Hacker News Reader

Comment by Animats | Hacker News Reader

Firefox by default directs DoH queries to DNS servers that are operated by a "trusted partner".

That's what I don't want - Firefox offering services.

Once you have a centralized server, with a huge number of minor queries passing through it, the operators get uppity. They start thinking they have editorial authority. Someone will decide that the DNS server should censor something. Child porn is the usual excuse, and then, after a while, you can't see sites that mention Tienanmen Square or Ukraine any more.

I'm quite happy with Sonic's classic DNS server. It just answers DNS queries and forwards requests to the appropriate upstream DNS server as required.

View on HN

This is configurable though (it's only a default), and is still better than the status quo in a lot of areas. Either you care enough to change it, or you stick to the default. Default (ISP) plain DNS is worse.

It's not though? You still have to trust your ISP, but now you need to trust some random company Mozilla has picked _in addition_ to your ISP.

The random company in this case is Cloudflare and NextDNS. And using DoH you cut out your ISP from the equation (at least for your browser traffic).

You can also setup a custom DoH provider (that can also be configured on the system level, not just the browser) so neither Cloudflare or your ISP gets your DNS queries.

Cloudflare and NextDNS absolutely counts as "some random company" in this context. I have no reason to trust random American companies more than my local ISP. I don't trust the USA more than I trust my own country.

> I have no reason to trust random American companies more than my local ISP. I don't trust the USA more than I trust my own country.

You know you are quite fortunate to be able to say so.

Firefox is a project with global impact. A lot of people around the world can benefit from DoH.

Even people in Germany who want to read the other side of the war story, like I did yesterday to read RT(.com) vs the Tagesschau propaganda. Since my ISP, O2, has removed rt.com entries and other russian propaganda outlets (I acknowledge the "west" also has propaganda outlets like Reuters etc) I was looking for ways to still read rt.com news. I looked into Firefox' preferences and searched for "DNS" and saw DNS over HTTP and I could pick Cloudflare, NextDNS (never heard of) or custom. I picked Cloudflare and read rt.com thus getting the other side of the whole bs propaganda mess.

The German Grundgesetz (constitution) says "eine Zensur findet nicht statt" (censorship does not occur/there will be no censorship) yet, there is censorship.

I was sceptical about DOH in general (why do we need this?) but now I see why this can be a good thing and great as well that Firefox supports it so easily.

How is this different from just using different DNS settings on your OS?

Because your ISP can block a "raw" DNS request, regardless of what server you configure. Your ISP can even inspect your DNS request, and choose to give a fake response or block the request based on the domain you are requesting.

Your ISP can also block the IP via reverse DNS if they want too.. If you don’t trust your ISP only a vpn will save you

Referring to Reuters as a propaganda outlet seems like a bold statement; what evidence led you to make that claim?

I could turn the question around, what evidence do you have they aren't?

I'm not going to search for every single article. Or are you seriously suggesting that Reuters is 100% free of propaganda, especially in war times?

The answer your question: "common sense".

That is an unsatisfying and fallacious response. I did not make that claim, nor did I call them a propaganda outlet. For whom are they propagandizing?

> I could turn the question around, what evidence do you have they aren't?

I don't care about either side of this argument, but you can't logically turn the question around. The burden of proof is on you, who made the claim.

Because USA wouldn't issue a national security letter to get dirt on foreigners? Seems like if Mozilla wanted to choose DoH as way to protect people from being spied on they wouldn't choose USA-based companies?

Like "don't get caught by your own gov accessing restricted material get caught by USA gov-related organisations so they can sell you out to your own gov & benefit USA".

If you're bothered about who's watching your web traffic then it seems highly unlikely you want to add USA to the list of who is watching you??

There aren't many companies with that capability and scale outside of US.

And the States are watching you anyway: most of the Internet resides there. Even the websites that don't are likely using Cloudflare or etc to save on traffic.

Cloudflare is only the default for users in the USA.

I'm in Canada and the default provider is CIRA. I can also choose to switch to Cloudflare, NextDNS, or add my own.

You can check out the Network Settings at the bottom of the General tab to see what your default is.

And who on earth is NextDNS? Looking at their website, there's no mailing address, phone number, or other identifying information other than the names of the founders and their Twitter links. If that doesn't qualify as some random company, I'm not sure what does!

And I simply don't trust Cloudflare.

And that’s fair, again this is all completely customizable and in fact you are better served configuring a system/network-wide DNS host that you run yourself or trust.

Most people are going to use the defaults. Giving all DNS requests for 99.9% of Firefox users to two random American companies is irresponsible.

If it is irresponsible to utilize the services provided by companies under the jurisdiction of the United States, then using much of the internet and Firefox itself is irresponsible.

