8 ms·

At this point Mozilla is just the Non-profit Arm of Google, They do what google tells them.... and DoH is absolutely designed to get around network based secu

by syshum 6y ago

At this point Mozilla is just the Non-profit Arm of Google, They do what google tells them.... and DoH is absolutely designed to get around network based security and filtering, both for Ad's and other reasons.

acdha 6y ago
> At this point Mozilla is just the Non-profit Arm of Google, They do what google tells them You can just say you don’t follow this closely. Mozilla is not perfect but they do push for privacy, with an increasingly limited amount of negotiating power. > DoH is absolutely designed to get around network based security and filtering, both for Ad's and other reasons. This is similarly reflecting a poor understanding of the situation. DoH can’t get around network filtering - if you block packets, there’s no magic trick to bypass it. It’s great for preventing ISPs from tampering with traffic or monitoring activity (this will also require eSNI to complete) but it’s not giving an attacker any capability they didn’t already have. If you’re concerned about security you’re fooling yourself if you don’t have endpoint management and some level of network segmentation and egress control. Attackers have hard-coded DNS servers, C&C endpoints, etc. for decades.
- fiddlerwoaroof 6y ago
  DoH absolutely can get network filtering: if I block port 53 outbound to control DNS queries within my network, DoH (and other tunneling technologies) is bypassing my network filtering of DNS.
  - shawnz 6y ago
    By the same logic HTTPS is bypassing your network filtering of every service which happens to have an alternative available over HTTPS. So do you block HTTPS?
    - fiddlerwoaroof 6y ago
      I’ve been thinking about installing a proxy with my own root for this reason.
      - deleted 6y ago
        [deleted]
      - shawnz 6y ago
        I would not want to use your network if that was the case, and I wonder if you similarly would use someone else's network if it was configured like that. I don't think network operators who provide access to the Internet can realistically expect to control what their users do on the Internet, unless the network operator is also the administrator of those workstations.
        fiddlerwoaroof 6y ago
        Maybe, but my rule is: my home network, my rules. I can’t really do this invisibly anyways: any device I don’t control will get certificate validation errors.
        syshum 6y ago
        The problem here is even the device owner is not the "administrator" of the device as we have lost ownership rights, locked behind EULA's, Patents and copyright The point of the original story is "your" meaning a device you own, is ignoring your network controls it is highly unlikely that the TV manufacturer is going to allow me to install my own custom root certs to inspect their traffic to HTTPS, so yes DoH and other things are a threat to network security, because if the TV become compromised I have limited administrative controls to prevent it other the blocking it completely which is a poor response to the problem DoH is a solution in search of a problem that can be solves in better more user friendly ways
        acdha 6y ago
        They could do that any time without DoH, as has been done for years. Your true choice is allowing network access or not.
    - throwaway201103 6y ago
      Yes, from your IoT devices maybe you do. The usual approach to setting up a firewall is a default of "block everything" and then selectively allow only what is needed. Most people cheat and only do this on inbound connections, allowing everything on the egress side, because it's easier. But if you want to block your IoT devices from making outbound https connections, you easily can. There's nothing really new going on here. It's always been possible to tunnel one protocol over another, or use nonstandard ports, and use encryption on the traffic to hide what you're doing.
    - LanternLight83 6y ago
      I would absolutely love to have control over HTTPS traffic on my network, specifically to enable my Squid proxy to cache HTTPS pages, but unfortunately not every device or even program supports custom CA's. I'd be the man-in-the-middle between the internet and every device I own.
      - shawnz 6y ago
        I think that is a pretty user-hostile attitude and I suspect you probably wouldn't really love it if every network operator was doing that kind of thing.
        fiddlerwoaroof 6y ago
        What’s user-hostile is every consumer device insisting on pushing its defaults and ignoring any network policies I’ve configured.
        shawnz 6y ago
        Yes, I agree that is also user-hostile, since it should be configurable. The problem is not about network policies though, since DHCP is explicitly not designed to be a policy and is purposely meant to be optional for the client. For this reason I wouldn't recommend buying a device like the Chromecast, in which the user can't configure the network settings. Instead maybe consider something like the Amazon Fire Stick which is not as user-hostile.
