Mozilla rolls out DoH to Canadian users of Firefox

And will they care enough? I get the sense that they don't really gain that much from messing with DNS, relatively.

Right. In place of that, we get one central point of DNS censorship. Where any unapproved site can be made to disappear.

"CIRA Canadian Shield" "Truly free". Right. "Freedom is Slavery" is more like it. In the US, Mozilla is apparently putting users under the thumb of Cloudflare.[1]

I'd rather have a mode where regular DNS and centrally controlled DNS are compared, and you get a popup if they differ. That warns you of censorship attempts. But that doesn't seem to be an option.

[1] https://forum.netgate.com/topic/133679/heads-up-be-aware-of-...

This is very much a US thing, I don't know as much about the situation in Canada, might be as bad. I really hope that this is not the begging of a roll out to the rest of the world.

Good luck, when 30M+ only have DSL as an option, and >70% only have one Cable provider, and one DSL provider.

FCC Data: https://broadbandmap.fcc.gov/#/area-comparison?version=jun20...

More Info: https://www.theverge.com/22177154/us-internet-speed-maps-com...

With eSNI/ECH, browsers would just have to hardcode a bootstrap IP, and then ISPs won't be able to block DoH without also blocking all of every major CDN.

But DNS hasn't worked pretty well for the past 30 years. It's been abused for a pretty long time now, both for hijacking requests and for violating privacy.

I don't think that DoH advocates looked at a perfectly good system and just decided to replace it. They looked at a system with significant flaws, saw that this system was holding back consumer privacy and security, and proposed an alternative.

> but DNS is only a tiny part of that problem [...] If you want to get rid those, then get rid of shitty ISPs. This is throwing out the baby with the bathwater.

DNS is a huge part of that problem, because without encrypted DNS most people can't realistically keep their DNS queries private. What we're seeing is that we can do all kinds of fancy stuff around encrypting connections, but the DNS is always going to be a hole, and it's always going to make the other protections much less useful.

We want to eventually plug other holes that make websites identifiable. During that process, there are going to be periods where some of the holes are plugged, and some aren't. But that doesn't mean all of the efforts are useless, it means we're in the process of plugging security holes. The fact that we haven't widely deployed SNI encryption or TLS 1.3 does not mean that encrypted DNS is useless, it means that multiple technologies are required to work together to make progress towards meaningfully masking domain names.

We still have very hard problems to solve, like IP addresses themselves and statistical analysis of response sizes to determine which pages are being visited. But it's not much use trying to mitigate those problems if we can't even secure DNS resolution.

In regards to ISPs, in general (where possible) we like to avoid the model of "everyone is insecure but there are no bad actors." Imagine if we had rejected HTTPS because "this is only really a problem if your router is compromised or the ISPs are snooping." We have a solution now that helps reduce the amount of trust we need for ISPs. That's good, we should deploy it. Even if ISPs weren't a problem, it would be worth deploying.

> This will simply lead to ISPs and network operators blocking DoH. And instead of a wonderfully decentralized DNS, we'll end up with centralized DoH in the hands of Cloudflare and their ilk.

I don't see a lot of reason to believe this. First, there was nothing preventing ISPs from blocking DNS and forcing you to use their DNS resolvers in the past, so I don't see what DoH changes about that situation -- other than that it's a meaningful privacy increase, which might make bad actors more aggressive about blocking it. But surely we're not claiming that we should abandon meaningful privacy improvements because we're scared of what ISPs might do.

Second, DoH is decentralized, you can still use other resolvers other than Cloudflare, and you can still chain resolvers together. For the moment, I happen to recommend Cloudflare because I think it's offering more believable privacy promises than other providers, but I understand the concerns about Cloudflare's centralization. It's valid to use something else.

But seriously, what is centralized about DoH that isn't centralized about DNS? The fact that requests can't be hijacked? Did the Internet become centralized specifically because you can't MITM HTTPS requests now? I'm seeing people claim that DoH means every request will go to Cloudflare, and that's just flat out not true: anyone can set up a DoH resolver, even locally on their own network.

Okay, granted, not everyone on your network might respect your DoH settings you put on your Piihole or router, but that's not really different from today. Google already doesn't respect network settings for its DNS resolution on Chromecasts (or at least didn't last I checked). My browser already allows me to override my network settings for DNS. DoH changes nothing about that other than that OSes and routers are lagging on implementing network-wide DoH settings. If you think that staying with DNS would mean that IOT devices will perpetually respect your network settings for domain resolution, then I have bad news for you, because they're definitely going to stop doing that in the future regardless of what technology exists, and some of them have already stopped doing that today.

What examples were you thinking of.

