27 ms·

Mozilla rolls out DoH to Canadian users of Firefox

231 points by tristor 5y ago

lucasyvas 5y ago
Can someone enlighten me as to why this should be a trusted default? Because I inherently wouldn't trust it. I wouldn't say I trust NextDNS, but I currently use them for DoH.
- 0xTJ 5y ago
  I'd argue that if you're using it, you trust it. Otherwise you wouldn't use it. This seems a lot better than just letting the internet provider give a regular DNS.
  - tremon 5y ago
    This seems a lot better than just letting the internet provider give a regular DNS Why? You're already using your internet provider, so you trust them. Otherwise you wouldn't use them.
    - dewey 5y ago
      > Otherwise you wouldn't use them. A lot of times you don't really have a choice which ISP to use so that's not really a good argument.
    - coldpie 5y ago
      No, the point of DOH is that you don't have to trust your ISP. In many countries the ISPs are actively hostile[1]. You do have to trust the DOH provider, yes, but in this case Mozilla (or yourself if you have the tech knowledge) will be verifying trust on your behalf. You cannot do that at all with plain ol' DNS. DOH is a "best of a bad situation" kind of solution, it's a reaction to hostile ISPs. It's not something anyone really likes. [1] https://www.internetsociety.org/blog/2014/04/turkish-isps-hijacking-traffic-this-is-how-an-internet-breaks/ https://www.internetsociety.org/blog/2014/04/turkish-isps-hi...
      - jeltz 5y ago
        DoH means handing your data to one more party since your ISP can already see your SNI headers and the IP addresses. The only thing DoH does is stopping DNS spoofing at the cost of handing your data to a third party.
        coldpie 5y ago
        > The only thing DoH does is stopping DNS spoofing at the cost of handing your data to a third party. It sounds like you think that's not worth it, but the evidence is that others disagree. Personally, I see both the pros & cons and have no strong feelings either way. I trust Mozilla's evaluation of the pros & cons more than I trust my own so I'm happy to do whatever they think is best, and I suspect most users feel the same way. If you disagree with their evaluation, you can toggle it off in Preferences, and they even show a banner on first start-up giving you that option.
    - JoshTriplett 5y ago
      I don't want to trust my Internet provider to do anything other than route encrypted packets. I don't want any other service than that from them, and I don't trust them any further than "exchange bandwidth for money".
    - recursive 5y ago
      DoH brings us closer to being able to use an internet provider you don't trust. And I already don't trust my ISP's DNS servers.
    - SilverRed 5y ago
      All ISPs in Australia run malicious DNS servers and it is required by law. So my options are to use DoH and solve the problem or not use the internet.
  - xg15 5y ago
    > I'd argue that if you're using it, you trust it. Nope.
- kevin_thibedeau 5y ago
  Your ISP is selling all of your internet activity to data brokers. This gets added into the detail profile they have on your spending, preferences, political attitudes, and much more. DoH takes that away.
  - elric 5y ago
    Maybe your ISP is, but mine is not. DoH does not take that away. It might move it away from the hands of your apparently adversarial ISP, but delivers the information in the hands of whoever is running those DoH servers...presumably Cloudflare, who already hold far too much sway for my comfort.
    - 542458 5y ago
      To qualify as a DoH resolver you have to agree to not log data for purposes other than providing the service, not keep logs for longer than 24h, and not sell any such data. This is audited. https://wiki.mozilla.org/Security/DOH-resolver-policy https://wiki.mozilla.org/Security/DOH-resolver-policy
      - autoexec 5y ago
        Where are you seeing anything about audits? The link just says that Mozilla can decide to remove people from the TRR program. They aren't sending people to Cloudflare and Comcast's server rooms. It's great that should a violation be disclosed to the public Mozilla might remove them, but unless there's a whistleblower the public will never know what's being done with their browsing history.
tyingq 5y ago
It would be nice if Firefox supported some way to automatically rotate which backend provider it's using for DoH. This would keep any one entity from having a continuous feed of every DNS lookup.
- moltar 5y ago
  Great idea. Would a local load balancing proxy do the trick?
  - vngzs 5y ago
    Not with a TCP proxy. To establish a HTTPS tunnel, the client needs to know the identity of the remote end for certificate validation. Randomizing remote ends with a naive proxy would lead to TLS errors. So you'd likely configure your browser to do DoH destined for that proxy, and have the proxy generate DoH requests to the remote ends. The downside is you'd have to somewhat manually set up certificate trust between your client and your proxy - either by trusting the proxy's certificate, or installing a root CA that issues the proxy's certificate in your browser's trust store.
  - jeroenhd 5y ago
    I use my PiHole to do balancing like this. I've set it up with DoT and DoH so that DNS requests are spread across several servers. Then, I expose my PiHole as a DoT + DoH server (DoT for Linux and Android, DoH for Firefox) so that I can always use my ad block lists and secured DNS traffic.
    - Thiez 5y ago
      Doesn't this just result in more organizations having your data? Presumably most DNS entries have some finite TTL, such as a few minutes / hours / days. Let's say one of your favorite websites has a TTL of 10 hours, and you visit this website once per day. Then eventually (soon!) you will have asked most or all of your servers for that domain, so now they all have your data. Or do you have your PiHole configured that it always asks the same server for the same domain?
justusthane 5y ago
As a sysadmin for an organization with our own internal DNS servers that clients need to hit, how will this impact us? Do I need to deploy a GPO to disable DoH in order to force FF to keep using our DNS servers?
- chaz6 5y ago
  This is answered in the FAQ at https://support.mozilla.org/en-US/kb/dns-over-https-doh-faqs#w_how-will-doh-impact-enterprises-with-custom-dns-solutions https://support.mozilla.org/en-US/kb/dns-over-https-doh-faqs...