        mrmanner 6y ago
        I read that as LanternLight83 is both the network operator and the user in this case, and if so it’s not really a problem. I would also love to MitM myself in some cases, mostly because it’d be interesting to see what’s going on.
        shawnz 6y ago
        Yes, but my point is that if you feel it's justified for your own network then you ought to expect every other network operator will feel that way about their network too. So before applying that mentality, it would be wise to consider what your experience would be like if all your neighbours, friends, colleagues etc also did that on their networks.
  - acdha 6y ago
    Network filtering means blocking traffic at the network level. Trying to use DNS for this leaves you trusting the client - and there are decades of precedent for clients bypassing that for various reasons, such as this post shows. The solution is to start doing network filtering: if you block packets to unapproved servers, you can actually stop this. You’ll need to run your own proxy, of course, but that’s always been the only way to actually accomplish that goal.
    - fiddlerwoaroof 6y ago
      That isn’t really possible, though: CDNs mean that blocking by IP just doesn’t work. The most effective method I’ve found is transparently redirecting all traffic on port 53 to a DNS server I control. DoH means that I might as well setup a transparent HTTPS proxy.
      - acdha 6y ago
        You’ll note that I mentioned a proxy. That’s why: you need to force all traffic through a proxy you control or you’re just hoping that a client doesn’t use hard-coded IPs or an outside API of some source. If your network allows the client to send traffic to port 443 anywhere, any blocking is on the honor system.
        gnu8 6y ago
        My question here is how are you going to install your root certificate on a $300 smart TV? Or, if that is not required because the TV does not verify DoH certificates, how bad is that for security (which we already know is awful on these devices)?
        acdha 6y ago
        This comes back to the core decision: do you care about controlling the network enough to block access? If the device can't be managed / is no longer supported the safest choice is not to allow it online at all. Different people will have different risk tolerances – it might make sense to put, say, a remote-control power switch on an IoT no-man's land network but if it has access to personal information or cameras/microphones it's not unreasonable to say it should just be blocked unless you're actively using those features.
  - manigandham 6y ago
    The issue isn't network filtering, it's encryption. Standard DNS is unencrypted. DNS-over-HTTP is encrypted. Or DNSSEC or any number of newer standards that secure the DNS lookup. At that point, filtering will require MITM proxies, whether it's for DNS or HTTP or any other protocol. It's a trade-off with security on the open network meaning harder penetration and control in your internal network. There's no easy answer.
    - tptacek 6y ago
      DNSSEC is not encrypted. Moreover, between end systems and DNS servers --- the scenario we're discussing on this thread --- it isn't even authenticated.
      - manigandham 6y ago
        Sure, DNSSEC provides authentication and integrity rather than encrypted traffic, which makes spoofing or rewriting the responses hard. Why do you say it's not authenticated? If they're using the newer standards then that's what it provides. If they're not then there's no issue with network filtering as usual.
        tptacek 6y ago
        Again: the article discusses an environment where machines on a home network are refusing to use the DNS servers the network is configured to use. DNSSEC authenticates requests between servers. But between DNS clients ("stub resolvers") and servers ("full recursers"), there is no authentication, just a single bit in the header that says "trust me, I authenticated this data". It doesn't matter if you're using your ISP's servers, 8.8.8.8, 1.1.1.1, or a custom server you set up on Digital Ocean somewhere: an on-path attacker can forge DNSSEC responses to you. It's a ridiculous situation.
- mindslight 6y ago