They are still the only CDN offering TLS1.3 with ESNI. Problem is they do not necessarily encrypt backend connections. TLS version and SNI are relevant IMO because even with DoH, without TLS1.3 plus ESNI, the ISP can still see domain names in the clear on the wire in client hello packets sent and TLS certificates returned from remote IPs. All those AWS-hosted sites you visit all require SNI, the domain name sent in the clear over the wire for your ISP to track. For many, you can use the cloudfront CNAME as the SNI but it would be easy for an ISP to keep lookup table for all AWS CNAMES. HN's hosting provider will not even support TLS1.3, it's TLS1.2 at best.

SNI is hostile toward privacy conscious users and makes censorship easier.

If you are in the minority who have a great DNS server, go to the firefox settings and make a change. Defaults should suit the majority.

With DoH of course this is much less relevant. The people operating Trusted Resolvers for DoH are obliged to actually implement the protocol correctly.

If you choose a DoH provider which does DNSSEC for you (such as Cloudflare's 1.1.1.1), and you trust that provider, your answers are DNSSEC validated, today, without any changes to Firefox. Millions of people benefit, zero work.

If you're concerned that Trusted Resolvers aren't enough privacy, Oblivious DoH eventually means that the TRs don't see your query any more, so the people answering the query don't know who you are, and people who know who you are don't know what your query is.

DNSSEC only protects integrity, not confidentiality or availability. It still lets evil ISPs build a profile of every domain you've ever resolved, and to block your access to certain domains by just dropping your DNS request packets for them. Basically the only thing it stops is them sending you to a fake page (e.g., a pretty block message rather than a generic browser error).

Too slow, I'm afraid. Word on the street is that any hello containing ESNI will be blocked from day one in too many places for it to ever get traction, including all of China. I believe draft ESNI is blocked by the GFOC today.

To even have a chance of making ESNI/ECH widespread, you'd have to make it mandatory for all TLS. That wouldn't fly politically in the working group, because the "enterprise" people have at least some influence there, and they want to do exactly the same kinds of DPI that North Korea would want to do. Even if it came out mandatory on the standards track, it would probably still fail at this point.

It might have worked if it'd been mandatory in TLS 1.2 or even TLS 1.3, but it seems too late now.

We'll see if they also disrupt DoH to the point of making it unusable. I bet they at least give it a try.

If they were actual user agents, you would still have control over a lot of behaviour that's now been removed. Like actually remembering form fields you want to remember (instead, some websites tell the browser that it can't remember the user name, and the brower foolishly obeys). Or like copy/pasting text. Or like using the right mouse button (some websites disable it). Or like having control over keyboard shortcuts, which some websites override and which can't trivially be fixed.

In my book, a user agent acts in my interests and on my behest. Sure, most of these behaviours can be corrected using browser extensions, but requiring a boatload of extensions to have an actual "user agent" doesn't make me happy.

Turns out that the microk8s config uses cloudflare DNS by default, and not your currently configured DNS or any kind of local DNS proxy. This was hugely frustrating because it's not the configuration that I would expect, it's not obvious why things are failing, and, in our case, it's sending internal DNS names to an external DNS server, unencrypted, over the public internet.

Surely it's convenient, but definitely not trustworthy.

This is the tradeoff of running arbitrary Turing-complete programs. If you don’t like what a program is doing, or that it doesn’t use libc or some standard way to do DNS resolution, your only options are to either change the program to do what you want, or don’t run it.

But you can't. Even if DoH went away today, even if Mozilla and everyone else dropped the technology, you still don't actually have the ability to do that. Devices will still be able to ignore you.

It's not DoH's fault if devices on your network don't use your network-wide DNS resolver. IOT devices were going to move in that direction regardless. Increasingly, your smart TVs are going to ignore your network settings. They might not even make DNS requests over the correct port. They might hide them in normal Internet traffic. They might cache them locally. They might make a request for a domain that looks safe, and then use a different IP address that they have cached locally. They might even ship with their own embedded 5G chip and use it for specific exfiltration requests and updates. They might join your local network, read all of your unencrypted traffic, and then use a 5G chip to separately send data out.

If you think that blocking DoH will solve these kinds of problems, I feel like you are putting way, way too much faith into your existing DNS setup.

> Anything that does not do what I tell it to do is malware IMHO

Okay, that seems completely reasonable. However, my perspective is that any network that will MITM my requests or monitor what websites I visit without my permission is malicious IMHO. It sounds like the answer here is to block access to your network for devices that you don't trust, or to try and quarantine them -- not to demand that my personal device stop respecting my own entered DNS settings whenever it joins a new network.