  - justusthane 5y ago
    Ah, thank you.
- gnabgib 5y ago
  There's a windows GPO key[0] and a canary domain[1] you can NXDOMAIN (use-application-dns.net). Both of these only control the default (it won't override a user personally choosing the setting). [0]: https://github.com/mozilla/policy-templates/blob/master/README.md#DNSOverHTTPS https://github.com/mozilla/policy-templates/blob/master/READ... [1]: https://support.mozilla.org/en-US/kb/canary-domain-use-application-dnsnet https://support.mozilla.org/en-US/kb/canary-domain-use-appli...
  - pbhjpbhj 5y ago
    Ah, so users can choose to override the local network administration? I didn't realise that. No way to prevent my family browsing to undesirable and unsafe sites without personally admin-ing each device and/or directly monitoring use? I realise this is currently all leaky, my attitude was to put controls in place (DNS based) and if they learnt to hack around it then they're probably old enough to handle what they find ... doesn't work for malware, etc., however. Presumably enabling DoH makes malware, advertising, etc., impossible to block? When is MS Windows going to use DoH to force access for monitoring, currently I block a few domains.
netr0ute 5y ago
What happens if the DoH servers are blocked? I do this at home to stop any client from bypassing PiHole and if FF isn't smart enough to consider this scenario, then that's bad.
- roody15 5y ago
  It fallbacks to local DNS
  - netr0ute 5y ago
    This is the kind of answer I needed.
- sodality2 5y ago
  I'd hope your PiHole at least resolves over DoH... if not consider AdGuard Home instead
  - netr0ute 5y ago
    It's not the PiHole itself that's the problem, but rather the clients on the LAN. I already redirect the PiHole's traffic over a VPN so the ISP is none the wiser, but I could go further and use DoH for that too.
  - e12e 5y ago
    That would require a valid certificate, wwouldn't it? (for it to work out of the box)
    - sodality2 5y ago
      Not for the pihole to use DoH to resolve regular :53 DNS requests, no. For it to act as a DoH DNS server, though, ie requests to it are encrypted, you would need one, yeah.
      - e12e 5y ago
betaby 5y ago
Mozilla is literally switching Canadian users to use government's (CIRA) DNS by default. Seriously, how that's a good thing?
- dubcanada 5y ago
  First of all, CIRA is not the government, it is an elected public company. Second of all, it is not switching to use CIRA's DNS, it is added CIRA DNS to their revolver so .ca domains get fed through Mozilla's DNS over HTTP, rather then going Mozilla DNS <-> CIRA.
  - betaby 5y ago
    No? What does it even mean 'added CIRA DNS to their revolver so .ca domains get fed through Mozilla's DNS over HTTP'. Please explain in technical terms.
    - dubcanada 5y ago
      CIRA is a root domain company (like Verisign for .com), it has root records because it owns the root nameservers for all .ca domains. All they are doing is adding those to Mozilla's existing supply (Cloudflare provides other DNS records). So rather then going Mozilla -> Cloudflare -> CIRA and back, it now just goes Mozilla -> CIRA. I don't have time to explain how DNS works. Look up Mozilla’s Trusted Recursive Resolver and how it works.
      - betaby 5y ago
        No. Mozilla changes is about recursor, not '.ca' domain.
- UseStrict 5y ago
  CIRA isn't government owned or backed, it's a member-directed not-for-profit organization. The government doesn't have anything beyond a non-voting board seat.
- _verandaguy 5y ago
uniqueuid 5y ago
Chris Siebenmann has written extensively and early on what this means for organizations: https://utcc.utoronto.ca/~cks/space/blog/web/FirefoxDNSOverHTTPSAndUs https://utcc.utoronto.ca/~cks/space/blog/web/FirefoxDNSOverH...
- fulafel 5y ago
  I wonder what's the attraction of split horizon dns especially at an academic institution. It seems it will obviously break stuff since all kinds of things rely on dns working as it was designed to, providing a global namespace.
  - ryan29 5y ago
    I personally use split horizon DNS for my home lab. I have several things that I put behind Cloudflare, but I don't want my local access to go me > cloudflare > me, so I use split horizon DNS. If you're not behind something like Cloudflare you can use NAT reflection (hairpin NAT), but those are a bit of a hack. Canada also has some large, private networks used by provincial governments that use split horizon DNS and DoH is going to be a huge pain for them. One specific example would be libraries that are on a private network and have access to resources handled differently depending on how you connect; via the private network = no auth, but via the internet = auth required. Split horizon DNS is a simple, practical way of affecting how traffic is routed in a lot of cases.
    - josephcsible 5y ago
      > you can use NAT reflection (hairpin NAT), but those are a bit of a hack. You think that hairpin NAT is a hack, but that split-horizon DNS isn't?
  - uniqueuid 5y ago
    > Fortunately we already have a split-horizon DNS setup, because we long ago made the decision to have a private top level domain for all of our sandbox networks, so we use our existing DNS infrastructure to give BINAT'd machines different IP addresses in the internal and external views. https://utcc.utoronto.ca/~cks/space/blog/sysadmin/BinatAndSplitHorizonDNS https://utcc.utoronto.ca/~cks/space/blog/sysadmin/BinatAndSp...
rank0 5y ago
I'm not sure how I feel about DoH. It seems like there a ton of unnecessary overhead added by placing the super lightweight DNS protocol on top of HTTP. My initial reaction is also that I might lose some control over my network and which domains hosts query on my network. Are things like DNS sinkholes and domain blacklisting still possible with DoH?
- luto 5y ago
  > Are things like DNS sinkholes and domain blacklisting still possible with DoH? they aren't, which is part of the reason DoH is implemented in the first place.
  - rank0 5y ago
    Can you expand on this a little more? I do not understand the reasoning here
    - Kalium 5y ago
      The tools to administer a home network, such as DNS blocking and DNS sinkholes, are the same tools nations use to administer their populaces. If the default in Firefox is to enable blocking and sinkholes for the home administrator's benefit, it will similarly be to the benefit of oppressive administrations. Home administrators who control their endpoints can turn DoH off with relative ease. By comparison, most governments cannot.
