Turn off DoH, Firefox
ungleich.ch
ungleich.ch
If instead what you worry about is the government spying on your traffic then complaining about DoH is even more silly - DNS requests are routinely intercepted and monitored by ISPs in many countries, with the information available to the security services, who have very few restrictions on what they are allowed to do with this data. This is especially true in the country the author appears to be based (Germany).
DoH is vital to protect users around the world from censorship and worse. Enabling it by default is a good thing - protecting users from abuse shouldn't only be opt-in. There has to be SOME default chosen, and the default needs to be a site large and well run enough to a) handle the load, and b) be in the firefox HSTS preload list. There aren't a lot of good DoH providers that fit these criteria - CF is one of the few.
As it stands Mozilla is switching out our local ISP for CloudFlare without asking our consent which means my traffic data is now spread around one more company - that seems like less privacy.
And I am not looking forward to finding out the fun ways in which this will break our local DNS.
The idea that Cloudflare is in way more trustworty than my local ISP is at best naïve. All this creates is another huge centralized pool of data with no oversight whatsoever except the promise of some company that is currently growing fast, that they will not do anything with that data. Come the times when money becomes tight again, we'll see how well that promise holds up.
Sure, encrypting DNS is a good thing. But this is just like trying to make email more secure by using a 3rd party encryption gateway - all it does is moving around who to trust.
That's not privacy - that's just silly
According to their blog post discussing the matter, they fully intend to inform the user of the change and give them the opportunity to opt out.
>When DoH is enabled, users will be notified and given the opportunity to opt out
https://blog.mozilla.org/futurereleases/2019/09/06/whats-nex...
Seems obvious, but is wrong. If there is a really obvious obstacle to anything, which immediately comes to mind, chances are people addressed this already.
In the US, Firefox by default directs DoH queries to DNS servers that are operated by CloudFlare, meaning that CloudFlare has the ability to see users' queries. Mozilla has a strong Trusted Recursive Resolver (TRR) policy in place that forbids CloudFlare or any other DoH partner from collecting personal identifying information. To mitigate this risk, our partners are contractually bound to adhere to this policy.
> Mozilla has a strong Trusted Recursive Resolver (TRR) policy in place that forbids CloudFlare or any other DoH partner from collecting personal identifying information. To mitigate this risk, our partners are contractually bound to adhere to this policy.
What happens if they get a FISA warrant? How does your contract protect users that before didn't have their DNS queries sent to US companies?
The data would still end up at yet one more company, compared to the status quo.
Trust works if I know the people involved - but I don't know a single individual at Mozilla (or Cloudflare for that matter). That Mozilla trusts Cloudflare is besides the point if I don't really know who they are.
The entity I am actually trying to trust is example.com - all this shuffling around trust in increasing layers of complexity is missing the point of the actual problem: Bootstrapping a connection to example.com without revealing to a 3rd part that that is what one is trying to do.
[0] https://developers.cloudflare.com/1.1.1.1/commitment-to-priv...
You seem to think that: 1)No company in the history of the world, has ever violated a contract?
2)No government has ever forced a company to give up information that it is contractually obliged not to give up
3)No hacker has ever hacked into a company's systems and exfiltrated data the company was contractually obliged not to share
You seem to think that if a contract has been concluded, it is impossible for it to be violated.
Then there are also the problems of making all Firefox browsers depend on the availability of CloudFlare.
It's as simple as this. Now I do prefer a society of trust over excessive technological means, but let's not pretend like sending data to an additional third party is somehow more or even just as private as not sending it in the first place.
So if Cloudfare maintains a log of your requests who cares, that log is useless since they can't identify you as soon as you change your IP address. While using standard DNS the provider can identify you and can log all you DNS requests, even if you don't the default ISP DNS servers, since they can simply intercept and decode all the traffic on the DNS port. And not only your provider, everyone in the path between your PC and the DNS server, even at LAN level, for example in public WiFi networks like in airports, schools, companies, the administrators can log all your DNS traffic, and put filters on it.
> Sure, encrypting DNS is a good thing. But this is just like trying to make email more secure by using a 3rd party encryption gateway - all it does is moving around who to trust.
Make up your mind are you worried about the number of people that can see your dns or not?
> it's trivial to change your DoH provider
Cloudfare is the default.
Cloudfare is the only provider listed.
Cloudfare will be On by default, so it will be that for 99.999% of Firefox users.
That ain't right no matter how well intended it is.
So the status quo is no better than this, and at least this is encrypted and protected by a privacy guarantee.
Now I agree that ideally a user-visible preference should be created for the DoH resolver, but I don't think that's a blocking issue. Just like the accounts features uses a mozilla server, and chrome uses google accounts, and both use google safe browsing lists, browsers have always made the decision to hardcode various external service providers.
You're completely missing the point. Users have many different ISPs, and them knowing DNS queries is not a problem because it's the ISP anyway. Now a browser wants to change that behavior, and send ALL queries to one american company.
Of course there's arguments for and against these aspects in the case of name resolution, both technical and on a legislative level, but maybe a net win in terms of privacy protection for the majority of users is still worth it. And should Cloudflare or whoever decide to misbehave with the data we send, it'll at least be easy to switch to other providers when DoH is widely adopted.
DNS over TLS has other issues. There's a nice comparison there https://dnscrypt.info/faq/ I have been using local resolver on 53, that forwards all requests from my LAN into DNSCrypt (and sends that over a VPN tunnel). That way I maintain privacy, and decentralization as well as being able to simply use the DNS resolver built into my OS.