To argue that my installation of Firefox or that my OS shouldn't be able to ignore network settings anywhere and that I shouldn't be able to choose how my requests are encrypted, just because it makes it easier for you specifically to enforce your network's security policy without explicit opt-in or consent -- I don't know, it just seems pretty backwards to me from how this kind of security stuff is normally supposed to work.

I know that this stuff will make it harder for some network operators to do their jobs but... so did HTTPS. I heard literally the exact same complaints during the early push to get every website encrypted. But we live with it, and now if you want to monitor my unencrypted network traffic, you need to get my permission to install a certificate. Control and consent slowly moves away from networks and onto devices over time, closer to the users themselves.

So, yes you can blacklist domains, as long as you can configure the DoH servers that the client uses.

People can still use browser add-ons to block domains, URL's, objects on sites, etc... uBlock is my favorite for this.

And if I run a guest wifi in one of the many countries where I have legal obligations to take steps to block illegal traffic because I am ultimately responsible for the emissions of my network, what would you suggest I do?

> DNS doesn't have a rich error vocabulary. For your ad-blocked domains, a traditional DNS server has to either lie (bogus answer) or claim no answer exists (NXDOMAIN or OK 0 answers) but HTTP has a rich variety of error codes.

It's a good thing that DNS has a limited vocabulary of error codes. I want the garbage website to think it couldn't load the ad because of a mysterious DNS issue. Having a reason like "DNSHTTP 486: Blocked by Client" would just make it that much easier for the site to deny you access/track you/detect your blocking activity.

I already do tell the devices I control which DNS servers to use via DCHP and IPv6 RA. Firefox is choosing to ignore that by default, and now I have to go through extra steps to solve a problem that Mozilla created by not simply re-using the previous solution (gethostbyname(3)).

At the very least if they had simply used the already existing DoT, instead of inventing a new protocol (DoH), I could have monitored port 953 traffic and see which devices were broken. Now I have to figure out devices trying to sneak through my policies.

I realise this is currently all leaky, my attitude was to put controls in place (DNS based) and if they learnt to hack around it then they're probably old enough to handle what they find ... doesn't work for malware, etc., however.

Presumably enabling DoH makes malware, advertising, etc., impossible to block?

When is MS Windows going to use DoH to force access for monitoring, currently I block a few domains.

So you'd likely configure your browser to do DoH destined for that proxy, and have the proxy generate DoH requests to the remote ends. The downside is you'd have to somewhat manually set up certificate trust between your client and your proxy - either by trusting the proxy's certificate, or installing a root CA that issues the proxy's certificate in your browser's trust store.

Then, I expose my PiHole as a DoT + DoH server (DoT for Linux and Android, DoH for Firefox) so that I can always use my ad block lists and secured DNS traffic.

It's still not clear if it's a win to rotate, but if you were going to rotate, that would help.

Hopefully ECH will make it this time

Canada also has some large, private networks used by provincial governments that use split horizon DNS and DoH is going to be a huge pain for them. One specific example would be libraries that are on a private network and have access to resources handled differently depending on how you connect; via the private network = no auth, but via the internet = auth required.

Split horizon DNS is a simple, practical way of affecting how traffic is routed in a lot of cases.

https://utcc.utoronto.ca/~cks/space/blog/sysadmin/BinatAndSp...

In the meantime they have to use split dns so they are able to keep things kinda working.

I have personally worked at least a couple of large orgs that have this setup (ie 100s or 1000s of ancient devices on internal networks squatting on what are actually public IPs).

I want to add, that you can't run your own public DNS server nowadays, because it can be misused for DOS and hosting providers scan for open DNS servers.

So if you want your own public DNS resolver, DOH is much easier.

https://github.com/DNSCrypt/dnscrypt-proxy/wiki/Local-DoH

It isn't too hard.

Why? You're already using your internet provider, so you trust them. Otherwise you wouldn't use them.

Nope.

DoH does not take that away. It might move it away from the hands of your apparently adversarial ISP, but delivers the information in the hands of whoever is running those DoH servers...presumably Cloudflare, who already hold far too much sway for my comfort.

I suppose you can run your own dns resolver for dot - but there seems to be much poorer support for network level configuration (like DHCP)?

I'd like my android TV, my TV, my phone and my computers and my guests to use my local settings - automatically. Now every device need manual setup for every network?

CIRA has 3 levels much like opendns, private, protected and family. My router has already been using private for awhile mainly because it was the fastest dns.

The server for where I am located is hosted at a local ISP. If they were truly nefarious vacuuming up every dns request and providing a printout of my activity to the prime minister every morning they'd just host the server on their own network.

If CSE built it themselves as alleged, they did a good job in terms of its performance and I trust the Canadian government more than I trust an ad company.