      - swiley 5y ago
        It would be nice if it would check the resolver config files (like the hosts file) with it enabled though. That was a really easy way to block harmful stuff or name things without requiring DNS. Having to choose between encryption and easy configuration is pretty poor UX.
        Kalium 5y ago
        Naively, that seems like something that could be a very useful configuration option to set! Though I can also see why you might default to having it off if you don't trust the host resolver very much in the country-administering-people case.
scaryclam 5y ago
For anyone wondering, DoH = DNS over HTTPS
hulitu 5y ago
They force DoH in the name of freedom. What will be the DoH resolver ? Cloudfare ? Google ? One must use GP to disable this on Win or a DNS server on linux Everyday the reasons to keep firefox are converging to 0.
- csunbird 5y ago
  How hard would it be to run a private DoH server? (This is a serious question, not a snarky comment)
  - cuillevel3 5y ago
    Easy: https://dnsprivacy.org/wiki/display/DP/DNS+Privacy+Clients#DNSPrivacyClients-Localforwarders https://dnsprivacy.org/wiki/display/DP/DNS+Privacy+Clients#D... I want to add, that you can't run your own public DNS server nowadays, because it can be misused for DOS and hosting providers scan for open DNS servers. So if you want your own public DNS resolver, DOH is much easier.
    - csunbird 5y ago
      > because it can be misused for DOS and hosting providers scan for open DNS servers Can you elaborate? I am thinking of doing exactly that, in case of need.
      - lights0123 5y ago
        https://blog.cloudflare.com/deep-inside-a-dns-amplification-ddos-attack/#opendnsresolversbaneoftheinternet https://blog.cloudflare.com/deep-inside-a-dns-amplification-...
        csunbird 5y ago
        Very, very interesting… I forgot the fact that ip addresses can be spoofed in the UDP packets, essentially making DNS resolvers to carry out the attack for botnets.
roody15 5y ago
Terrible decision IMO. To default to application level DNS that then defaults to a large centralized DNS provider is the opposite of supporting an open and decentralized internet. This should be an optional feature that is Opt in. Instead a quick banner appears when you start Firefox and if you don't quickly hit disable … it enables this by default. disappointing behavior by Mozilla
- 542458 5y ago
  I’m not sure how this is significantly worse than the DNS status quo despite being more centralized. Traditional DNS is very easy for everybody and anybody to snoop and tamper with, including your ISP, the government, the resolver and anybody else with a chunk of network infrastructure on your path. DoH is very hard for anybody but the resolver to snoop or tamper with. The resolvers commit to not selling data and not retaining logs for more than 24h. Of course a court order will take precedence, but we’ve gone from “anybody who cares can see and tamper with your DNS queries” to “just your resolver can see and tamper with your DNS queries, and they’re audited so that'll probably only happen under court order”. All else held equal the increased centralization would make DoH a step backwards - but all else isn’t held equal, and traditional DNS is such a bad protocol that most of the advantages of its decentralization don’t actually manifest. And it’s not like the DNS protocol weaknesses are hypothetical - they’re used en masse by regimes and corporations around the world. With that in mind, I’d say default-on is a reasonable decision.
- josephcsible 5y ago
  DNS is heavily abused by network operators for censorship and surveillance purposes. IMO, a slightly more centralized Internet is a good tradeoff to make that impossible. And if the current DoH provider ever does abuse their position, it'd be easy for Mozilla to switch to a new provider.
  - e12e 5y ago
    Used to be you could mostly avoid such censorship by pointing a local resolver at the dns roots (or alternate roots..). I suppose you can run your own dns resolver for dot - but there seems to be much poorer support for network level configuration (like DHCP)? I'd like my android TV, my TV, my phone and my computers and my guests to use my local settings - automatically. Now every device need manual setup for every network?
lucasyvas 5y ago
Is it possible to configure multiple DoH providers so your DNS requests round robin like an actual DNS server list could/would?
- cpeterso 5y ago
  You can point Firefox to any DoH provider you like, but there is no setting to set multiple DoH providers. If you are concerned about DoH providers tracking you, it seems like using two DoH providers would give each of them half your browsing history, which probably covers all the same sites as your full browsing history. https://support.mozilla.org/en-US/kb/firefox-dns-over-https#w_switching-providers https://support.mozilla.org/en-US/kb/firefox-dns-over-https#...
FpUser 5y ago
I am curious how this will affect various applications and testing suites as those would know nothing about that Mozilla's decision. All in all it is sickening to watch all those entities trying to to usurp control over the areas that are better not to be fucked with.
admax88q 5y ago
There's a lot of lament that this bypasses the operating system level config, but I feel like we wouldn't be here if the operating system had stepped up their DNS any time in the last several years. This is a workaround for the fact that many networks are hostile to DNS lookups (injecting ads, tracking, captive portals), and operating systems continue to just default to the ISPs DNS provider, which is often hostile. OS's could have switched to running their own local caching resolver ala unbound years ago, could have integrated DNSCrypt or DoT years ago. But instead the defaults are still horribly unsecure for the average user. For the techie user who's running PiHole or some custom local DNS, yeah this will be annoying, but for the average user who's just delegating to their ISP that is then tracking their DNS lookups and injecting ads if they mistype a domain, this is a win.
- floatingatoll 5y ago
  Release (not beta) macOS already lets you configure your system to use DNS-over-HTTPS, if you know the magic incantation to chant at it. Apple hasn't added UI for it yet, but it's available and works when enabled.