  Your technical description doesn't really respond to the meat of the critique of DoH, which is that it prevents the technique described in this article - transparent proxying for all traffic of a certain service, in this case DNS. The problem is that your relationship with your network devices is logically the same as a totalitarian country's/company's relationship with their citizens/users. So any protocol that prevents censorship/surveillance by ISPs also impinges upon bona fide network administrators. Corporate networks have the same dynamic, although there are few tears shed when it becomes harder for them to tamper with users' traffic. The right answer is to make sure devices that have any Internet access run code you control. The root of the problem here is buying a "smart" TV, hooking it up to the network, and then expecting to tame all of its user-hostile anti-features by policing its communication. The only way to use black box IoT devices is to remove all general Internet access from them, allowing communication only with hosts you do control. For instance I've got a network of tp-link bulbs that are all controlled from a Home Assistant instance, and they never have and never will get a packet out to the larger Internet.
  - acdha 6y ago
    My point was simply that DNS was never an effective measure. Corporate operators don’t need it since they can configure proxies and install endpoint monitoring, but the people building untrustworthy IoT devices or malware can’t be relied upon to cooperate. I agree that the core problem here is blocking egress entirely – and that’d be a good area for home routers to add UI polish so you could easily allow your TV to hit Samsung.com if there’s an update you need before turning it back off. Unfortunately that’s going to be a losing game for many devices and that really hits at the root cause: we need strong regulation controlling privacy because trying to stop a well-funded company with purely technical measures is almost always a losing game.
    - mindslight 6y ago
      Well DNS has been a pragmatic measure for quite some time. I've definitely seen jailbreaks of embedded devices that start off by MITMing DNS to proxy all traffic. DoH is changing that, and I can see how that's annoying. > hit Samsung.com if there’s an update you need Why would you need an update? Updates are mainly necessary for security, which you don't need if the device isn't on the Internet. If the device doesn't have all the features you expect out of the box, return it within the return period. There's a small corner case where an update could carry significantly increased functionality, but it seems easier to ad-hoc address that down the line rather than plan for it. Carelessly doing updates is a good way to break your device. > Unfortunately that’s going to be a losing game for many devices I don't see how it's a losing game if you play it correctly. Fine grained policing of types of traffic is a losing game, but wholesale denying transit isn't. There is little difference between my network of tp-link bulbs and a local modbus network.
- hackerfromthefu 6y ago
  Denial is not just a river in Egypt Follow the money .. watch the actions not the words
  - acdha 6y ago
    You mean actions like the Mozilla engineers advocating for users in standards groups or industry coordinating teams? Or the ones building privacy-oriented features? You’re going to have to make a more substantial argument to get anywhere with this.
skinkestek 6y ago
> At this point Mozilla is just the Non-profit Arm of Google, They do what google tells them.... As someone who has used (and still use Firefox) continously since around 2005 it surely feels that way sometimes and some of the decisions I see would make much more sense to me if I knew top management was somehow in Googles pocket. (That said 1. for my workflows I still consider Firefox the best browser. 2. switching would only make it even easier for Google. 3. I always hope something will change and Firefox will become really really great again or someone will fork it.
- inetknght 6y ago
  > some of the decisions I see would make much more sense to me if I knew top management was somehow in Googles pocket. Consider. [0] https://en.wikipedia.org/wiki/Mozilla_Corporation#Google https://en.wikipedia.org/wiki/Mozilla_Corporation#Google [1] https://www.theverge.com/2020/8/15/21370020/mozilla-google-firefox-search-engine-browser https://www.theverge.com/2020/8/15/21370020/mozilla-google-f...
- wolco2 6y ago
  They are in google pockets for 95% of revenue. But I think as a browser with a smaller market they join things and change things to be like everyone else. There was a recent change to facebook picture albums that lazily loads pictures as you scroll. In large albums this grinds to a halt after a few pages and each scroll takes 30 seconds to load the next set of images. Chrome handles this smoothly. For social media I had to switch to chrome. Firefox is still better for privacy and I use it when I can even though it feels like it's slowing down after each upgrade.
- 153791098c 6y ago
  > 3. I always hope something will change and Firefox will become really really great again or someone will fork it. Abrowser (from trisquel) is what firefox should have been. Best fork out there imo.
stjohnswarts 6y ago
Extraordinary claims require extraordinary proof. Of which I presume you have lots to share with the HN community?

