Hacker News Reader

Comment by Tharkun | Hacker News Reader

Why would I want my browser to do this? My browser should use the DNS configured by my OS -- in my case, a local, caching resolving NS. If I want to use some kind of DNS-over-HTTP I'll tell my OS to do it. I don't want my browser making DNS decisions for me. What am I missing?

View on HN

You're missing that you can still configure the browser to your needs? You seem to be a power user so you can do this. Mozilla cares about average users too, and doesn't have control over OS defaults that may not be optimal for average users' privacy.

I, too, have a local caching resolver. And I'm unlikely to turn this on at the browser level, although I'm occasionally tempted to play with it in the resolver.

But I strongly suspect we're in the minority and that something like this is the easiest -- and quite possibly the only -- way for many users to avoid DNS poisoning by ISPs.

Not just ISPs; those using DNS-based adblockers (pi-hole and the like) will be impacted too (from my understanding.)

I think you missed the point of the parent comment, it wasn't that only ISPs poisoning DNS are impacted it was that this solves that problem for the vast majority who have no clue, excepting those who do the exact thing you describe and understand how to point it at their pi-hole.

You're right.

You're missing that you're a technically skilled individual, and most browser users are not. The design decisions must cater to the unskilled, because they will not opt in manually. By default most OSes will use their ISP's DNS, and this will very often be insecure and compromised in some way.

Hmm, I have a feeling this feature will be opt out one day.

One more thing to remember to turn off in Firefox, if you're running your own DNS over TLS with more elaborate config than what will be in Firefox.

One thing I like about this DNS over TLS is that now it should be possible to route DNS requests over tor safely to a more trusted DNS resolving endpoint. Though I haven't yet checked how it would work with Cloudflare.

Will I have to solve google captacha per handful of DNS requests if I try to access 1.1.1.1 from tor? Anyone tried?

Because at the moment, no major OS supports it.

dnscrypt-proxy (https://github.com/jedisct1/dnscrypt-proxy) supports all major platforms and checkout https://dnscrypt.info for more options.

It's worth noting that this is from the principle developer of libsodium as well.

Because browsers follow a pattern of reinventing the wheel with different tradeoffs, primarily focusing on "secure" execution of untrusted code from the web. Just look at the stack of web technologies, they provide an ever-expanding set of abstractions and reinventions of what OSes already provide.

I used this at some point on my Fedora laptop. I had issues on some hotel APs where it didn't allow me to see the 'login page' of the AP.

What's the way to circumvent this problem? I'm frequently on public wifi's, so I need to access AP login pages without issue.

The real solution is for the captive portal is to signal that there is a captive portal.

Unfortunately that has turned into an arms race: some operating systems switch to a different browser when they detect a captive portal. So captive portals try to avoid detection, etc.

Basically what you want is package that tries to detect a captive portal and when it detects one alerts the user and offer to start a browser that uses the DHCP-supplied DNS resolvers to interact with the portal.

Trying to access any IP directly also typically works, e.g. 8.8.8.8. The redirect to that IP following the login is then of course broken/timing out, but that’s not really a problem.

Such captive portals are a pain anyway, even more reasons for providers to stop doing this — hijacking DNS requests.

Firefox tries to detect captive portals.

As long it is opt in I don't see this as a decision issue.

Your OS does not support it.

That doesn't mean it's suddenly in scope for a browser. The solution would be for the OS to support it, not for the browser to do an end-run around the OS's DNS settings.

It is exactly in scope for a browser. The whole point is to stop your ISP getting your browsing history.

Sure, would be nice for the OS to support it, but until that future point why wait.

>Sure, would be nice for the OS to support it, but until that future point why wait.

Because with the current system I can configure my DNS to my liking at my router and it propagates to all devices. Replacing that with a system where after every Firefox update I have to double check whether Firefox is still doing what I want on all devices is a total pain in the ass by comparison.

Reply on news.ycombinator.com