- vbezhenar 5y ago
  How OS is going to circumvent local DNS? Hardcode 1.1.1.1? It's very easy for ISP to block this address.
- TurningCanadian 5y ago
  I didn't realize that Fedora dropped that proposal https://pagure.io/fesco/issue/1511 https://pagure.io/fesco/issue/1511 May have been related to IPv6? Not sure. I remember trying it out at the time (https://fedoraproject.org/wiki/Changes/Default_Local_DNS_Resolver#How_to_get_Unbound_and_dnssec-trigger_running.3F https://fedoraproject.org/wiki/Changes/Default_Local_DNS_Res...) and not running in to issues
- elric 5y ago
  So the fact that some ISPs are apparently untrustworthy is enough to blow up the whole thing which has worked pretty well for the past 30 years? There are plenty of valid use cases for captive portals. But yes, injecting ads and tracking are obviously messed up, but DNS is only a tiny part of that problem, and I don't see how using DoH will help with them. If you want to get rid those, then get rid of shitty ISPs. This is throwing out the baby with the bathwater. This will simply lead to ISPs and network operators blocking DoH. And instead of a wonderfully decentralized DNS, we'll end up with centralized DoH in the hands of Cloudflare and their ilk. Who have been shown repeatedly to be user hostile; especially towards privacy conscious users.
np-tokumei 5y ago
In the current designs, plaintext domain names are mainly exposed through two channels: the SNI extension in TLS, and traditional DNS name resolutions—the deployment of DoH/DoT is thus a prerequisite for ESNI. Equivalently, the use of DoH/DoT will not provide any meaningful privacy if domain names are still exposed through the (unencrypted) SNI extension in TLS handshake traffic. Recently, there is a push for the deployment of DoH/DoT, with major organizations already supporting it (e.g., Google, Cloudflare, Firefox), though this has not been followed by an equivalent effort for the deployment of ESNI, which is now being reworked in an Internet draft called Encrypted Client Hello (ECH: https://www.ietf.org/archive/id/draft-ietf-tls-esni-12.txt https://www.ietf.org/archive/id/draft-ietf-tls-esni-12.txt). Unless the confidentiality of domain names is preserved on both channels (SNI and DNS), neither technology can provide any actual privacy benefit if deployed individually. Also many websites hosted on IP addresses that do not host any other domains, the IP information can be used to infer which domain was visited. We have carried out some studies to investigate the extent to which domain name inference can be done through IP address information. For more technical details pls have a look at these papers: "Assessing the Privacy Benefits of Domain Name Encryption" https://arxiv.org/pdf/1911.00563.pdf https://arxiv.org/pdf/1911.00563.pdf "Domain name encryption is not enough: privacy leakage via IP-based website fingerprinting" https://petsymposium.org/2021/files/papers/issue4/popets-2021-0078.pdf https://petsymposium.org/2021/files/papers/issue4/popets-202...
- shawnz 5y ago
  Firefox has indeed been making efforts to enable ESNI/ECH alongside their efforts to enable DoH. As you mention, they are mostly only useful together.
  - np-tokumei 5y ago
    yea, they have also disabled/removed ESNI since version 85 https://www.ghacks.net/2021/02/24/the-case-of-the-missing-esni-support-in-firefox-85/ https://www.ghacks.net/2021/02/24/the-case-of-the-missing-es... Hopefully ECH will make it this time
enriquto 5y ago
how could firefox know that you are canadian? the title sounds nonsensical to me
CarelessExpert 5y ago
Nice to see they'll be making it easy to opt out. I use a Pihole on my network and this would be an enormous PITA if it was hard (or worse, impossible) to disable... Edit: I forgot, as another commenter pointed out, they also have a canary domain (use-application-dns.net) that you can blackhole to disable this at the network level (unless the user manually enables DoH).
- warhorse10_9 5y ago
  You can also just set the policy to disable this in registry or using policy.json on Linux. Mac has a similar setup, i'm just not familiar with it.
  - CarelessExpert 5y ago
    Yeah, I ended up going the canary domain route, and then setting up my pihole itself to use DoH using cloudflared outbound. Best of both worlds!
    - iso1210 5y ago
      Yes, canary domain is fine - at least while it still works. I don't want to have to configure DNS for 50 different applications on 20 different machines. My OS does DNS, and my DHCP server doles out the DNS server I want my machines to use.
      - CarelessExpert 5y ago
        The Mozilla page on the topic (https://support.mozilla.org/en-US/kb/canary-domain-use-application-dnsnet https://support.mozilla.org/en-US/kb/canary-domain-use-appli...) notes that: > The use of this domain is specified by Mozilla, as a limited-time measure until a method for signaling the presence of DNS-based content filtering is defined and adopted by an Internet standards body. Presumably that'd be the IETF, and I have no idea which committee would be working on this, if there's a draft RFC in the works, etc. But it's clear the expectation is some sort of standard mechanism will eventually replace the canary domain that yields the same functionality but in a less hacky way.
tombh 5y ago
DoH = DNS over HTTPS
dleslie 5y ago
Worth noting is that the CIRA is a Canadian organization and so will be restricted by Canadian court orders and regulator rulings. So this rollout of DoH to Canadians isn't nearly as disruptive as it could be.
- gdevenyi 5y ago
  It took way too much scrolling to find a comment like this. Don't forget C-10
protomyth 5y ago
Is there an open source DoH resolver?
- tristor 5y ago
  Unbound supports DoH since 1.12.0 released in 2020. [1] [1]: https://blog.apnic.net/2020/12/14/dns-over-https-in-unbound/ https://blog.apnic.net/2020/12/14/dns-over-https-in-unbound/
  - protomyth 5y ago
    Anyone know if NSD or Bind is going that way?
nfoz 5y ago
What is the mechanism by which the software determines that you are "located in Canada"?
elktea 5y ago
Can't an ISP just respond with NXDOMAIN for use-application-dns.net and force Firefox to use their resolvers?
kilodeca 5y ago
What's wrong with DOT?
Shorel 5y ago
I disable it, because I get MORE spam, and unwanted ads with this enabled than without. Yep, my hosts file is that complete.