by syshum 6y ago

acdha 6y ago

> At this point Mozilla is just the Non-profit Arm of Google, They do what google tells them You can just say you don’t follow this closely. Mozilla is not perfect but they do push for privacy, with an increasingly limited amount of negotiating power. > DoH is absolutely designed to get around network based security and filtering, both for Ad's and other reasons. This is similarly reflecting a poor understanding of the situation. DoH can’t get around network filtering - if you block packets, there’s no magic trick to bypass it. It’s great for preventing ISPs from tampering with traffic or monitoring activity (this will also require eSNI to complete) but it’s not giving an attacker any capability they didn’t already have. If you’re concerned about security you’re fooling yourself if you don’t have endpoint management and some level of network segmentation and egress control. Attackers have hard-coded DNS servers, C&C endpoints, etc. for decades.

fiddlerwoaroof 6y ago
DoH absolutely can get network filtering: if I block port 53 outbound to control DNS queries within my network, DoH (and other tunneling technologies) is bypassing my network filtering of DNS.
- shawnz 6y ago
  By the same logic HTTPS is bypassing your network filtering of every service which happens to have an alternative available over HTTPS. So do you block HTTPS?
  - fiddlerwoaroof 6y ago
    I’ve been thinking about installing a proxy with my own root for this reason.
    - deleted 6y ago
      [deleted]
    - shawnz 6y ago
      I would not want to use your network if that was the case, and I wonder if you similarly would use someone else's network if it was configured like that. I don't think network operators who provide access to the Internet can realistically expect to control what their users do on the Internet, unless the network operator is also the administrator of those workstations.
      - fiddlerwoaroof 6y ago
        Maybe, but my rule is: my home network, my rules. I can’t really do this invisibly anyways: any device I don’t control will get certificate validation errors.
      - syshum 6y ago
        The problem here is even the device owner is not the "administrator" of the device as we have lost ownership rights, locked behind EULA's, Patents and copyright The point of the original story is "your" meaning a device you own, is ignoring your network controls it is highly unlikely that the TV manufacturer is going to allow me to install my own custom root certs to inspect their traffic to HTTPS, so yes DoH and other things are a threat to network security, because if the TV become compromised I have limited administrative controls to prevent it other the blocking it completely which is a poor response to the problem DoH is a solution in search of a problem that can be solves in better more user friendly ways
        acdha 6y ago
        They could do that any time without DoH, as has been done for years. Your true choice is allowing network access or not.
  - throwaway201103 6y ago
    Yes, from your IoT devices maybe you do. The usual approach to setting up a firewall is a default of "block everything" and then selectively allow only what is needed. Most people cheat and only do this on inbound connections, allowing everything on the egress side, because it's easier. But if you want to block your IoT devices from making outbound https connections, you easily can. There's nothing really new going on here. It's always been possible to tunnel one protocol over another, or use nonstandard ports, and use encryption on the traffic to hide what you're doing.
  - LanternLight83 6y ago
    I would absolutely love to have control over HTTPS traffic on my network, specifically to enable my Squid proxy to cache HTTPS pages, but unfortunately not every device or even program supports custom CA's. I'd be the man-in-the-middle between the internet and every device I own.
    - shawnz 6y ago
      I think that is a pretty user-hostile attitude and I suspect you probably wouldn't really love it if every network operator was doing that kind of thing.
      - fiddlerwoaroof 6y ago
        What’s user-hostile is every consumer device insisting on pushing its defaults and ignoring any network policies I’ve configured.
        shawnz 6y ago
        Yes, I agree that is also user-hostile, since it should be configurable. The problem is not about network policies though, since DHCP is explicitly not designed to be a policy and is purposely meant to be optional for the client. For this reason I wouldn't recommend buying a device like the Chromecast, in which the user can't configure the network settings. Instead maybe consider something like the Amazon Fire Stick which is not as user-hostile.
      - mrmanner 6y ago
        I read that as LanternLight83 is both the network operator and the user in this case, and if so it’s not really a problem. I would also love to MitM myself in some cases, mostly because it’d be interesting to see what’s going on.
        shawnz 6y ago
        Yes, but my point is that if you feel it's justified for your own network then you ought to expect every other network operator will feel that way about their network too. So before applying that mentality, it would be wise to consider what your experience would be like if all your neighbours, friends, colleagues etc also did that on their networks.
- acdha 6y ago
  Network filtering means blocking traffic at the network level. Trying to use DNS for this leaves you trusting the client - and there are decades of precedent for clients bypassing that for various reasons, such as this post shows. The solution is to start doing network filtering: if you block packets to unapproved servers, you can actually stop this. You’ll need to run your own proxy, of course, but that’s always been the only way to actually accomplish that goal.
  - fiddlerwoaroof 6y ago
    That isn’t really possible, though: CDNs mean that blocking by IP just doesn’t work. The most effective method I’ve found is transparently redirecting all traffic on port 53 to a DNS server I control. DoH means that I might as well setup a transparent HTTPS proxy.
    - acdha 6y ago