I have to wonder though with HTTP/3 https://en.wikipedia.org/wiki/HTTP/3 being QUIC based, will we see DNS over QUIC? https://en.wikipedia.org/wiki/QUIC
Seems like Firefox doesn't even support QUIC at the moment. https://bugzilla.mozilla.org/show_bug.cgi?id=1158011
Which is already a lot better than getting 100% from simply spying on CloudFlare or serving them with "National Security Letters".
[1]: https://quad9.net/doh-quad9-dns-servers/ [2]: https://nextdns.io/
DoH doesn't prevent ISP monitoring. Even if they cannot see the DNS request, the browser sends the ISP the returned A/AAAA record in the header of a TCP SYN packet. The ISP necessarily sees the hosts you are connecting to; they don't need to see the DNS traffic. DoH to Cloudflare allows both Cloudflare and the ISP to monitor your pattern-of-life.
> DoH is vital to protect users around the world from censorship and worse.
Yes, it would be a useful tool to fight censorship, but don't conflate that with monitoring traffic. The ISP still sees the addresses and ports in the IP+TCP headers.
But of course, then the problem is punted to SNI, since your TLS Hello packet will probably send the host name with the setup packet, leaking the host then. So we're back to square one. To be fair, Firefox and Cloudflare are also working on ESNI, in which case, from what I understand, your DoH reply will include the A/AAAA record and the public key to encrypt SNI names with, which plugs that final major hole.
So I think the A/AAAA record being exposed doesn't necessarily tank everything, but it certainly isn't perfect, either. But realistically none of these solutions were 100% perfect and a unique A/AAAA record was always going to expose you to a significant amount of side analysis, I think. In general, it just raises the bar and lets us place more trust in the "last hop" between you and the resolvers, much like many other improvements over the past few years, and originally envisioned by e.g. DNSCrypt. In general I feel the actual host header is more important than the A/AAAA record (it is at least more accurate), but I could be super wrong about that.
(The more general discussion about a few major players being able to shape major internet changes for users like this, and general consolidation of the internet is, I think, extremely relevant. But also beyond just this particular exercise.)
Of all the governments to worry about, the ones in the EU (as well as US, CA, AU, NZ), are the ones I'd least be concerned with, relatively speaking.
They're enabling this in the US, and yet even with all its problems, it's the one country that the average web surfer would have to worry least about when visiting "inappropriate" sites.
* https://en.wikipedia.org/wiki/Room_641A
> DoH is vital to protect users around the world from censorship and worse.
Great. Then enable it in countries where it's actually a problem. As a Canadian I do not feel a need for this, and I worry about Cloudflare getting an NSL more than I worry about CSIS/RCMP tapping glass.
Completely wrong threat assesment in my opinion. You should always be concerned about your own government. It isn't only the axis of evil that imprisons people with leaks about heavy privacy invasions.
Russia and China have anything about you and you are a citizen of a western nation? Great, because that doesn't matter at all.
You know who poses the greatest threat in motorsports? It is the other driver on your team.
Who says I'm not? But I have recourse with government. What recourse do I have with a private corporation that's based in a country with such law privacy laws.
None.
My e-mail is hosted on Canadian soil with a direct-connect to TorIX (and I personally know the people who run the servers).
I know when I hit a foreign corporation (AMZN, GOOG, etc.) that my data is probably up for grabs, but I also know when when my traffic is not leaving Canadian (digital) soil.
So yes, I know all about ECHELON et al, but I know how the packets I send out are generally routed as well.
Like I've asked before, should Mozilla also start including an obfuscating VPN by default, to bypass the Chinese firewall?
This is a political issue, and one that I don't think Mozilla should even get involved in because it could have very ugly consequences --- just focus on making a good browser and leave the politics (and VPN/firewall-busters) to others.
While true for you or me, the vast majority of people will have this enabled by default - probably not even realising it's on
This is very bad for Erdoğan. They won't be able to block DNS over HTTPS. Thus teir classic DNS blocks will be useless. Last time I've checked there was over 300K blocked domains via DNS. Even 8.8.8.8 doesn't work.
Said own country might one day decide to restrict access/log visits to controversial site X (e.g. Tibet, government critical news, piratebay etc.), which does not affect your DNS based in foreign country
That seems pretty shady to me
This should be, if not illegal at least highly problematic in the eyes of the law. At best the ISPs got a "better behave, because next time ...".
All ISPs have data sharing with "selected partners to ensure service quality" which, at least until GDPR, meant basically that they could sell data.
Whereas cloudflare states that the 1.1.1.1 data will only ever be shared with APNIC in anonymised form (which they define). Cloudflare defines what data they share for 1.1.1.1 users, which my ISP does not. I trust cloudflare, at least right now. If they were to change their retention policies and agreement I would maybe reconsider.
But basically, i know my ISP, and they don't log dns queries.
Most ISP's (the ones i have worked with) don't save DNS requests. They usually save netflow.
I also use vpn (my own), with its own dns resolver, for when i don't trust middle man.
It seems trivial to select a half a dozen likely candidates and let the user choose between them on install.
Honestly I'd like them to do the same with the search engine. Yes, it's simple enough to change the default, but it'd be nice to choose up-front.
Most Firefox users do not care. Those that do can figure out how to change it easily enough.
My ISPs caching DNS, and any caching DNS running on IP addresses belonging/advertised by my ISP by BGP to various CDNs, are the best possible responses.
I don't care if the p99 DNS response from my ISP is 50% slower than Cloudflare, if the streaming video, or large download, or many small files requests are better served by CDNs in my ISPs network that are not visible to Cloudflare.
All DNS benchmarks I have seen focus only on the DNS response time, never on the DNS response quality.
