Hacker News Reader

Hacker News

Comment by stefan_ | Hacker News Reader

Parent Full thread

stefan_

They turned on DNS over HTTPs by default and send your queries to Cloudflare:

https://blog.mozilla.org/blog/2020/02/25/firefox-continues-p...

View on HN

(for US users only, unlike what Chrome does which is worldwide)

You’re seemingly pushing you own agenda here?

As the article itself says:

> Are other approaches feasible? For example, Firefox’s captive portal test uses delegated namespace probe queries, directing them away from the root servers towards the browser’s infrastructure.

In your agenda to expose my agenda in linking a Firefox blog post, you have missed that this isn't even about captive portal detection. Captive portals are easily detected by trying to load a known response page; captive portals don't fake that because they want to be detected so that the browser redirects you to their portal.

This is about malicious DNS resolvers that don't return NXDOMAIN for non-existent domains but instead send you to an ISP advertisement page. This messes with the omnibox. For all other domains, they resolve just fine. These resolvers are inclined to evade detection, e.g. if browsers checked a static list of domains, they would just return NXDOMAIN for only those.

I can't even remember last i got an advertisement page. Must've been about 10 years ago, though the last 5 I've been using third party DNS. I don't know any Swedish ISP that does this. I'm using ISP DNS on my phone.

Sounds like your country isn't as commonly affected. Lucky you :)

I assume at some point the calculus flipped for ISPs to not annoy you with low-quality ads and make customers cut them out, but instead operate a real DNS resolver so you can still sell their real-time browsing history to advertisers. Part of that is the Google and Cloudflare marketing campaigns for their public resolvers, so people had a ready alternative.

Gee, 10 years ago - About when Chrome implemented this feature and started to gain worldwide traction.

Ok sorry, please forgive my misunderstanding, it sounds like you’re saying Cloudflare is a ‘malicious DNS resolver’, but I guess I’m wrong there as well? I opted into DoH when it became available in Nightly (though not in the US), am I being a mug here?

they're saying that ISPs run malicious DNS resolvers (which is correct), not Cloudflare.

I don’t see that in the parent comment, though, to which my misguided reply has been heavily downvoted? I guess I need to learn more about this. Edit: or just stay out of it.

> captive portals don't fake that because they want to be detected so that the browser redirects you to their portal

This is not always true; several systems try to get you out of the iOS/macOS captive portal detection because it boxes the user into a restrictive frame, and either always impersonate captive.apple.com or begin to impersonate it when they want the user to believe they're "online".

Reply on news.ycombinator.com