Hacker News Reader

Comment by acqq | Hacker News Reader

How is concentrating DNS to even less "points of possible collection" of any advantage to user's privacy? My opinion is not far from nullc's:

https://news.ycombinator.com/item?id=22415794

https://news.ycombinator.com/item?id=22419657

"I see this as massively centralizing DNS request data (onto cloudflare) and this change is the most problematic part of the whole thing."

The less companies and locations one have to intrude to be able to "see" or influence DNS responses, the easier it is for a competent attacker.

And from a legal standpoint, at once even more information which would have before remained in some other countries is easily (even trivially) obtainable.

View on HN

You’re focusing on CloudFlare, but already I have a choice of a couple of DNS-over-HTTPS providers in my preferences, and I see no reason why it would stick at just two.

> already I have a choice of a couple of DNS-over-HTTPS providers in my preferences

Can you please cite that "couple" and also how you believe a typical user would ever change the default?

The dropdown has CloudFlare, NextDNS and Custom (that opens a text input).

As for users changing this, sure, that’s not going to happen. But I can imagine a world where the default is that your requests are fanned out randomly to a choice of hundreds or thousands of providers, with no clear and complete picture of a single user in the event that a single provider is compromised.

Yes, that would be a good option. They should've just waited for more providers switching to DoH before they turned this on by default, IMO.

Probably a chicken-and-egg thing. As long as we get there? :)

> How is concentrating DNS to even less "points of possible collection" of any advantage to user's privacy?

Firefox nightly (not sure with other version) propose already NextDNS as an alternative in pref. and an easy way to add a custom one. I can see for example big companies requiring their employees to use a custom one.

If you disregard the few people who change from the defaults and simplify a little, then moving from plain old DNS to DNS-over-HTTPS is moving from some DSL provider's resolver to Cloudflare's. The DSL provider has your real name and street address, Cloudflare does not.

> The DSL provider has your real name and street address, Cloudflare does not.

Some readers probably aren’t aware of the fact that even with DNS over TLS to Cloudflare the DSL provider can still collect exact info of which sites one visits. The name of the site is visible in the clear in the TLS communication with the site, independently of DNS.

How do you think this compares to the present default, "whatever DNS my ISP chose for me"?

Yes, but you always also had the "choice" of running your own resolver and running any outbound queries (or just using a recursive resolver) over a VPN.

You might protest that since that's complicated and takes effort the 'choice' isn't that meaningful, particularly when it comes to our collective privacy. You might also protest that it's easy to mess up and hard apply consistently to all hosts, and that few people would bother.

Exactly. The same applies to "you don't have to use cloudflare" for DOH.

You also could have already used your choice of DOH by running DOH proxy-- and bonus: all software would be protected rather than just the browser. ... so if "choice" was the only criteria, we already had it, and there was no reason to default many millions of people to sending all their DNS requests to a single point of observation.

Why wouldn't firefox be able to add those preferences by default?

Why should it? There's already a preference, called system setting. The system administrator configured something, it is not app job to duplicate or override that.

In the early days of web browsers, the browsers like Firefox implemented early SSL/TLS ahead of OS vendors. To this day, Firefox still maintains and bundles its own Root CA list, and by default prefers its own list over OS provided lists.

There's certainly precedence for web browsers doing things ahead of OS/system support because they can do it faster, and because maybe they think their users' (privacy and/or security) needs can't wait for deeper OS/system support.

(Also, for an increasing number of people, a browser isn't just "an app", it is their real OS where they spend the most time.)

NextDNS (the other provider) is a startup / Delaware C-Corp that has been around for less than a year. I'm not sure if I trust them more than my local ISP (at least in Europe, for the US this might be different).

There's a long Twitter discussion initiated by Paul Vixie that discusses the problem in more detail:

https://twitter.com/paulvixie/status/1232427484202688512

Mozilla is not rolling out DoH by default in Europe, and probably won't do so until they have suitable European provider(s).

Just enter your own resolver then, it's not enabled by default for you anyways. Out of all the problems with Firefox, this isn't one.

I'm pretty sure that mozilla is currently negotiating with other DNS providers to get them onboard. Hopefully, within a few months, you'll be able to pick from dozens, in addition to rolling your own.

Reply on news.ycombinator.com