But that's because they are mostly written by people who don't know how the internet (or competent ISPs) actually work. Some of them even seem to log errors when they get unexpected responses for some well-known URLs (like google.com) because they don't know there are new Google sites than when they last checked ...
Germany: Storing data for a limited period of time so that data pertaining to individuals can be requested on a case-by-case basis by law enforcement (we are talking Police, not all of government). Not a big deal.
U.S.: Highly developed and well resourced mass surveillance in operation on both the business side (surveillance capitalism) and government side (NSA). Privacy laws that protect only U.S.-based persons and declare data pertaining to foreign persons to be fair game. Big f*ing deal.
https://www.reuters.com/article/us-germany-spying-merkel/mer...
Author is based in Switzerland.
But since you mentioned Germany - German security services have no legal authority to indiscriminately monitor internet traffic, particularly not inside the country. They got into trouble with parliament the last time they got caught doing it.
For ISPs, there's no business value in intercepting or logging customer traffic. They're not allowed to use such data themselves, like for advertising purposes. At "large ISP" scale (tens to hundreds of gigabits), equipment that can intercept DNS queries at line rate is very expensive and adds a lot of infrastructure complexity. ISPs operate on thin margins and have zero incentive to deploy such equipment or otherwise mess with traffic.
They're legally mandated to store some metadata like IP address assignments and flow/CGNAT data for a limited period of time and aren't terribly happy about it, at the very least because it's expensive to collect and store it with no benefit. Deutsche Telekom has recently sued the government about it and won[1]. The so-called "Vorratsdatenspeicherung" is a recurrent topic in German politics with conservative governments introducing it, and then having to scrap it when it gets challenged in court by civil rights groups and/or companies[2].
In either case, DNS request data is NOT metadata and would never be inspected and stored unless there's a specific warrant.
Deutsche Telekom once redirected NXDOMAIN responses to an OpenDNS-like landing page with suggestions ("Navigationshilfe") and had to stop doing it when people complained to authorities[3].
Exporting and analyzing sampled packet headers or flows is pretty cheap and a standard feature with carrier-grade routing equipment (NetFlow/IPFIX and/or sFlow). IP assignments are basic accounting data that every ISP has.
Inspecting packet contents is very different and requires plenty of expensive extra equipment and/or complicated network engineering to redirect traffic to a centralized analyzer, which increases latency. It's only done if necessary, like temporary rerouting for ingress DDoS mitigation.
(source: worked in the industry)
> Masses off unfounded FUD - the article deliberately buries that it's trivial to change your DoH provider if you're silly enough to believe that CF is actively logging DoH requests and selling them (CF is involved with serving vast swathes of the internet anyway - if they wanted to go down this route they have far more lucrative avenues open than selling DNS requests by IP).
Personally, I do trust CloudFlare and understand Mozilla's choice, but I do agree with the centralization concerns. It's a difficult set of tradeoffs, and characterizing the author's concerns as "unfounded FUD" is not fair.
[1]: https://web.archive.org/web/20180511081552/http://www.vg-koe...
[2]: https://de.wikipedia.org/wiki/Vorratsdatenspeicherung
[3]: https://www.golem.de/news/t-online-navigationshilfe-telekom-...
> security services, who have very few restrictions on what they are allowed to do with this data. This is especially true in the country the author appears to be based (Germany).
The author appears to be from Switzerland, and it's not clear at all why "security services" (who?) in Germany "especially" have few restrictions.
> "especially"
That refers to news and new laws in recent years, which extended their surveillance capabilities. Also, it is relevant because Germany both has relative strong data protection against non-state actors, but also quite capable intelligence agencies.
That said, I think arguing about state actors is the wrong threat model for this discussion.
My post was just a rebuttal to GP's framing the discussion around vague accusations towards state actors.
> security services captures the meaning quite well
It really doesn't. The various secret services (internal, external, military) are reporting to parliament (not the whole of it, just a close circle/committee nevertheless having received trust by being elected), and their heads are nominated by the government. It's of course entirely within your right to criticize their existence or operations, but yielding power to private monopolies based in another country without any public control whatsover and potential ties to foreign secret services (we don't really know) can't possibly solve whatever problem you're on to, and shouldn't be justified on such vague arguments.
Very long term we might trend away from that, just as eventually countries which had outlawed capital punishment "except in times of war" realised they had no intention of doing it in a war either so many of them began removing that caveat. But today this is the case with every such restriction I've seen, it either says in the law itself that it doesn't apply to security services or there's a superseding law that says the security services needn't obey the data protection rules.
Disclaimer: I do not work or have any financial connection to that service
> Additionally, Mozilla is also working with ISPs to make sure users won't use DoH as a way to bypass legally-set blocklists.
> The organization said it's been asking ISPs and providers of network-based parental control solutions to add a "canary domain" to their blocklists. When Firefox will detect that this canary domain is blocked, it will disable DoH to prevent the feature to be used as a filter-bypassing solution.
https://www.zdnet.com/article/mozilla-to-gradually-enable-dn...
And I'm already set for the DoH switch https://i.imgur.com/GuP5a8F.png
Anyone upstream that wants to start censoring or logging can just add this canary domain and continue business as usual.
I don't think anyone believes CF will start selling data, that's not what the article argues.
Regardless, it's opt-out not opt-in. Which is against newer consumer protection laws such as GDPR.
> DoH is vital to protect users around the world from censorship and worse.
This isn't black and white. Yes there is upside (as both you and the article agree), but the downside of how DoH is implemented here is that you have to point all your DNS queries to a US company. Historically we've seen how this is a bad idea for global internet privacy (eg. PRISM, etc).