231 points by tristor 5y ago

Can someone enlighten me as to why this should be a trusted default? Because I inherently wouldn't trust it. I wouldn't say I trust NextDNS, but I currently use them for DoH.

0xTJ 5y ago
I'd argue that if you're using it, you trust it. Otherwise you wouldn't use it. This seems a lot better than just letting the internet provider give a regular DNS.
- tremon 5y ago
  This seems a lot better than just letting the internet provider give a regular DNS Why? You're already using your internet provider, so you trust them. Otherwise you wouldn't use them.
  - dewey 5y ago
    > Otherwise you wouldn't use them. A lot of times you don't really have a choice which ISP to use so that's not really a good argument.
  - coldpie 5y ago
    No, the point of DOH is that you don't have to trust your ISP. In many countries the ISPs are actively hostile[1]. You do have to trust the DOH provider, yes, but in this case Mozilla (or yourself if you have the tech knowledge) will be verifying trust on your behalf. You cannot do that at all with plain ol' DNS. DOH is a "best of a bad situation" kind of solution, it's a reaction to hostile ISPs. It's not something anyone really likes. [1] https://www.internetsociety.org/blog/2014/04/turkish-isps-hijacking-traffic-this-is-how-an-internet-breaks/ https://www.internetsociety.org/blog/2014/04/turkish-isps-hi...
    - jeltz 5y ago
      DoH means handing your data to one more party since your ISP can already see your SNI headers and the IP addresses. The only thing DoH does is stopping DNS spoofing at the cost of handing your data to a third party.
      - coldpie 5y ago
        > The only thing DoH does is stopping DNS spoofing at the cost of handing your data to a third party. It sounds like you think that's not worth it, but the evidence is that others disagree. Personally, I see both the pros & cons and have no strong feelings either way. I trust Mozilla's evaluation of the pros & cons more than I trust my own so I'm happy to do whatever they think is best, and I suspect most users feel the same way. If you disagree with their evaluation, you can toggle it off in Preferences, and they even show a banner on first start-up giving you that option.
  - JoshTriplett 5y ago
    I don't want to trust my Internet provider to do anything other than route encrypted packets. I don't want any other service than that from them, and I don't trust them any further than "exchange bandwidth for money".
  - recursive 5y ago
    DoH brings us closer to being able to use an internet provider you don't trust. And I already don't trust my ISP's DNS servers.
  - SilverRed 5y ago
    All ISPs in Australia run malicious DNS servers and it is required by law. So my options are to use DoH and solve the problem or not use the internet.
- xg15 5y ago
  > I'd argue that if you're using it, you trust it. Nope.
kevin_thibedeau 5y ago
Your ISP is selling all of your internet activity to data brokers. This gets added into the detail profile they have on your spending, preferences, political attitudes, and much more. DoH takes that away.
- elric 5y ago
  Maybe your ISP is, but mine is not. DoH does not take that away. It might move it away from the hands of your apparently adversarial ISP, but delivers the information in the hands of whoever is running those DoH servers...presumably Cloudflare, who already hold far too much sway for my comfort.
  - 542458 5y ago
    To qualify as a DoH resolver you have to agree to not log data for purposes other than providing the service, not keep logs for longer than 24h, and not sell any such data. This is audited. https://wiki.mozilla.org/Security/DOH-resolver-policy https://wiki.mozilla.org/Security/DOH-resolver-policy
    - autoexec 5y ago
      Where are you seeing anything about audits? The link just says that Mozilla can decide to remove people from the TRR program. They aren't sending people to Cloudflare and Comcast's server rooms. It's great that should a violation be disclosed to the public Mozilla might remove them, but unless there's a whistleblower the public will never know what's being done with their browsing history.

tyingq 5y ago

It would be nice if Firefox supported some way to automatically rotate which backend provider it's using for DoH. This would keep any one entity from having a continuous feed of every DNS lookup.

moltar 5y ago
Great idea. Would a local load balancing proxy do the trick?
- vngzs 5y ago
  Not with a TCP proxy. To establish a HTTPS tunnel, the client needs to know the identity of the remote end for certificate validation. Randomizing remote ends with a naive proxy would lead to TLS errors. So you'd likely configure your browser to do DoH destined for that proxy, and have the proxy generate DoH requests to the remote ends. The downside is you'd have to somewhat manually set up certificate trust between your client and your proxy - either by trusting the proxy's certificate, or installing a root CA that issues the proxy's certificate in your browser's trust store.
- jeroenhd 5y ago
  I use my PiHole to do balancing like this. I've set it up with DoT and DoH so that DNS requests are spread across several servers. Then, I expose my PiHole as a DoT + DoH server (DoT for Linux and Android, DoH for Firefox) so that I can always use my ad block lists and secured DNS traffic.
  - Thiez 5y ago
    Doesn't this just result in more organizations having your data? Presumably most DNS entries have some finite TTL, such as a few minutes / hours / days. Let's say one of your favorite websites has a TTL of 10 hours, and you visit this website once per day. Then eventually (soon!) you will have asked most or all of your servers for that domain, so now they all have your data. Or do you have your PiHole configured that it always asks the same server for the same domain?

justusthane 5y ago

As a sysadmin for an organization with our own internal DNS servers that clients need to hit, how will this impact us? Do I need to deploy a GPO to disable DoH in order to force FF to keep using our DNS servers?