      You’ll note that I mentioned a proxy. That’s why: you need to force all traffic through a proxy you control or you’re just hoping that a client doesn’t use hard-coded IPs or an outside API of some source. If your network allows the client to send traffic to port 443 anywhere, any blocking is on the honor system.
      - gnu8 6y ago
        My question here is how are you going to install your root certificate on a $300 smart TV? Or, if that is not required because the TV does not verify DoH certificates, how bad is that for security (which we already know is awful on these devices)?
        acdha 6y ago
        This comes back to the core decision: do you care about controlling the network enough to block access? If the device can't be managed / is no longer supported the safest choice is not to allow it online at all. Different people will have different risk tolerances – it might make sense to put, say, a remote-control power switch on an IoT no-man's land network but if it has access to personal information or cameras/microphones it's not unreasonable to say it should just be blocked unless you're actively using those features.
- manigandham 6y ago
  The issue isn't network filtering, it's encryption. Standard DNS is unencrypted. DNS-over-HTTP is encrypted. Or DNSSEC or any number of newer standards that secure the DNS lookup. At that point, filtering will require MITM proxies, whether it's for DNS or HTTP or any other protocol. It's a trade-off with security on the open network meaning harder penetration and control in your internal network. There's no easy answer.
  - tptacek 6y ago
    DNSSEC is not encrypted. Moreover, between end systems and DNS servers --- the scenario we're discussing on this thread --- it isn't even authenticated.
    - manigandham 6y ago
      Sure, DNSSEC provides authentication and integrity rather than encrypted traffic, which makes spoofing or rewriting the responses hard. Why do you say it's not authenticated? If they're using the newer standards then that's what it provides. If they're not then there's no issue with network filtering as usual.
      - tptacek 6y ago
        Again: the article discusses an environment where machines on a home network are refusing to use the DNS servers the network is configured to use. DNSSEC authenticates requests between servers. But between DNS clients ("stub resolvers") and servers ("full recursers"), there is no authentication, just a single bit in the header that says "trust me, I authenticated this data". It doesn't matter if you're using your ISP's servers, 8.8.8.8, 1.1.1.1, or a custom server you set up on Digital Ocean somewhere: an on-path attacker can forge DNSSEC responses to you. It's a ridiculous situation.
mindslight 6y ago
Your technical description doesn't really respond to the meat of the critique of DoH, which is that it prevents the technique described in this article - transparent proxying for all traffic of a certain service, in this case DNS. The problem is that your relationship with your network devices is logically the same as a totalitarian country's/company's relationship with their citizens/users. So any protocol that prevents censorship/surveillance by ISPs also impinges upon bona fide network administrators. Corporate networks have the same dynamic, although there are few tears shed when it becomes harder for them to tamper with users' traffic. The right answer is to make sure devices that have any Internet access run code you control. The root of the problem here is buying a "smart" TV, hooking it up to the network, and then expecting to tame all of its user-hostile anti-features by policing its communication. The only way to use black box IoT devices is to remove all general Internet access from them, allowing communication only with hosts you do control. For instance I've got a network of tp-link bulbs that are all controlled from a Home Assistant instance, and they never have and never will get a packet out to the larger Internet.
- acdha 6y ago
  My point was simply that DNS was never an effective measure. Corporate operators don’t need it since they can configure proxies and install endpoint monitoring, but the people building untrustworthy IoT devices or malware can’t be relied upon to cooperate. I agree that the core problem here is blocking egress entirely – and that’d be a good area for home routers to add UI polish so you could easily allow your TV to hit Samsung.com if there’s an update you need before turning it back off. Unfortunately that’s going to be a losing game for many devices and that really hits at the root cause: we need strong regulation controlling privacy because trying to stop a well-funded company with purely technical measures is almost always a losing game.
  - mindslight 6y ago
    Well DNS has been a pragmatic measure for quite some time. I've definitely seen jailbreaks of embedded devices that start off by MITMing DNS to proxy all traffic. DoH is changing that, and I can see how that's annoying. > hit Samsung.com if there’s an update you need Why would you need an update? Updates are mainly necessary for security, which you don't need if the device isn't on the Internet. If the device doesn't have all the features you expect out of the box, return it within the return period. There's a small corner case where an update could carry significantly increased functionality, but it seems easier to ad-hoc address that down the line rather than plan for it. Carelessly doing updates is a good way to break your device. > Unfortunately that’s going to be a losing game for many devices I don't see how it's a losing game if you play it correctly. Fine grained policing of types of traffic is a losing game, but wholesale denying transit isn't. There is little difference between my network of tp-link bulbs and a local modbus network.
hackerfromthefu 6y ago
Denial is not just a river in Egypt Follow the money .. watch the actions not the words
- acdha 6y ago
  You mean actions like the Mozilla engineers advocating for users in standards groups or industry coordinating teams? Or the ones building privacy-oriented features? You’re going to have to make a more substantial argument to get anywhere with this.