The user made a conscious choice to trust one specific American company. They do not want other companies they did not personally "vet"-- with whatever weird and personal criteria they feel like -- added without their approval. This shouldn't be this hard to understand.

And they have the option to not utilize this feature or change the settings to a service provider they do trust.

The threat vector is understandable. Not making the choice to mitigate it is what does not make sense to me. Cloudflare is not an unknown operator. You can study their past behavior, their beliefs, and how their services work, and make that choice.

Saying 99% of people accept the defaults and claiming this is bad without learning about what the defaults are or how to change them when it takes a few straightforward steps to do so is what does not make sense to me.

Even installing Firefox in the first place is to make a conscious choice to change the defaults of nearly all operating systems that the vast majority of people on Earth use. It’s defaults will also now have a feature to encrypt your DNS queries to a third party vetted by Firefox. If you cannot trust them then why use their browser?

I’ve studied it.

“Matthew Prince, Cloudflare’s chief executive. “It’s dangerous for infrastructure companies to be making what are editorial decisions,” he said.”

Not dangerous enough apparently.

So? That's not an argument for doing it again. 'Everyone else is taking a bung from the NSA to forward them data', for example, isn't a moral justification to do it yourself (made up example).

You get prompted for whether or not you want to use it. If you choose not to use it, it will continue using whatever DNS your computer is using.

It's just an option. In this case, both selected options are excellent providers that I'm happy to see.

You don't _need_ to, running your own dns resolver is pretty easy...

apt install dnsmasq

is my preference.

Even a ten dollar router will let you pick who you trust for DNS.

Even in that scenario you’re still vulnerable to DNS sniffing and injection. These aren’t theoretical concerns, they’re real-world actively explored vulnerabilities. And if you still don’t care, well, that’s why you can turn DoH off.

This is valid also on Cloudfare. I really do not see why i shall have more trust on Cloudfare than on my ISP ? They both operate in the "free" market.

In some countries ISPs work closely with the government and block certain websites the government asks them to etc. In these cases I would trust cloudflare over my ISP

In some countries (USA) tech companies (Cloudflare) work closely with the government (see Snowdon revelations). I trust my ISP, which I chose, more than a foreign company (Cloudflare).

^ This is what I don't get..

Everyday people who are worried about state-actor threats - an incredibly targeted and unlikely scenario for the average person - but are less concerned about their personal information being harvested for marketing purposes - something that happens all the time to everyone.

And i don't get how one would think that I, as a European, would want an overseas company to handle my data. If my ISP is breaching GDPR, all i have to do is to go to data protection agency (at least i have that option on the table), good luck doing that with an overseas company... I have zero indications that my ISP is selling data for marketing purposes (unlike some US ISPs which even inject ads).

Because if the situation is reversed and e.g. the local police subpoenas your ISP to find people that are "illegally torrenting" or whatever they won't include you. That's happened a lot within Europe.

Even if the foreign government spies more nether jurisdiction is likely to care enough about you specifically to make an international case of it.

In other words I'd think most Americans would be better off proxying through Europe, and most Europeans would be better off proxying through the US.

Even better would be to proxy through a third country that your own country is unlikely to cooperate with, and which won't care about you personally.

E.g. I wouldn't want to live in Iran or North Korea, but I'd think proxying DNS through them would in some way maximize my privacy if I was living in Europe or the US.

I'll never travel to either of them, and my authorities are vanishingly unlikely to cooperate with either of them for anything short of murder.

Except proxying through Iran or North Korea literally puts a target on you locally. Not really the brightest idea. As for other things - it is not black or white, depends where you are and from that you choose the best option for you. The "copyright" cartels are mostly American so it kinda does not even make sense to use US in order to avoid that, just makes it easier for them.

> Everyday people who are worried about state-actor threats - an incredibly targeted and unlikely scenario for the average person -

I agree with you that people should be more worried about companies collecting their personal info, but we know now that the state collecting your data isn't incredibly targeted or at all unlikely. They just take everything. It's happening to every last one of us every single day. It's been going on for decades.

https://en.wikipedia.org/wiki/Room_641A https://en.wikipedia.org/wiki/Russ_Tice

Cloudflare has a legally binding contract with Mozilla to this effect. So you’ve traded up from a number of companies that have never promised to not sniff or tamper with your traffic (and often do, and don’t really have any positive brand image to protect) up to a single company that has a legal commitment not to tamper with your traffic (and has some form of brand image to protect). I too, would prefer if DoH had more technical features to prevent sniffing/tampering, but this is an upgrade.

See, IMHO a "binding contract" isn't worth the paper it's written on if violations of the contract are undetectable. There's no brand image impact if there's no evidence.

And if I was an intelligence agency trying place spies, Cloudflare would be among the first tech companies I'd target.

This feature seems almost exclusively a feature for people in the ISP-monopoly-friendly United States.