chaz6 5y ago
This is answered in the FAQ at https://support.mozilla.org/en-US/kb/dns-over-https-doh-faqs#w_how-will-doh-impact-enterprises-with-custom-dns-solutions https://support.mozilla.org/en-US/kb/dns-over-https-doh-faqs...
- justusthane 5y ago
  Ah, thank you.
gnabgib 5y ago
There's a windows GPO key[0] and a canary domain[1] you can NXDOMAIN (use-application-dns.net). Both of these only control the default (it won't override a user personally choosing the setting). [0]: https://github.com/mozilla/policy-templates/blob/master/README.md#DNSOverHTTPS https://github.com/mozilla/policy-templates/blob/master/READ... [1]: https://support.mozilla.org/en-US/kb/canary-domain-use-application-dnsnet https://support.mozilla.org/en-US/kb/canary-domain-use-appli...
- pbhjpbhj 5y ago
  Ah, so users can choose to override the local network administration? I didn't realise that. No way to prevent my family browsing to undesirable and unsafe sites without personally admin-ing each device and/or directly monitoring use? I realise this is currently all leaky, my attitude was to put controls in place (DNS based) and if they learnt to hack around it then they're probably old enough to handle what they find ... doesn't work for malware, etc., however. Presumably enabling DoH makes malware, advertising, etc., impossible to block? When is MS Windows going to use DoH to force access for monitoring, currently I block a few domains.

netr0ute 5y ago

What happens if the DoH servers are blocked? I do this at home to stop any client from bypassing PiHole and if FF isn't smart enough to consider this scenario, then that's bad.

roody15 5y ago
It fallbacks to local DNS
- netr0ute 5y ago
  This is the kind of answer I needed.
sodality2 5y ago
I'd hope your PiHole at least resolves over DoH... if not consider AdGuard Home instead
- netr0ute 5y ago
  It's not the PiHole itself that's the problem, but rather the clients on the LAN. I already redirect the PiHole's traffic over a VPN so the ISP is none the wiser, but I could go further and use DoH for that too.
- e12e 5y ago
  That would require a valid certificate, wwouldn't it? (for it to work out of the box)
  - sodality2 5y ago
    Not for the pihole to use DoH to resolve regular :53 DNS requests, no. For it to act as a DoH DNS server, though, ie requests to it are encrypted, you would need one, yeah.
    - e12e 5y ago

betaby 5y ago

Mozilla is literally switching Canadian users to use government's (CIRA) DNS by default. Seriously, how that's a good thing?

dubcanada 5y ago
First of all, CIRA is not the government, it is an elected public company. Second of all, it is not switching to use CIRA's DNS, it is added CIRA DNS to their revolver so .ca domains get fed through Mozilla's DNS over HTTP, rather then going Mozilla DNS <-> CIRA.
- betaby 5y ago
  No? What does it even mean 'added CIRA DNS to their revolver so .ca domains get fed through Mozilla's DNS over HTTP'. Please explain in technical terms.
  - dubcanada 5y ago
    CIRA is a root domain company (like Verisign for .com), it has root records because it owns the root nameservers for all .ca domains. All they are doing is adding those to Mozilla's existing supply (Cloudflare provides other DNS records). So rather then going Mozilla -> Cloudflare -> CIRA and back, it now just goes Mozilla -> CIRA. I don't have time to explain how DNS works. Look up Mozilla’s Trusted Recursive Resolver and how it works.
    - betaby 5y ago
      No. Mozilla changes is about recursor, not '.ca' domain.
UseStrict 5y ago
CIRA isn't government owned or backed, it's a member-directed not-for-profit organization. The government doesn't have anything beyond a non-voting board seat.
_verandaguy 5y ago

uniqueuid 5y ago

Chris Siebenmann has written extensively and early on what this means for organizations: https://utcc.utoronto.ca/~cks/space/blog/web/FirefoxDNSOverHTTPSAndUs https://utcc.utoronto.ca/~cks/space/blog/web/FirefoxDNSOverH...

fulafel 5y ago
I wonder what's the attraction of split horizon dns especially at an academic institution. It seems it will obviously break stuff since all kinds of things rely on dns working as it was designed to, providing a global namespace.
- ryan29 5y ago
  I personally use split horizon DNS for my home lab. I have several things that I put behind Cloudflare, but I don't want my local access to go me > cloudflare > me, so I use split horizon DNS. If you're not behind something like Cloudflare you can use NAT reflection (hairpin NAT), but those are a bit of a hack. Canada also has some large, private networks used by provincial governments that use split horizon DNS and DoH is going to be a huge pain for them. One specific example would be libraries that are on a private network and have access to resources handled differently depending on how you connect; via the private network = no auth, but via the internet = auth required. Split horizon DNS is a simple, practical way of affecting how traffic is routed in a lot of cases.
  - josephcsible 5y ago
    > you can use NAT reflection (hairpin NAT), but those are a bit of a hack. You think that hairpin NAT is a hack, but that split-horizon DNS isn't?
- uniqueuid 5y ago
  > Fortunately we already have a split-horizon DNS setup, because we long ago made the decision to have a private top level domain for all of our sandbox networks, so we use our existing DNS infrastructure to give BINAT'd machines different IP addresses in the internal and external views. https://utcc.utoronto.ca/~cks/space/blog/sysadmin/BinatAndSplitHorizonDNS https://utcc.utoronto.ca/~cks/space/blog/sysadmin/BinatAndSp...

rank0 5y ago

I'm not sure how I feel about DoH. It seems like there a ton of unnecessary overhead added by placing the super lightweight DNS protocol on top of HTTP. My initial reaction is also that I might lose some control over my network and which domains hosts query on my network. Are things like DNS sinkholes and domain blacklisting still possible with DoH?

