4 ms·

This doesn't address why this needs to be built in to the browser when Android already does DoH by itself. I assume there's a reason, does anyone know what it i

This doesn't address why this needs to be built in to the browser when Android already does DoH by itself. I assume there's a reason, does anyone know what it is?

seanieb 1y ago
Privacy.
- ape4 1y ago
  Yeah, Android is Google
  - woodrowbarlow 1y ago
    does android not allow you to configure a custom DoH resolver? could Mozilla simply offer a public resolver, and encourage users to switch at the OS level (possibly including a first-launch dialog offering to set the configuration for you)?
- LiamPowell 1y ago
  Why is DoH in the browser more private than DoH in the OS?
  - add-sub-mul-div 1y ago
    It's not Google. My heuristic is that the bigger the tech giant the more sophisticated, indirect, and obfuscated the sharing/selling of data.
    - benoau 1y ago
      The fact that Google has incurred over $3 billion in fines in recent years specifically for infringing people's privacy should be a consideration!
  - DetroitThrow 1y ago
    It's all about whether you trust the OS to not track you when doing DoH at that level. In both mobile browser ecosystems, I can see why users of a browser would prefer the independent browser to do the DoH themselves, rather than leave it to the OS.
  - lucideer 1y ago
    Because there are fewer actors to trust. In the OS you need to trust (1) the OS vendor, (2) the client vendor & (3) any VPN app or HTTP intermediary that's integrated with OS network APIs. In the client you need only to trust the client vendor.
    - e12e 1y ago
      Surely you're at the mercy of the hardware vendor and os in either case? Granted, the os would need to read your address space, not simply supply a recording DNS API, but still...
      - cogman10 1y ago
        The hardware and OS in the case of DoH only gets the IP address for the connection. It's not horribly hard to figure out who owns that IP address, but it's definitely harder than just reading a domain name.
      - lucideer 1y ago
        You're at the mercy of the hardware in all cases. You can't do anything without trusting some external party unless you make an apple pie from scratch, but reducing the number of parties needing trusting is usually a good security approach.
thyristan 1y ago
Query statistics is valuable data you can sell. Client DNS queries are in that regard similar to search queries and a default search engine setting, you can sell that to the highest bidder. So browser makers are incentivized to implement their own resolver with its own set of DNS servers instead of just the system ones. Either because they want to sell those statistics themselves. Or because they want to protect their users from the statistics collection of the underlying OS resolver or ISP resolver.
- khc 1y ago
  the browser, being the originator of these DNS queries, already knows what website you are visiting.
  - thyristan 1y ago
    Yes, but for a browser to be overtly reporting visited sites somewhere is often seen as dubious. Doing it stealthily by sending DNS queries less so, at least for less knowledgeable observers.
noirscape 1y ago
Android privacy tools are leaky (which is bad given it's privacy tooling, you don't want that to leak!) Their VPN tools on OS level are pretty notorious for not properly respecting kill switch settings[0]. That alone makes a native browser implementation a better solution than the OS version. [0]: https://mullvad.net/en/blog/dns-traffic-can-leak-outside-the-vpn-tunnel-on-android https://mullvad.net/en/blog/dns-traffic-can-leak-outside-the... is just one example I found on Google (in this case, using the C function getaddrinfo bypasses the tunnel entirely, which Chrome in particular uses for DNS queries - only android API calls respect the tunnel), but you hear about stuff like this every couple years; in that post they also link to a prior incident where connectivity checks and NTP updates were conveniently not using the VPN even when killswitches are active. Neither of these incidents have been fixed as of the time of writing (and Google explicitly doesn't consider conncheck/NTP calls occuring outside of the VPN tunnel to be a bug.)
- izacus 1y ago
  What does your post have to do with DoH though?
  - noirscape 1y ago
    Moreso giving a reason why you'd want an app to force DoH instead of trusting the OS to do it "correctly". Google has already shown to have a habit of not properly respecting privacy focused settings, and DoH is intended to be primarily privacy focused. (As it's used to prevent DNS tampering.)
jansper39 1y ago
I thought Android only supported DNS over TLS, so at least this opens up options for people.
alerighi 1y ago
First not all Android versions do that, and not all vendors implement that. Not everyone is running the latest version and has a Google Pixel. Second passing from the OS is less secure since there are a multitude of actors, Google, the device vendor, eventual VPN app, etc. that could get access to that queries (in fact apps to block ADS such as ADAway if you don't have root use VPN functionality to intercept DNS queries). In the end if you want to be safe better not pass from the OS in the first place.
- TiredOfLife 1y ago
  My Samsung phone is on android 9 (released 7 years go) and has DoH
ekr____ 1y ago
Android does same-provider auto-upgrade if it determines that the recursive supports DoH (last I checked, if it's on Google's list). However, this means that unless you configure your own resolver, you're vulnerable to whoever controls the network substituting their own resolver. Firefox uses a set of vetted and pre-specified resolvers ("trusted recursive resolvers"), so is less vulnerable to this form of attack. I say "less vulnerable" because by default it will fall back to the system DNS on failure, but you can configure hard-fail. You may or may not think this is a better design (I was one of the people responsible for Firefox doing things this way, so I do), but hopefully this explains the difference. See: https://educatedguesswork.org/posts/dns-security-dox/ https://educatedguesswork.org/posts/dns-security-dox/ for more on the difference.
- wander_forever 1y ago
  Yes, this. AND while Firefox is providing you the control to choose when to enable or disable DoH, you don't get that control at OS-level, or even the visibility of what the OS is choosing on your behalf for each such query.
wander_forever 1y ago
DoH in Firefox provides you the control to choose when to enable or disable and which DNS provider to choose, while Android does not provide any such choice or even make it known to the user when DoH is used or not. In addition, Firefox only partners with DNS providers that have legally-binding agreements for strongest privacy guarantees - see https://wiki.mozilla.org/Security/doh-resolver-policy https://wiki.mozilla.org/Security/doh-resolver-policy .
Phelinofist 1y ago
AFAIK Android does not do DoH but DoT - at least you can only set a DoT endpoint in the "private DNS" settings.