CF is not a private company funded by a foundation with a time until the funding runs out measured in 30-40 years. It is a public company with a small number of customers that provide majority of its revenue.
It simply isn't prudent to say that it won't explore other revenue streams in future and that monetization of data won't be one of those streams.
> Regardless, it's opt-out not opt-in. Which is against newer consumer protection laws such as GDPR.
I understand the argument in theory.. but the reality is CF is a more trustworthy DNS provider than basically any consumer ISP in the EU.
Historically we've seen many cases of US companies handing over data to US authorities (willingly or not).
Not true. ISPs typically record and store netflow-like data, very rarely DNS-data (I'd say storing DNS data is even unusual). If ISPs are in a position to get more detailed than netflow data on you they resort to things like deep packet inspection (DPI), which doesn't rely on DNS, pretty much all mobile/cellular ISPs do that today.
> DoH is vital to protect users around the world from censorship and worse.
Not true either. DoH can't do anything against censorship and if enabled by default in all browsers can actually give worldwide censorship powers to a single US entity that already has something akin "we will block anything we don't like and do anything our government wants" in their ToS.
The correct way would be to standardise DoH and DoT and add support into it into automatic address configurations and operating systems.
Exactly. If Mozilla wants to, it's more than welcome to reach into the VPN area with its own products, but I don't believe this functionality should be part of a browser. They're already reaching into the VPN area[1], should they also investigate bypassing Chinese censorship with their own "firewall-busting" obfuscating VPN? That's not something most users want nor need in their browsers, and such functionality is really a cat-and-mouse game that I think is best left to smaller and less-well-known entities.
It's unfortunate that browsers are already beyond "neutral", when IMHO the only thing they should do is fetch exactly the page URL that was entered and display it.
Edit: yes, apparently people disagree and want Mozilla to control what the Internet (and every user, ignoring his/her default configuration) does. This is really really disturbing.
I strongly disagree. Browsers deal with a hostile environment that poses countless threats to their users, and need to be safe. Arguing that browsers should be minimal and not protect privacy is like arguing that cars should be minimal and not have seat belts.
There is an argument that ensuring privacy in DNS could be done outside the browser. I think HTTPS is a good precedent for putting privacy in the scope of the browser; the browser should attempt to ensure that privacy expected by the user is established or it should refuse to operate.
I disagree with the solution of trusting Cloudflare, but privacy should be considered crucial to user safety in modern browser design decisions.
I strongly disagree. A browser has one job, and that is to follow and render URLs. Secure connections and such are services provided by other components of the OS, and the browser should absolutely use those services but not attempt to overreach its main purpose. It's really the principle of "do one thing and do it well".
To spin your analogy, you're arguing that cars should have seatbelts that also check your age and blood alcohol level because "that's also a safety thing".
There is an argument that ensuring privacy in DNS could be done outside the browser
Yes, the same way that VPN clients are; and I'm perfectly happy for Mozilla to be working in that area, but most certainly do not put that in the browser and do not make it default.
This sounds good on the surface, but falls apart at the smallest level of logical scrutiny.
It's akin to saying, "a car should only accelerate, decelerate and make turns!" After all, that's a car's main purpose.
Whereas the fact of the matter is that modern cars are built to be able to handle all kinds of hostile environments and have numerous defense and safety mechanisms in order to keep their passengers safe.
The same applies to Internet browsers.
So browsers can throw up their hands and say "we are as secure as the OS" or they can do it themselves. Not ideal but the alternative is worse for users.
Nothing. Absolutely nothing. Work within the environment you're given.
Basically every device on the planet is right now configured to blindly accept whatever DNS server is handed to it by DHCP and there is really no movement on changing that.
...and that's just fine, because I trust my LAN more than some third party in another country.
wow. not only has history rejected your premise, but the many technologies that exist today in a web browser prove you wrong.
The essential Multics vs Unix mindset clash. One application to rule them all vs. a versatile toolbox of interchangeable modules. Telco heads vs hacker heads.
In the end, the hackers always win - but the telcos grow to be fat cats.
It all feels like a step-by-step attempt at turning general-purpose computers into cable TV.
"rm"'s purpose is only to delete, yet it still tries to ensure safety and sanity with its flags: -r, -f, --no-preserve-root, etc. Even simple tools should be safe by default.
This is beside the point. Mozilla make a browser. They don't make the address resolution code for the underlying operating system. Operating system vendors are of course going to start to support DNS-over-https.
You can disable dns-over-https if you don't want it enabled. Just go to about:config and set network.trr.mode. to 5
It was also possible to disable Ubuntu from sending your desktop searches to online retailers:
* https://www.pcworld.com/article/2889895/how-to-stop-ubuntu-f...
Just because something can be disabled does not necessarily mean it should be enabled by default in the first place.
https://www.zdnet.com/article/how-to-enable-dns-over-https-d...
Edit: I've just checked and there is the ability in the settings screen to set a custom DoH provider. So once your pihole can do it you can set it there.
So for me the trr mode is stored in /home/sean/.mozilla/firefox/k3dmofx7.default/prefs.js
If you don't like CF just switch to different provider https://github.com/curl/curl/wiki/DNS-over-HTTPS
I trust my ISP and government more than a US company I have no formal contract with and the US government.
Also, there's the whole 'applications should not override system level settings' thing. My DHCP pushes a local (caching) DNS server that also does name resolution for internal services. This change would break that for all Firefox users on my network.
And every single intermediary and whoever else might be listening in? This is an unencrypted plaintext connection. Which is the main point here. The whole "we trust ISP more" thing is completely beside the point. The point is DNS is horribly insecure nowadays, and it is about damn time we switch to something better.
> Also, there's the whole 'applications should not override system level settings' thing.