luto 5y ago
> Are things like DNS sinkholes and domain blacklisting still possible with DoH? they aren't, which is part of the reason DoH is implemented in the first place.
- rank0 5y ago
  Can you expand on this a little more? I do not understand the reasoning here
  - Kalium 5y ago
    The tools to administer a home network, such as DNS blocking and DNS sinkholes, are the same tools nations use to administer their populaces. If the default in Firefox is to enable blocking and sinkholes for the home administrator's benefit, it will similarly be to the benefit of oppressive administrations. Home administrators who control their endpoints can turn DoH off with relative ease. By comparison, most governments cannot.
    - swiley 5y ago
      It would be nice if it would check the resolver config files (like the hosts file) with it enabled though. That was a really easy way to block harmful stuff or name things without requiring DNS. Having to choose between encryption and easy configuration is pretty poor UX.
      - Kalium 5y ago
        Naively, that seems like something that could be a very useful configuration option to set! Though I can also see why you might default to having it off if you don't trust the host resolver very much in the country-administering-people case.

scaryclam 5y ago

For anyone wondering, DoH = DNS over HTTPS

hulitu 5y ago

They force DoH in the name of freedom. What will be the DoH resolver ? Cloudfare ? Google ? One must use GP to disable this on Win or a DNS server on linux Everyday the reasons to keep firefox are converging to 0.

csunbird 5y ago
How hard would it be to run a private DoH server? (This is a serious question, not a snarky comment)
- cuillevel3 5y ago
  Easy: https://dnsprivacy.org/wiki/display/DP/DNS+Privacy+Clients#DNSPrivacyClients-Localforwarders https://dnsprivacy.org/wiki/display/DP/DNS+Privacy+Clients#D... I want to add, that you can't run your own public DNS server nowadays, because it can be misused for DOS and hosting providers scan for open DNS servers. So if you want your own public DNS resolver, DOH is much easier.
  - csunbird 5y ago
    > because it can be misused for DOS and hosting providers scan for open DNS servers Can you elaborate? I am thinking of doing exactly that, in case of need.
    - lights0123 5y ago
      https://blog.cloudflare.com/deep-inside-a-dns-amplification-ddos-attack/#opendnsresolversbaneoftheinternet https://blog.cloudflare.com/deep-inside-a-dns-amplification-...
      - csunbird 5y ago
        Very, very interesting… I forgot the fact that ip addresses can be spoofed in the UDP packets, essentially making DNS resolvers to carry out the attack for botnets.

roody15 5y ago

Terrible decision IMO. To default to application level DNS that then defaults to a large centralized DNS provider is the opposite of supporting an open and decentralized internet. This should be an optional feature that is Opt in. Instead a quick banner appears when you start Firefox and if you don't quickly hit disable … it enables this by default. disappointing behavior by Mozilla

542458 5y ago
I’m not sure how this is significantly worse than the DNS status quo despite being more centralized. Traditional DNS is very easy for everybody and anybody to snoop and tamper with, including your ISP, the government, the resolver and anybody else with a chunk of network infrastructure on your path. DoH is very hard for anybody but the resolver to snoop or tamper with. The resolvers commit to not selling data and not retaining logs for more than 24h. Of course a court order will take precedence, but we’ve gone from “anybody who cares can see and tamper with your DNS queries” to “just your resolver can see and tamper with your DNS queries, and they’re audited so that'll probably only happen under court order”. All else held equal the increased centralization would make DoH a step backwards - but all else isn’t held equal, and traditional DNS is such a bad protocol that most of the advantages of its decentralization don’t actually manifest. And it’s not like the DNS protocol weaknesses are hypothetical - they’re used en masse by regimes and corporations around the world. With that in mind, I’d say default-on is a reasonable decision.
josephcsible 5y ago
DNS is heavily abused by network operators for censorship and surveillance purposes. IMO, a slightly more centralized Internet is a good tradeoff to make that impossible. And if the current DoH provider ever does abuse their position, it'd be easy for Mozilla to switch to a new provider.
- e12e 5y ago
  Used to be you could mostly avoid such censorship by pointing a local resolver at the dns roots (or alternate roots..). I suppose you can run your own dns resolver for dot - but there seems to be much poorer support for network level configuration (like DHCP)? I'd like my android TV, my TV, my phone and my computers and my guests to use my local settings - automatically. Now every device need manual setup for every network?

lucasyvas 5y ago

Is it possible to configure multiple DoH providers so your DNS requests round robin like an actual DNS server list could/would?

cpeterso 5y ago
You can point Firefox to any DoH provider you like, but there is no setting to set multiple DoH providers. If you are concerned about DoH providers tracking you, it seems like using two DoH providers would give each of them half your browsing history, which probably covers all the same sites as your full browsing history. https://support.mozilla.org/en-US/kb/firefox-dns-over-https#w_switching-providers https://support.mozilla.org/en-US/kb/firefox-dns-over-https#...

FpUser 5y ago

I am curious how this will affect various applications and testing suites as those would know nothing about that Mozilla's decision. All in all it is sickening to watch all those entities trying to to usurp control over the areas that are better not to be fucked with.

admax88q 5y ago

There's a lot of lament that this bypasses the operating system level config, but I feel like we wouldn't be here if the operating system had stepped up their DNS any time in the last several years. This is a workaround for the fact that many networks are hostile to DNS lookups (injecting ads, tracking, captive portals), and operating systems continue to just default to the ISPs DNS provider, which is often hostile. OS's could have switched to running their own local caching resolver ala unbound years ago, could have integrated DNSCrypt or DoT years ago. But instead the defaults are still horribly unsecure for the average user. For the techie user who's running PiHole or some custom local DNS, yeah this will be annoying, but for the average user who's just delegating to their ISP that is then tracking their DNS lookups and injecting ads if they mistype a domain, this is a win.