>And if I was an intelligence agency trying place spies, Cloudflare would be among the first tech companies I'd target.

This seems like a threat model swap in the conversation. The subject threat model here is (1) defending against companies stealing and selling my data. You swapped in the threat of (2) state level agencies spying on you through these companies.

The problem is that #2 seems to be an intractable problem. (but not so much because of an infiltrated DNS provider, more like cable taps and infiltrated hardware manufacturers)

#1 seems to be a more solvable problem (albeit at increasing levels of complexity). When you bring #2 into the conversation, it defocuses on the solution to #1 and gets to a point where we all throw up our hands and admit helplessness and defeat.

I see this happen often and I think every conversation should be clearly grounded in the threat model that is being addressed.

ISP-provided CPEs often (usually these days? I wonder if anyone has studied this) allow you to change the recursive DNS servers that they forward queries to. Nor do they let you customize the DNS servers handed out by their DHCP servers.

A while back, Sky Broadband was even intercepting all customer traffic to UDP or TCP port 53, and forcing it to go to their shitty DNS servers, which panic and drop the connection when they see something 'unusual'.

> A while back, Sky Broadband was even intercepting all customer traffic to UDP or TCP port 53, and forcing it to go to their shitty DNS servers, which panic and drop the connection when they see something 'unusual'.

This is exactly why DNS over HTTPS is a thing. Unencrypted services are regularly abused by ISPs and DNS is no exception.

Running your own DNS resolver doesn't give you any of the benefits that using DoH does. The recursive queries that it sends out are just as vulnerable to an adversary on the network blocking or spying on as the ones sent to a regular insecure DNS server.

My ISP specifically reserves the right to sell browsing data, Cloudflare and NextDNS have privacy policies forbidding them from doing so.

Your ISP will still get your browsing data via SNI so the only change is that now both your ISP and Clouldflare will get it.

No, Cloudflare thought of that and is fixing it with their deployment of TLS ECH.

Your ISP will see every IP you're communicating with. They don't need your DNS at all. Trying to hide your traffic from your ISP without a VPN is unlikely to work.

But when the IP is all they see, and it belongs to a big CDN, that doesn't really reveal anything.

I live in China and (still) use Firefox in preference to Google. I agree they need to fire the management and focus on the code. The big pain with DNS is that it's one avenue of censorship but also a proxy for many wrong-headed network geographic assumptions through the lens of geoDNS. "Oh, you resolved from Europe, so you really want a European server! Let me help you out there..." The internet has far too many of these half-baked hacks layered now, it's getting to the point where to obtain a halfway trustworthy response you have to have a dynamic network of geographically distributed and temporally transient nodes seeking similar information and voting on the result. Geoscoping, echo-chamber personalization, household profiling, jurisdiction-second-guessing, ID verification as an outsourced service, political policy fandangling, globe splitting for artificial market segregation, walled-gardening, DRM...

What is a practical alternative to multiple DNS views based on the client's geographical location, for the problems solved by them?

A way to 'opt out' of response customization based on my location would be nice while troubleshooting. But then which zone is that going to give me? Probably the US one. :P

What is a practical alternative to multiple DNS views based on the client's geographical location, for the problems solved by them?

DNS was originally intended to be a domain name resolution service with fixed records. Yet, IIRC even in the very early days (1983) it allowed multiple records. So providing a list of potential endpoints to the client to empower them was fully supported since approximately day 1.

Apparently, instead of developing smart clients that use this (very efficiently provided) information to make reasonable actor-centric decisions, we have developed dumb clients and instead of selecting the best possible endpoint from a set it will just select either a random response or the first response most of the time. GeoDNS further degrades this already bad situation to purposefully provide limited, expiring and non-cacheable responses to individual clients thus locking in the failure.

There are application-level peer selection implementations for various protocols, for example gentoo had a mirrorselect tool which is awesome and torrents will generally prefer fast peers. It would not be that hard to make a smart resolver that did AS-level resolution and cached previously observed bandwidth to make intelligent prioritization decisions without the need to actually actively probe the network. This could even be done at the OS level, transparent to applications.

[RFC882] https://www.rfc-editor.org/rfc/rfc882.txt [RFC883] https://www.rfc-editor.org/rfc/rfc883.txt

Sonic is a decent provider. This is rare. Most ISPs in the US will sell your queries, use it for marketing, inject fake NXDOMAIN ads, etc.

So choose a different one. You don't have to use your ISP's. The danger is in everyone using the same one, which is what you get if the browser vendors are choosing for everyone.

Better yet, give the browsers a way to detect this (e.g. generate a random domain known not to exist and make sure it gives NXDOMAIN) and switch to the other DNS only if the normal one is broken.

You don't get this choice in most of the US.

You don't have the choice of DNS server in most of the US?

