Hacker News Reader

Comment by tomxor | Hacker News Reader

FF now does DNS over HTTPS by default (Preferences > General > Network Settings), it defaults to using NextDNS and is configurable.

Some people will be uncomfortable with this default, but it's a step up from consumer ISPs who _will_ track you, to a 3rd party who Mozilla says wont.

I add Mullvad VPN (because wiregaurd is frickin awesome), which also allows you to use their DNS servers, but for this you actually have to turn off FF's DNS over HTTPS to allow the wiregaurd interface to pick up the DNS requests - they have a really good "leak" checker page while using their servers to check for various protocols https://mullvad.net/en/check/

Yes yes I know, VPN doesn't unbreak the internet, but here we are.

View on HN

The other great thing is, in case you wanted to support Mozilla, the MozillaVPN is using Mullvad's service, and routinely provides great service. I will add though, if you're a huge privacy advocate, and don't want to supply your email or card details to Mozilla but want to use a VPN, Mullvad directly is still the best choice imo.

I use Mozilla VPN, but the program (Ubuntu 20.04) 1+ times per day just closes and it does not have a network kill switch.

So I have to continue to use Firefox's DoH to prevent my university to occasionally take a peek at my traffic. Assuming they don't bother reversing IPs to domain names.

You don't need a "network kill switch" with wiregaurd, you might be using the openVPN option which mullvad also provide for compatibility. Because wiregaurd is stateless you don't have to worry about stuff leaking through while physical layers go up and down, you can just leave the wg interface up and keep hoping around safely... I literally haven't taken my current wg connection down in days, yet my computer is put to sleep every night.

If you use Linux you don't even need an app (not Firefox's or Mullvad's), you can just pop one of the wiregaurd configs (mullvad.net can generate them for you) into /etc/wiregaurd and then use the super simple wg-quick cli interface to bring it up. You can also tell systemd to bring up a specific interface at startup with one line.

>FF now does DNS over HTTPS by default

Just checked & mine was off. Not that I mind since it's supposed to hit the local pihole anyway

Reply on news.ycombinator.com