floatingatoll 5y ago
Release (not beta) macOS already lets you configure your system to use DNS-over-HTTPS, if you know the magic incantation to chant at it. Apple hasn't added UI for it yet, but it's available and works when enabled.
vbezhenar 5y ago
How OS is going to circumvent local DNS? Hardcode 1.1.1.1? It's very easy for ISP to block this address.
TurningCanadian 5y ago
I didn't realize that Fedora dropped that proposal https://pagure.io/fesco/issue/1511 https://pagure.io/fesco/issue/1511 May have been related to IPv6? Not sure. I remember trying it out at the time (https://fedoraproject.org/wiki/Changes/Default_Local_DNS_Resolver#How_to_get_Unbound_and_dnssec-trigger_running.3F https://fedoraproject.org/wiki/Changes/Default_Local_DNS_Res...) and not running in to issues
elric 5y ago
So the fact that some ISPs are apparently untrustworthy is enough to blow up the whole thing which has worked pretty well for the past 30 years? There are plenty of valid use cases for captive portals. But yes, injecting ads and tracking are obviously messed up, but DNS is only a tiny part of that problem, and I don't see how using DoH will help with them. If you want to get rid those, then get rid of shitty ISPs. This is throwing out the baby with the bathwater. This will simply lead to ISPs and network operators blocking DoH. And instead of a wonderfully decentralized DNS, we'll end up with centralized DoH in the hands of Cloudflare and their ilk. Who have been shown repeatedly to be user hostile; especially towards privacy conscious users.

np-tokumei 5y ago

In the current designs, plaintext domain names are mainly exposed through two channels: the SNI extension in TLS, and traditional DNS name resolutions—the deployment of DoH/DoT is thus a prerequisite for ESNI. Equivalently, the use of DoH/DoT will not provide any meaningful privacy if domain names are still exposed through the (unencrypted) SNI extension in TLS handshake traffic. Recently, there is a push for the deployment of DoH/DoT, with major organizations already supporting it (e.g., Google, Cloudflare, Firefox), though this has not been followed by an equivalent effort for the deployment of ESNI, which is now being reworked in an Internet draft called Encrypted Client Hello (ECH: https://www.ietf.org/archive/id/draft-ietf-tls-esni-12.txt https://www.ietf.org/archive/id/draft-ietf-tls-esni-12.txt). Unless the confidentiality of domain names is preserved on both channels (SNI and DNS), neither technology can provide any actual privacy benefit if deployed individually. Also many websites hosted on IP addresses that do not host any other domains, the IP information can be used to infer which domain was visited. We have carried out some studies to investigate the extent to which domain name inference can be done through IP address information. For more technical details pls have a look at these papers: "Assessing the Privacy Benefits of Domain Name Encryption" https://arxiv.org/pdf/1911.00563.pdf https://arxiv.org/pdf/1911.00563.pdf "Domain name encryption is not enough: privacy leakage via IP-based website fingerprinting" https://petsymposium.org/2021/files/papers/issue4/popets-2021-0078.pdf https://petsymposium.org/2021/files/papers/issue4/popets-202...

shawnz 5y ago
Firefox has indeed been making efforts to enable ESNI/ECH alongside their efforts to enable DoH. As you mention, they are mostly only useful together.
- np-tokumei 5y ago
  yea, they have also disabled/removed ESNI since version 85 https://www.ghacks.net/2021/02/24/the-case-of-the-missing-esni-support-in-firefox-85/ https://www.ghacks.net/2021/02/24/the-case-of-the-missing-es... Hopefully ECH will make it this time

enriquto 5y ago

how could firefox know that you are canadian? the title sounds nonsensical to me

CarelessExpert 5y ago

Nice to see they'll be making it easy to opt out. I use a Pihole on my network and this would be an enormous PITA if it was hard (or worse, impossible) to disable... Edit: I forgot, as another commenter pointed out, they also have a canary domain (use-application-dns.net) that you can blackhole to disable this at the network level (unless the user manually enables DoH).

warhorse10_9 5y ago
You can also just set the policy to disable this in registry or using policy.json on Linux. Mac has a similar setup, i'm just not familiar with it.
- CarelessExpert 5y ago
  Yeah, I ended up going the canary domain route, and then setting up my pihole itself to use DoH using cloudflared outbound. Best of both worlds!
  - iso1210 5y ago
    Yes, canary domain is fine - at least while it still works. I don't want to have to configure DNS for 50 different applications on 20 different machines. My OS does DNS, and my DHCP server doles out the DNS server I want my machines to use.
    - CarelessExpert 5y ago
      The Mozilla page on the topic (https://support.mozilla.org/en-US/kb/canary-domain-use-application-dnsnet https://support.mozilla.org/en-US/kb/canary-domain-use-appli...) notes that: > The use of this domain is specified by Mozilla, as a limited-time measure until a method for signaling the presence of DNS-based content filtering is defined and adopted by an Internet standards body. Presumably that'd be the IETF, and I have no idea which committee would be working on this, if there's a draft RFC in the works, etc. But it's clear the expectation is some sort of standard mechanism will eventually replace the canary domain that yields the same functionality but in a less hacky way.

tombh 5y ago

DoH = DNS over HTTPS

dleslie 5y ago

Worth noting is that the CIRA is a Canadian organization and so will be restricted by Canadian court orders and regulator rulings. So this rollout of DoH to Canadians isn't nearly as disruptive as it could be.

gdevenyi 5y ago
It took way too much scrolling to find a comment like this. Don't forget C-10

protomyth 5y ago

Is there an open source DoH resolver?

tristor 5y ago
Unbound supports DoH since 1.12.0 released in 2020. [1] [1]: https://blog.apnic.net/2020/12/14/dns-over-https-in-unbound/ https://blog.apnic.net/2020/12/14/dns-over-https-in-unbound/
- protomyth 5y ago
  Anyone know if NSD or Bind is going that way?

nfoz 5y ago

What is the mechanism by which the software determines that you are "located in Canada"?

elktea 5y ago

Can't an ISP just respond with NXDOMAIN for use-application-dns.net and force Firefox to use their resolvers?

kilodeca 5y ago

What's wrong with DOT?

Shorel 5y ago

I disable it, because I get MORE spam, and unwanted ads with this enabled than without. Yep, my hosts file is that complete.