This doesn't address why this needs to be built in to the browser when Android already does DoH by itself. I assume there's a reason, does anyone know what it is?

seanieb 1y ago

Privacy.

ape4 1y ago
Yeah, Android is Google
- woodrowbarlow 1y ago
  does android not allow you to configure a custom DoH resolver? could Mozilla simply offer a public resolver, and encourage users to switch at the OS level (possibly including a first-launch dialog offering to set the configuration for you)?
LiamPowell 1y ago
Why is DoH in the browser more private than DoH in the OS?
- add-sub-mul-div 1y ago
  It's not Google. My heuristic is that the bigger the tech giant the more sophisticated, indirect, and obfuscated the sharing/selling of data.
  - benoau 1y ago
    The fact that Google has incurred over $3 billion in fines in recent years specifically for infringing people's privacy should be a consideration!
- DetroitThrow 1y ago
  It's all about whether you trust the OS to not track you when doing DoH at that level. In both mobile browser ecosystems, I can see why users of a browser would prefer the independent browser to do the DoH themselves, rather than leave it to the OS.
- lucideer 1y ago
  Because there are fewer actors to trust. In the OS you need to trust (1) the OS vendor, (2) the client vendor & (3) any VPN app or HTTP intermediary that's integrated with OS network APIs. In the client you need only to trust the client vendor.
  - e12e 1y ago
    Surely you're at the mercy of the hardware vendor and os in either case? Granted, the os would need to read your address space, not simply supply a recording DNS API, but still...
    - cogman10 1y ago
      The hardware and OS in the case of DoH only gets the IP address for the connection. It's not horribly hard to figure out who owns that IP address, but it's definitely harder than just reading a domain name.
    - lucideer 1y ago
      You're at the mercy of the hardware in all cases. You can't do anything without trusting some external party unless you make an apple pie from scratch, but reducing the number of parties needing trusting is usually a good security approach.