Hopefully, DoH will become a system level setting eventually.
You're not affected then, because the DoH rollout w/ Cloudflare as the default is only planned for the US.
Because if you do, at that point they are your "ISP" for purposes of this discussion. Do you still trust them more than Cloudflare?
(For a desktop machine, obviously this is not an issue, but for pretty much anyone with a laptop this is something that needs to be worried about.)
As far as internal services, is this a split-horizon setup? As far as I understand, the plan is to detect those and fall back from DoH to normal DNS as needed.
I wish Windows 10 and other operating systems natively supported DNS-over-HTTPS, but many don't. So they have to work around that lack of support.
I do not! I'd rather have that anon US co. than any government.
https://www.ghacks.net/2018/04/02/configure-dns-over-https-i...
I use https://odvr.nic.cz/doh
I feel like at least in Europe, a large majority of people would trust their government and local ISP much more than some company halfway over the world with basically no accountancy in your own country, especially an American one since it means your data is basically at the mercy of the US government.
And I very much hope they aren't contemplating rolling this out in Europe.
Having worked for a major European telco, I get the impression that the amount of regulation they face around data protection and privacy is tremendous and my experience has been that this stuff is by no means taken lightly either.
It would never in a million years occur to me to route my traffic in such a way as to circumvent the legal protections it enjoys as long as it stays within a European ISP's network and instead encrypt it and send it off to a nearly unregulated entity in a foreign country.
> https://support.mozilla.org/en-US/kb/firefox-dns-over-https
Mozilla has a strong Trusted Recursive Resolver (TRR) policy in place that forbids CloudFlare or any other DoH partner from collecting personal identifying information. To mitigate this risk, our partners are contractually bound to adhere to this policy.
These are much stronger guarantees than my ISP's.
Your ISP has access to more detailed data on you than DNS queries. Also CF servers are typically located in the same jurisdiction as your government and send unencrypted DNS queries from there. Now instead of dealing with every ISP your government has to deal with just one company in one location, no need to even ask that company anything, just come in and setup mirroring point, very convenient for the government, not very good for you.
Even with DoH, my ISP already sees all of my network traffic. My DNS queries will effectively be anonymized by their recursive name servers.
I believe the GP comment was referring to government surveillance. This is a thing in Europe and GDPR won't protect you from it.
Also, good news for you: Since you live in Europe, the announced switch to DoH with Cloudflare as the default for Firefox users in the US won't affect you.
https://developers.cloudflare.com/1.1.1.1/commitment-to-priv...
The people fighting for the status quo probably know how to run their own resolver, even with DoH or DTLS. But Mozilla's conundrum is how to protect everyone 's privacy (and to a certain extent, security). DoH, despite all its flaws, attempts to do that by piggy-backing on already working infrastructure, so it seems like a good fit to move everyone to DoH. But then, they're the chicken-and-egg problem. How do you make sure people deploy local DoH resolvers if no browser enforces the move to DoH ? How do you make sure those resolvers are truthful, or even respect local law (having both is often impossible).
So, you need to compromise. I'd have preferred to have temporary non-profit third party entity handle this à-la-Letsencrypt, but Mozilla deemed its contract with Cloudflare sufficient to provide enough guaranties. Ideally, name resolution should be done closer to the user instead of being centralized like that. But by arguing instead of experimenting we just keep the status quo. Time will tell if this was a bad decision. But it's not as clear cut as this blog post says it is.
> Mozilla's conundrum is how to protect everyone 's privacy
And exactly how does this protect user's privacy? Instead of the user's ISP being able to see where the user connects now both cloudflare AND the user's ISP (via seeing the connection itself) can tell.
Re: privacy: by not having lying DNS or no NXDOMAIN, there is also less tracking (say, fingerprinting in ad web pages).
And in the ISP's case, you're assuming they already do DPI, otherwise they now see IPs, which might not mean much in the CDN case. But if they do DPI, it will be resolved once ESNI starts being deployed.
What if ISPs block requests with eSNI for all users, in order to be able to remain compliant with legal intercept legislation (e.g. warrant for suspected child porn investigation)?
There are conflicting desires with trade-offs, and all Mozilla is doing here is escalating the war, rather than trying to reach agreement with the rest of the industry on how to satisfy two different requirements.
Switching from a technical measure of privacy (no data being shared) to hope isn't the right way to go.
> But if they do DPI, it will be resolved once ESNI starts being deployed.
Once.
> Once.
This underestimates DPI vendors. eSNI can't stop them, they will just move to exploit side channel information (traffic patterns) to identify which websites you are visiting. People need to remember, that DPI industry has been fighting with obfuscation for years, it's a war where Cloudflare and Mozilla are compete newbies.
How often to corporations take other corporations to court over contract disputes? I think it's pretty often.
https://blog.mozilla.org/blog/2017/12/05/mozilla-files-cross...
You're right. But so are Mozilla.
Here we are 30 years into the web, and we're still using plain old DNS. DNS over TLS should have caught on, but it didn't. Apple and Microsoft had years to ensure it's implemented as standard, but they didn't.
The points this article makes - about DHCP options, about multiple providers, are very valid.
But they're also just talking shops.
The biggest problems here seems to be 1) DHCP can't give internal DOH servers. When I'm at home I want it landing on my own DOH server, but when I'm away I want to use a different one. 2) Internal DNS resolving falls to bits
Anyone who wants to can configure their dhcp client to ignore it, or use a different service, you could even have applications doing that too, but this would allow a network operator to tell people where the recommended resource is.
Likewise if you want to change your DNS provider yourself you would have a single location on your machine to do it for the entire OS, rather than having to change 50 different applications.
