to a third party, then that's their business.
    • tetha 6y ago
      > All HTTPS does is ensure security between your client and the server with the private key of the certificate. Just for completeness, HTTPs does not necessarily guarantee you are connected to the right server. This depends on the CAs you trust. For example, larger enterprises commonly inject their own CA into their workstations in order to prevent loss of sensitive data. This allows SSL inspection proxies to terminate all SSL connections with a valid, trusted certificate from the perspective of that workstation. .
• matsemann 6y ago
  > I’m surprised at the negative knee-jerk reaction. Only Chrome is allowed to break stuff on the web, remember?
  • MinusGix 6y ago
    This site is likely to get annoyed at Chrome as well. Also, just because Chrome gets away with it doesn't mean its an action that should be accepted purely for that reasoning.
  • qwertox 6y ago
    This is optional, so it's not breaking the web. It's like disabling JavaScript manually.
• iso1631 6y ago
  I want my OS to do DNS - including DOH, not my browser. I want a single source for my DNS I want my network to tell me a DNS server to use. As I own my computer I can override that, but much of the time I want to use the network provided DNS server.
  • acd10j 6y ago
    At least in my case network provided DNS are the worst, Full of spyware, and tracking.
    • waheoo 6y ago
      They're referring to the local network configuration. Many sysadmins will hate this. > Full of spyware, and tracking. What do you use? Google?...
    • iso1631 6y ago
      I run my own networks and my own devices, I choose what options go in my DHCP server If I were on a hostile network (say a hotel), then sure, I'll ignore their DNS server and use my own (or indeed just punch my way out via a VPN), but most of the time I use friendly networks, and I don't want to have to configure 20 different applications on a dozen different boxes to use a DNS provider of my choice. There's a reason I use DHCP in the first place.
      • manquer 6y ago
        You are able to run own network and have the know how to do so, typical physical Firefox users cannot. Given your knowledge you can disable or even build firefox with DoH disabled , it is a sensible default for vast majority of users who do not know what DHCP is, or control their network. It cannotis trivial configuration for people who can control and do not want the DoH service provider given by Firefox. Also many places do not allow VPN traffic either. It is not as easy to bypass monitoring in a locked down environment like typical corporate firewalls, college campuses etc. Yes for every block in place like deep packet inspection etc there is usually some workaround but these become increasingly difficult as more stringent the blocking becomes, and having options like DoH helps users who cannot or do not know how to run VPNs.
• raxxorrax 6y ago
  I just hope we don't get compromised CA because a lot of governments currently try to fight encryption. But agreed, it is a good idea. The only disadvantage I see is that some sites might not want to pay for a certificate and don't know how to easily obtain free ones. So it might kill some sites.
  • jchw 6y ago
    Not 100% sure why this is being downvoted, I think it is true that some sites, for one reason or another, probably will not adopt ACME/Let's Encrypt...
  • ozim 6y ago
    They don't need compromised CA, you can mandate all devices in your country to install your root cert, good part it failed: https://www.privateinternetaccess.com/blog/kazakhstan-tries-and-fails-to-mitm-all-of-its-internet-users-with-rogue-certificate-installation/ https://www.privateinternetaccess.com/blog/kazakhstan-tries-...
• 3np 6y ago
  I have mixed feelings about what you wrote. 100% with you that by itself, browser HTTPS-only mode (even by default) is A Good Thing. In isolation, this is a no-brainer and Mozilla's doing the right call. I'm not happy with DoH though, at all. I fall in the crowd who wants to control my own DNS on my own devices (and I do realize that for those less technically knowledgeable, the status quo is putting that in the hands of the network admin or even ISP, but at least in principle they have the means to do so if they just figure out how, which is relatively trivial). DoH effectively completely cripples things like pihole. I'd have to start whitelisting IPs/hostnames for port 443 :/ Another practical negative consequence is the further centralization of TLS termination in (most notably) Cloudflare and Akamai, as I am sure this will de the default for those who are now rushed to TLS-enable currently uncompliant endpoints. Great sieves for XEyes and private tracking industry.
  • kd913 6y ago
    Firefox DoH easily works with DNSCryptProxy. https://github.com/DNSCrypt/dnscrypt-proxy/wiki/Local-DoH https://github.com/DNSCrypt/dnscrypt-proxy/wiki/Local-DoH You can easily set it up to contact that, but enable some exclusions for specific domains if you wish to fallback to pihole. It's probably not that efficient anyway to be using pihole's filtering in Firefox compared with just ublock origin anyway.
    • 3np 6y ago
      I wasn't aware of this part of dnscrypt-proxy, thanks for sharing. I find network-level blocking and browser extensions work complementary. In a broader sense, I guess the larger concerns is malware and trackware on various devices where DoH is used maliciously. Especially smartphones. Granted there is nothing stopping them today, but the normalization of DoH will put it in arms reach for everyone.
    • cptskippy 6y ago
      > It's probably not that efficient anyway to be using pihole's filtering in Firefox compared with just ublock origin anyway. Pihole operates at the network level. It can block Windows Telemetry, ads on your Roku, smart devices trying to phone home, etc. Any guest devices that connect to your network also benefit without you having to install blockers on them. It's not a replacement for ublock, it's used in conjunction with it.
• mrslave 6y ago
  Agreed. I've been using this for several versions already (mentioned by other commenters - dom.security.https_only_mode). Very few websites break, and they should know better (e.g. HTTPS redirects to HTTP, redirects to another HTTPS location). I've often daydreamed of a new HN freature where non-HTTPS links have a preceeding red marker "[HTTP only]" (or similar) but never could find the correct place to write it down. Considering that Firefox is now a minority browser :( perhaps there is still usefulness in this idea?
• pabs3 6y ago
  HTTPS Everywhere already supports a HTTPS-only mode called EASE, it is opt-in though.
• userbinator 6y ago
  I’m surprised at the negative knee-jerk reaction Increased corporate/government control and centralisation. That is a huge "do not want" for many of the HN crowd, including me.
  • taftster 6y ago
    Honest question. How is this feature enabling increased corporate/government control?
    • Karunamon 6y ago
      Because now almost every Firefox user will be sending their DNS straight to one centralized provider, a large corporation, which makes them more vulnerable to various kinds of government interference.
      • winded_italics 6y ago
        This change isn't about DoH.
      • danShumway 6y ago
        There is nothing about DNS over HTTPS that requires you to use one centralized provider, and unencrypted DNS has always been easier for large corporations, ISPs, and the government to sniff. I think people are just totally off-base on this. The instances of government/corporation reactions to DOH that we have seen suggest that untrustworthy organizations and governments largely oppose the change. They would not oppose the change if it was in their best interest. Worth noting that anyone can set up a DOH server. You can even set up your own server in your own house and use it the same way that you would a Pi-hole. To the extent that malware providers or IoT providers will use this to circumvent blocks, they already had the ability to do that -- and IoT services like Chromecasts have already experimented in the past with setting their own DNS providers and ignoring network settings. We do not need to open up our networks to MiTM attacks to avoid centralization. Unencrypted DNS is a bad idea, it isn't complicated.
• dehrmann 6y ago
  Especially for average users, this is a lot better than the VPN snakeoil I keep seeing ads for.