DoH Secure DNS Doesn't Make Us a Villain Mozilla Tells UK ISP's | Hacker News Reader

DoH Secure DNS Doesn't Make Us a Villain Mozilla Tells UK ISP's

theregister.co.uk

50 pointssigna1123 comments

https://news.ycombinator.com/item?id=20369951

https://news.ycombinator.com/item?id=20362548

https://news.ycombinator.com/item?id=20358300

This is so low of these UK ISPs to take a swing at the non-profit Firefox instead of Google's proposed for-profit instance of DoH with Chrome.

Their only plausible motive would therefore seem to be that they currently enjoy profiting off your raw browsing data and violating your privacy at the highest level by spying on it and selling it. It can hardly be plausible that 'safety' is what they're concerned about.

I have always chosen ISPs that seem to support the little guy, and if there were one that wasn't in this Association to make a point, I'd join it. Can anyone in the UK speak to this to help out our UK readers?

Andrews and Arnold are outside ISPA, have a healthy respect of privacy and a healthy disrespect of logging and block lists. The owner blogs at https://www.revk.uk

Zen are in ISPA, but don't participate in any blocking or filtering.

They both provide service leagues ahead of the big ones, have tech support that's UK based and actually have a clue what they're on about.

I don’t know their ISPA status but I have been incredibly impressed with Aquiss, who offer similar levels of support to A&A. They also offer month-to-month phone lines and internet service without a minimum term, which is unusual in the UK.

Zen don't have minimum terms, seem to remember A&A have a one off setup fee for no term.

The majors prefer you not to leave when you realise they're crap. :)

Good to know - thanks for the info!

Does Chrome support DoH?

It's lower that Mozilla caved in to pressures.

I guess someone from the ISPs told Mozilla that MPAA/RIAA may soon sue them too, as the two orgs have sued the hell out of ISPs for not filtering traffic.

> Their only plausible motive would therefore seem to be that they currently enjoy profiting off your raw browsing data and violating your privacy at the highest level by spying on it and selling it.

Alternative take: DNS level blocking is sufficient to get the UK watchdogs off their backs, and DoH means that there will be requirements for something more intrusive soon. Instead of putting up a fight with the UK censors, they chose to deflect the blame to Mozilla.

In this interpretation they're not evil data resellers, they're merely spineless.

UK is dystopia and it is crazy how almost all UK political parties support this sensorship and even seem to be one upping eachother.

> UK is dystopia

Yes, except compared to all the other countries.

please, UK is a special - Cambridge Analytica‘s success to manipulate the Brexit vote - the video surveillance of public spaces - this porn debacle

Well it is pretty nice place maybe compared to other countries like China, Iran and North Korea. UK jails people for making jokes, singing rap lyrics. Your government wants to ban porn and demand encryption has backdoors, sensorship of the internet is just par for the course. It is completely insane.

https://www.theguardian.com/music/2019/jan/31/skengdo-and-am...

Depends who you compare to. Australia is the only advanced economy who’s laws are even more draconian. USA is a close third.

It’s to the point where I (non-sarcastically) feel safer travelling with my data over a Russia border than I do the UK/USA/AUS border.

Since anecdotally my girlfriends family live in Russia and I like to visit the US (and my homeland, the UK) so I cross those borders often.

This doesn't seems it should be the function of the browser; rather, to run a local DNS service which is only accessible on your computer, and then you can make it to access the DNS data by use of whatever you want to use, whether HTTPS or Namecoin or whatever, possibly even more than one. Then you can use it with any programs, and not only with Firefox.

The ISP should not censor it. (I also think that HTTPS is probably not the best protocol for DNS, although it can still be used; just making DNS as TCP instead of UDP and then adding TLS, would help. But regardless of which way is done, it should be a separate program that the browser and other program using internet does not need to know the implementation of.)

In an ideal world yes, this should be implemented at the OS level. However, the vast majority of users would not see any benefit until OSX/Windows/Android/iOS/<insert Linux flavor> receives an update for DoH-by-default and then users either have auto-updates turned on or manually apply the update.

Until that time comes, this is a fine step in the right direction, and you can disable Firefox's DNS if you don't want it.

As long as there is a setting in the browser to disable its own DNS implementation (possibly hidden so that you will need to set it in about:config or whatever), OK.

Getting all operating systems to do that, across the board, is much harder than changing a cross-platform browser.

Also, operating systems would have a much harder time doing that, especially if they don't all have integrated support for captive portal detection and similar.

> just making DNS as TCP instead of UDP and then adding TLS, would help

Then systems in the middle can tell it's DNS, and block it.

We're moving towards a world where all traffic will look like HTTPS, or eventually like http/3.

If they block the internet, or inject stuff in, then they should not be allow to call it the Internet Service Provider; it is not internet, then. The ISP shouldn't care what application protocol you use.

If carrier NAT is enabled (which in my opinion, it should be enabled by default, but the customer ought to have the ability to disable it if they want to disable it, so that you can have a real internet connection), then they might legitimately filter some transport protocols (e.g. TCP and UDP and other protocols in that layer) (but not application protocols), but if you disable NAT then you can use other transport protocols.

I use a lot of stuff that isn't HTTP(S).

(Still, the system domain name system should be independent of the implementation and the protocol in use. Whether you want to use HTTPS or something else for DNS, the browser shouldn't care.)

> Getting all operating systems to do that, across the board, is much harder than changing a cross-platform browser.

Is it? I understand that Debian has just added support. It should be as easy for Google to add it to Android as add it to Chrome. That leaves only Apple and Microsoft -- and even before that, anyone who likes to can set the DNS server in those operating systems to a stub that makes queries via DoH, either running on the local machine or connected via VPN. (I'm making that sound very tech nerd, but actually doing it isn't inherently any harder than installing Firefox.)

> Also, operating systems would have a much harder time doing that, especially if they don't all have integrated support for captive portal detection and similar.

Wouldn't it be the same issue for Firefox?

> We're moving towards a world where all traffic will look like HTTPS, or eventually like http/3.

Sad but true. Though at least HTTP/3 looks to support UDP, at which point it becomes a lot more reasonable to encapsulate whatever inside it.

> especially if they don't all have integrated support for captive portal detection and similar.

How so? Windows does this at OS-level. Android seems capable too.

AFAIK, captive portal detection involves sending request to a known server on the Internet and getting back something that's a proper response from that server. This operation doesn't require a browser. Beyond that, from the system's POV, it's equivalent to being in a network that's not connected to the Internet. I don't see why we need to browsers to handle anything except captive portal's UI itself here.

This seems to indicate one thing, and that is that DoH is an effective privacy control.

At least I have switched over my entire network to DoH through Pi-Hole.

Reply on news.ycombinator.com