This is what I would like to see as a default (and included in routers). In fact, it's what I already do myself.
I think (as others here have said) that the privacy concerns the article raises are mostly FUD. But I do agree with the article when it says handling DNS at the application level is kind of a terrible idea (even though it might seem justified in this case). If the end result is that every application has its own built in network stack, that's going to be terrible for security, usability, and make it much harder to debug third-party apps.
So enable DoT instead.
People say that it's trivial to change. It's trivial to change for us who are technically minded. It's far from obvious and will not be changed by non-technical users.
This will only increase the massive amount of data that Cloudflare gets about people's online behavior. I am always very skeptical of centralization and of having a company get this much information. Remember google's Don't be evil? I'm extremely uncomfortable with such a massive centralization of data.
People might say that the status co is not great because DNS is sent to the ISP. I'd argue the status co is better because it's far less centralized. And, at least for Europeans, I trust European legislation better than US legislations.
I can understand the argument that some countries have mass surveillance and it's a net positive for users in those countries since it will protect them. But in that case, I feel that the default should be randomized from a list of provider, not only one company. I also would be much less concerned by this if it was an option on first startup with a clear explanation (even though users tend to not read and blindly click accept, it's at least more of an informed consent)
And anyway, that purpose of preventing mass surveillance and blocking in those countries where it would actually be useful seems to be moot because of: > Additionally, Mozilla is also working with ISPs to make sure users won't use DoH as a way to bypass legally-set blocklists.
> The organization said it's been asking ISPs and providers of network-based parental control solutions to add a "canary domain" to their blocklists. When Firefox will detect that this canary domain is blocked, it will disable DoH to prevent the feature to be used as a filter-bypassing solution.
So, if isp in countries with censorship can use a canary website to prevent users from bypassing "legally-set blocklists". What is the point again of enabling this?
No, it explicitly won't.
Mozilla has a strong Trusted Recursive Resolver (TRR) policy in place that forbids CloudFlare or any other DoH partner from collecting personal identifying information. To mitigate this risk, our partners are contractually bound to adhere to this policy.
> The resolver must not retain, sell, or transfer to any third party (except as may be required by law) any personal information, IP addresses or other user identifiers, or user query patterns from the DNS queries sent from the Firefox browser.
> Transparency Report. There must be a transparency report published at least yearly that documents the policy for how the party operating the resolver will handle law enforcement requests for user data and that documents the types and number of requests received and answered, except to the extent such disclosure is prohibited by law.
> The party operating the resolver should not by default block or filter domains unless specifically required by law in the jurisdiction in which the resolver operates.
This doesn't really matter if you live in the US, but most of us don't.
1. centralization of all dns lookups is worrisome
2. Dns should not be handled by applications. It should be handled by the operating system.
I see a lot of people conflating the two in the comments.
I disagree. It has become common for the OS to handle DNS globally. This can provide nice cache efficiency/centralized configuration benefits. But it is also much less flexible and unlike e.g. the OS's Certificate Authority Registry there's no update/revocation benefits.
DNS over HTTPS being configurable in the browser gives us more flexibility. For example you want to AdBlock but not risk breaking OS Updates, you want to split-tunnel a VPN connection then pick which resolver for the browser, or you even want to use a different non-"internet"/non-ICANN network only in a single browser/instance you now can. That's powerful.
DNS by the OS is common in 2019. But saying it "should" without explanation isn't a strong argument except towards the status quo.
PS - If you think of a web browser like an "app ecosystem" this line of thinking makes a heck of a lot of sense. The OS is just a host for a sub-"OS" ecosystem. There's a reason browsers already have their own configuration for e.g. web cams, microphones, sound/mute, language, 3D acceleration, and security that already end-run around what the OS is trying to dictate.
I agree with #1 but why it should be managed by the OS?
If you are currently using private DNS server with internal domains and don't know about changes firefox is going to make, firefox will resolve you domains incorectly while all your tools like nslookup and dig will show correct information.
And then when you do figure it out, you will have to go to every single user and help them fix firefox setup. (because most of such small businesses don't have their own AD)
I first though about blocking it at companies firewall level, but thats tricky, because you don't want to break everything else that uses cloudflare.
Example: Say you use hosts file to block porn and other shady sites for your kid, all they have to do is use chrome.
A bug that I cannot reproduce. Chrome follows my HOSTS file fine on Windows 10. But even if it didn't it would still be off-topic.
So now it will, by default, contact all the ad/tracking hosts that you configured to be blocked.
"But now your DNS queries to those ad/tracking hosts are encrypted!"
No. I don't care. I didn't want to connect to those hosts in the first place.
Everyone on this article saying it's FUD is either a framework junky, isn't seeing the bigger picture, or just focus on one wrong thing in the article.
> For starters, Mozilla said that after it turns on DoH by default for US users, Firefox will contain a mechanism to detect the presence of any local parental control software or enterprise configurations.
> Additionally, Mozilla is also working with ISPs to make sure users won't use DoH as a way to bypass legally-set blocklists.
> The organization said it's been asking ISPs and providers of network-based parental control solutions to add a "canary domain" to their blocklists. When Firefox will detect that this canary domain is blocked, it will disable DoH to prevent the feature to be used as a filter-bypassing solution.
https://www.zdnet.com/article/mozilla-to-gradually-enable-dn...
You will have to turn it off manually, in Firefox.
Not a great direction for DNS to be going for things like Pi-hole. If DoH becomes a thing on say smart TVs and gaming consoles, I fear it will be baked in and not configurable. Also going to be annoying on PCs/phones if each individual application is going to get its own DNS config now.