skinkestek 6y ago

> At this point Mozilla is just the Non-profit Arm of Google, They do what google tells them.... As someone who has used (and still use Firefox) continously since around 2005 it surely feels that way sometimes and some of the decisions I see would make much more sense to me if I knew top management was somehow in Googles pocket. (That said 1. for my workflows I still consider Firefox the best browser. 2. switching would only make it even easier for Google. 3. I always hope something will change and Firefox will become really really great again or someone will fork it.

inetknght 6y ago
> some of the decisions I see would make much more sense to me if I knew top management was somehow in Googles pocket. Consider. [0] https://en.wikipedia.org/wiki/Mozilla_Corporation#Google https://en.wikipedia.org/wiki/Mozilla_Corporation#Google [1] https://www.theverge.com/2020/8/15/21370020/mozilla-google-firefox-search-engine-browser https://www.theverge.com/2020/8/15/21370020/mozilla-google-f...
wolco2 6y ago
They are in google pockets for 95% of revenue. But I think as a browser with a smaller market they join things and change things to be like everyone else. There was a recent change to facebook picture albums that lazily loads pictures as you scroll. In large albums this grinds to a halt after a few pages and each scroll takes 30 seconds to load the next set of images. Chrome handles this smoothly. For social media I had to switch to chrome. Firefox is still better for privacy and I use it when I can even though it feels like it's slowing down after each upgrade.
153791098c 6y ago
> 3. I always hope something will change and Firefox will become really really great again or someone will fork it. Abrowser (from trisquel) is what firefox should have been. Best fork out there imo.

stjohnswarts 6y ago

Extraordinary claims require extraordinary proof. Of which I presume you have lots to share with the HN community?