thyristan 1y ago

Query statistics is valuable data you can sell. Client DNS queries are in that regard similar to search queries and a default search engine setting, you can sell that to the highest bidder. So browser makers are incentivized to implement their own resolver with its own set of DNS servers instead of just the system ones. Either because they want to sell those statistics themselves. Or because they want to protect their users from the statistics collection of the underlying OS resolver or ISP resolver.

khc 1y ago
the browser, being the originator of these DNS queries, already knows what website you are visiting.
- thyristan 1y ago
  Yes, but for a browser to be overtly reporting visited sites somewhere is often seen as dubious. Doing it stealthily by sending DNS queries less so, at least for less knowledgeable observers.

noirscape 1y ago

Android privacy tools are leaky (which is bad given it's privacy tooling, you don't want that to leak!) Their VPN tools on OS level are pretty notorious for not properly respecting kill switch settings[0]. That alone makes a native browser implementation a better solution than the OS version. [0]: https://mullvad.net/en/blog/dns-traffic-can-leak-outside-the-vpn-tunnel-on-android https://mullvad.net/en/blog/dns-traffic-can-leak-outside-the... is just one example I found on Google (in this case, using the C function getaddrinfo bypasses the tunnel entirely, which Chrome in particular uses for DNS queries - only android API calls respect the tunnel), but you hear about stuff like this every couple years; in that post they also link to a prior incident where connectivity checks and NTP updates were conveniently not using the VPN even when killswitches are active. Neither of these incidents have been fixed as of the time of writing (and Google explicitly doesn't consider conncheck/NTP calls occuring outside of the VPN tunnel to be a bug.)

izacus 1y ago
What does your post have to do with DoH though?
- noirscape 1y ago
  Moreso giving a reason why you'd want an app to force DoH instead of trusting the OS to do it "correctly". Google has already shown to have a habit of not properly respecting privacy focused settings, and DoH is intended to be primarily privacy focused. (As it's used to prevent DNS tampering.)

jansper39 1y ago

I thought Android only supported DNS over TLS, so at least this opens up options for people.

alerighi 1y ago

First not all Android versions do that, and not all vendors implement that. Not everyone is running the latest version and has a Google Pixel. Second passing from the OS is less secure since there are a multitude of actors, Google, the device vendor, eventual VPN app, etc. that could get access to that queries (in fact apps to block ADS such as ADAway if you don't have root use VPN functionality to intercept DNS queries). In the end if you want to be safe better not pass from the OS in the first place.

TiredOfLife 1y ago
My Samsung phone is on android 9 (released 7 years go) and has DoH

ekr____ 1y ago

Android does same-provider auto-upgrade if it determines that the recursive supports DoH (last I checked, if it's on Google's list). However, this means that unless you configure your own resolver, you're vulnerable to whoever controls the network substituting their own resolver. Firefox uses a set of vetted and pre-specified resolvers ("trusted recursive resolvers"), so is less vulnerable to this form of attack. I say "less vulnerable" because by default it will fall back to the system DNS on failure, but you can configure hard-fail. You may or may not think this is a better design (I was one of the people responsible for Firefox doing things this way, so I do), but hopefully this explains the difference. See: https://educatedguesswork.org/posts/dns-security-dox/ https://educatedguesswork.org/posts/dns-security-dox/ for more on the difference.

wander_forever 1y ago
Yes, this. AND while Firefox is providing you the control to choose when to enable or disable DoH, you don't get that control at OS-level, or even the visibility of what the OS is choosing on your behalf for each such query.

wander_forever 1y ago

DoH in Firefox provides you the control to choose when to enable or disable and which DNS provider to choose, while Android does not provide any such choice or even make it known to the user when DoH is used or not. In addition, Firefox only partners with DNS providers that have legally-binding agreements for strongest privacy guarantees - see https://wiki.mozilla.org/Security/doh-resolver-policy https://wiki.mozilla.org/Security/doh-resolver-policy .

Phelinofist 1y ago

AFAIK Android does not do DoH but DoT - at least you can only set a DoT endpoint in the "private DNS" settings.