In a home LAN configuration, which I'd expect is the vast majority of Pi-hole setups, I don't think you'd really be gaining anything from DoH.
And even if Pi-hole does support being a DoH server, you'd have to configure that in Firefox anyway.
To retain your pi-hole, you'll need to run a DoH proxy on your pi-hole device, configure your browser to use that as the DoH provider, and this will allow your pi-hole to inspect and modify DNS results. Your pi-hole can then use any upstream DoH provider that you want.
And those who live under oppresive governments should not be an excuse to force those who don't to have their traffic routed through a property of an oppressive government.
Yes, I know it's not about to be a default for non-US users yet. But "The UK people are getting screwed" is not a very good argument for "everyone should be getting screwed by the US".
As a fellow citizen of a Five Eyes country, I assume that if any of those 5 have info about me that one of the other four wants it won't even be a question of paperwork for it to be shared.
I understand that you're trying to illustrate a larger problem, but that example is likely to get you zero sympathy from anybody, anywhere.
I know that US ISPs have an established pattern of "just handing over" browsing history, but I have no idea what CF's track record is like.
If you worry for your government, you should use a VPN anyway (where possible which is the case for UK afaik).
I think it should be on by default. In my country encrypted DNS makes it more difficult for the government to track what people watch and to block sites.
> And to select or enter the DoH provider instead of defaulting to Cloudflare.
You can enter any DNS server address in Firefox.
While I agree, that it is bad to concentrate all the world's DNS queries in the hands of an entity under US jurisdiction, not encrypting DNS is much worse currently. So Cloudflare and US government are the lesser evil for me.
Also, if there were volunteers running free DoH servers then Mozilla could choose one of them randomly instead of sending all queries to USA.
Also, even if a company like Microsoft adds it to Windows, they will add it only to they latest version and leave people on Windows XP, 7 and 8 without protection. Same with Google - they will add it only to the latest Android. Because commercial companies want you to buy new products, not to use the old one for a long time.
At least you can change the provider in about:config. I don't remember if you can do it through the settings page.
Can currently choose "Cloudfare (default)" or "Custom"
But I agree, a few more options on there would be good, and if they are turning it on by default, then there should be a setup page that appears to let you choose the provider or something
> By planning to support DNS-over-HTTPS, Mozilla is throwing a monkey wrench in many ISPs' ability to sniff on customers' traffic and filter traffic for government-mandated "bad sites."
But I don't see why they can't offer their DoH, it seems their issue is with Cloudflare not with DoH per se
I'm assuming the DoH servers used by British users are physically in the UK. (I believe they anycast the service from all of their edge locations, and they have several in the UK.)
So the fact that Cloudflare doesn't have to comply with this law is precarious. Is it because only ISPs are required to comply? If so, it seems like a matter of time before Parliament amends the law to require any public DNS operator to implement the filters as well.
That means that the ISP dns will 100% be logging all requests made.
The risk of Cloudflare doing it is far outweighed by ISPs legally being required to do it, at least in Australia.
Difference being if I connected to ISP ABC's DoH server - communication between will be encrypted, but the actual requests will be logged after they receive the request.
Kazakhstan, China, Russia and the NSA all agree with me.
This is going to make that a pain - especially if they introduce it in the mobile version?
I don't know how to configure pi-hole, but at the dnsmasq level you can do that with this directive:
address=/use-application-dns.net/
I guess if these use normal DNS requests first to determine if it should be allowed, then it will work.
> If a user has chosen to manually enable DoH, the signal from the network will be ignored and the user’s preference will be honored
Well, that kinda puts a dampner on it all!
This will greatly impact the internet's ability to route around censorship as if it were damage.
Now we are content that applications do their own name resolution and said resolution is centralised on a very few (non-altruistic) hands (CloudFlare/Google).
Add amp to this. Sprinkle it with the views of people who run their own mail server and consider where this leaves us.
I am not that naive and think we can keep ourselves in 1995. But I do think we give up on too many of the good parts all to freely.
Here's the next thing, no one is stopping you from running your own DoH server. No one is stopping you from changing the FF config to use it. The big issue has been is the end user has been so unaware of security for so long and done so little about it somebody has to. There is no financial incentive for your ISP to care, so they have not. Most operating systems, specifically Windows, but also Apple have done little to nothing for client DNS security. This could have been handled between operating system developers and DNS infrastructure but they didn't care to.
No, there was a lot of caring over the years as DNS is old and insecure, in particular unencrypted communications with authoritative DNS servers being the biggest issue. And yet completely ignored by DNS-over-HTTPS, because solving it would likely eliminate the need for resolvers in the middle, so surveillance capitalism isn't interested, they only want to "solve" it in a such way that doesn't really solve it, but just gives them DNS data.
Cloudflare has committed themselves to not track users via DNS requests, and only log what’s strictly necessary.
And if you distrust Cloudflare, you have a much bigger problem. Half the Internet routes through Cloudflare these days. If they wanted to spy on you, they have (potentially clear-text) access to a good chunk of your HTTPS traffic.
And as many others have pointed out, it’s a much better recommendation to have people change the DoH server to something else.
Is this also potentially a violation of federal wiretap law?
My ISP being able to monitor where I connect is not great, but being exposed to my ISP and cloudflare monitoring it is not better-- and is also very unexpected.
There are also at least somewhat clear standards of privacy expected from ISPs, it's entirely unclear to me what duty of care cloudflare has towards users of this service or what position they'd be in to resist further compromise of user data (through either legal or illegal means).
The problem is that Mozilla is taking a very US-centric view of a product that is used worldwide.
> Mozilla has a strong Trusted Recursive Resolver (TRR) policy in place that forbids CloudFlare or any other DoH partner from collecting personal identifying information. To mitigate this risk, our partners are contractually bound to adhere to this policy.
So, the "obvious" view seems to be wrong.
Up until now, you could use dig, nslookup and other tools to see how your computers resolves to help you figure stuff out.
Now what do you do?
also what happens when firefox uses this cloudflare, some other X application will start using Z, and the third Y.
Also I work, and used to work for many small shops (under 50 people) in different industries. Its standard practice to have internal domains, sometimes even having different things on the same domain (ie mail.comany.co is diffrenet server form inside and outside the network).
If you don't have AD (increasingly common here with apple and linux laptops being the 95% of users), you will have to go to each user on every device that has firefox and help him fix the settings.
I would say just block it at firewall level, but it's not trivial, without breaking sites that use cloudflare.
How the operating system resolves names, is up to it. It could use tcp-over-pigeons, if the sysadmin configured it so, and no application should be working around that.
If you want to use DoH with Cloudflare, you are free to configure your system to do so. You will also get consistency, all your apps will use the same system, not just the browser. Let the others to have their systems configured as it suits them.
Linux, or at least the glibc-based distributions, have a concept of nss_modules; you can configure whatever mechanism you want, some people are using DNSCrypt or nss-tls, for example. Systemd-resolved, with all the hate it gets, does support DoT. So do other local caching resolvers, like Knot.
With other systems, you would have to discuss that with the respective vendors. Vendors also discuss these issues with customers, and very few customers are fond of breaking their systems. Activism, as Mozilla has shown, is a good way to irritate a good chunk of your user base. The change would have to be gradual, and allow the local admins to be in control (like Android and Linux distributions do).
That being said I am a little confused by those that are concerned because this change would mean their DNS queries will be sent to a US company and they don't trust US companies. Firefox is developed and distributed by a US corporation and is just a susceptible to being forced to follow US government directives as Cloudflare.
I have my router directing all DNS traffic to OpenDNS so these devices can't pick their own servers, any outbound requests on port 53 will be redirected. If they start using DoH/DoT, I can't do that so easily. I'd have to start monitoring outbound traffic and do hostname resolution on the IPs.
I think the privacy argument for DoH in the browser is fairly weak, since doing a DNS lookup is not really an indication of, well, anything really. No matter what domain it was, there's no indication that the user intended to visit a website or use a service on that domain, it could be as simple as a lookup to load an embedded image in a spam email. The only good usage of it is to prevent censorship via DNS.
The main point I am making is just as we want to be free in choosing whether or not to use DoH over CF, Mozilla is as free to design their own product.
The Chinese had to hack BGP to get that kind of data for a limited time.
edit: I also think OS maintainers are the main problem here, none of this would've happened if they supported DoT or DoH themselves.
[0] https://support.mozilla.org/en-US/kb/configuring-networks-di...
The ability to chose which DNS provider you query will be next on the feature list for Firefox I imagine.
Cloudflare have the same mindset to do something about the vulnerability of DNS to snooping (see their 1.1.1.1 app). Two companies with the same mindset. I'm hoping others follow them.
The article itself sounds paranoid and divides those that would rather trust private companies (with good intentions) against those that would rather trust their ISP/Government (also with good intentions).
Evidently, Mozilla plays the role of a Google's darling once again. Those financial "donations" have some interesting effects, aren't they? Aside from an official "Google Search Bar in Firefox" line.
What's even more interesting is that Hacker News moderator deranked the topic.
Probably all the actors represent the same mafia ring, as they painfully in need to defend those interests to stay commercially relevant in changing world (hello IPFS).
* https://www.proofpoint.com/us/threat-insight/post/psixbot-no...
However if you use DoH you can access Wikipedia.
Thank you whoever contributed to DoH!
This is a problem of centralization.
It doesn't feel right to address the issue by blaming the DoH, or Firefox, as they are not defaulting to the prime evil - Google.
I believe the better suggestion here to say is to set up own DoH servers, urge related parties to opensource their own implementation if there's none.
The ISPs, and anyone they share the data with, also already have the DNS queries, so the argument is wrong.
But also, if you do want just one government to have the data, do you prefer that data to go to your local country, which may be speech-oppressing regimes like Syria, Saudi Arabia, UK, Ukraine, or Iran?
I fail to see how this is in any way a step backwards.
https://github.com/curl/curl/wiki/DNS-over-HTTPS#publicly-av...
This is nonsense.
From another side, DoH/DoT prevents ISPs/government from DNS modifying/rerouting.
Stand strong Firefox against this.
If Mozilla wants to play this game, it really should make DoH a visible top level choice for a user.
The conclusion of the debate was that it vastly improves the privacy for most users. Which is why it shipped in Firefox.
Take that into account when you read (misleading, factually wrong) push-back like the original article.
Obviously debate is still on, as we see in here and in [0], and it looks like HN folks are not in favour of these integrations, including me. So question stands, how/why the debate was concluded, did all developers had a vote? Is there a link to discussion?
The aim of this process is to play a two-step game in which:
1. A controversial change is made by either party (be it Google or Mozilla)
2. Another party does the same, thus cementing the planned direction
How?
Cloudflare is not the internet.
https://w3techs.com/technologies/details/cn-cloudflare/all/a...
Not big, but not insignificant.
Why does DoH necessarily mean that Cloudflare will be handling the traffic? The article barrels right to that conclusion without explaining why.
> It is clear what Mozilla needs to do: Mozilla can and should revert the change and allow users to easily opt-in. And to select or enter the DoH provider instead of defaulting to Cloudflare.
Buried lede is buried.