It is actually really easy to ignore user's selected DNS server. Basically ISP can just inject responses, given that DNS is unauthenticated.

I don't know if US ISPs do that, but it can be done.

I know that both T-Mobile and Comcast have both ignored user selected non-DoH DNS settings by force in the past, either by DPIing port 53 traffic or static routing major public DNS servers toward their own resolvers.

So, do they still do it? This fearmongering about DNS selling pops up in every DNS thread here.

I don’t really understand this perspective. “Sure, I’m using vulnerable technology, but nobody has exploited me lately that I know of” isn’t a statement that would get positive reception in any other netsec discussion.

yeah... it's not fear mongering when it's a thing that actually happens. Some ISPs collect and sell your data. I mean, they even paid congress to make it okay for them to do it. They sure can't be expected to keep their word

https://arstechnica.com/tech-policy/2019/01/t-mobile-sprint-...

And you really believe that "every ISP" sells your data, only Cloudfare is not doing it ? You know, Apple was a "privacy oriented company" until some years ago.

Well... I said "some ISPs" sell your data, not "every ISP", but I wouldn't put it past any of them. Personally, I don't trust cloudflare, I don't like efforts to kill ad-blocking, and I don't like further consolidating people's DNS traffic into the hands of a smaller and smaller number of providers. I've got the feature disabled for now. I wish someone like EFF would set up a DNS server supporting DoT. I'd pay for the service!

ISPs don't have the best profit margins, especially ones in competitive markets..

If the big players are selling DNS data, I guarantee you there are companies out there approaching every other smaller ISP with a turnkey solution that makes it as easy as possible to do the same thing with some kind of revenue share model.

Not a lot of businesses would turn down extra money like that, when they know their big competitors are doing the same thing.

Unlike most ISPs, privacy and security are a core part of Cloudflare's brand and business model - at least at the moment - so it's in their own interest to actually not do this stuff.

Only time will tell whether or not they pull a "don't don't be evil" on us, but that's a different conversation. :-)

Cloudbleed and particularly Cloudflare's response to it (the way they publicly blamed Google) tells you everything you need to know about how trustworthy Cloudflare is. I personally use Google via DNS over TLS, not that it is a good option but I personally prefer that to the alternatives available near me. CenturyLink was intercepting DNS last I checked a few years ago.

Cloudflare promises that they don't in a legally binding document. Does your ISP do the same?

It is much easier to replace Cloudflare if they violate your privacy than to replace your ISP if they violate it. That helps to keep Cloudflare honest.

The article is not about DNS?

I can confirm T-Mobile currently still does it.

Comcast does it to this day.

How can this be legal, interfering with someone's Internet traffic?

I guarantee the ToS you agree to with your ISP gives them to right to do this kind of stuff, for "network stability and performance" reasons or some other reason.

I used to have Spectrum "community wifi" (their service for apartment buildings). They were doing this as of last year. They even spoofed responses from root servers, which utterly broke things like `dig +trace`.

Capturing and redirecting DNS traffic is not difficult. You can do it yourself to force smart devices with hard-coded DNS settings to go via a local resolver that filters ads/stalking, so I have no doubt there are ISPs doing it to their customers to keep control for the purposes of tracking and NXDOMAIN hijacking.

For anyone looking for a quick and easy solution via NextDNS: https://github.com/nextdns/nextdns/wiki

I have it installed a few different places on a few networks (Ubiquity, DDWRT, OPNSense, DNSMasq), and it works as expected.

1) Literally yes in some cases, as others have pointed out.

2) I thought we were just talking about defaults? Firefox DoH lets you choose any server too

No, you don't. I have only one choice of ISP, Comcast. Comcast sniffs all DNS traffic to this day. Their DNS is hard-coded into their routers. I know they sniff because I have gotten DMCA notices while using a VPN. I had to spend quite some time setting things up to my VPN provider's recommendations to be able to use their DNS. I haven't received a DCMA notice since.

And yes, I know a cheap router can easily fix this problem. I just haven't had the time..

Not without DoH. If you just try to set a custom server to use for insecure DNS, it's trivial for your ISP to rewrite all of your insecure DNS queries to go to itself instead.

> Child porn is the usual excuse, and then, after a while, you can't see sites that mention Tienanmen Square or Ukraine any more.

Has this ever happened?

Yes and it's happening right now with the US and Canadian "no encryption" campaign

> US and Canadian "no encryption" campaign

What is that?

I believe they are talking about the EARN IT act:

https://www.congress.gov/bill/117th-congress/senate-bill/353...

Didn't the UK run into a problem a decade-ish ago where the group compiling the list of porn sites to block by default included the websites for their rival political parties? I just tried searching for references, but I can't find anything with details. I can't speak with certainty and it sounds like it was just a grunt being a jerk, but still a risk with these types of restrictions.

I'm not sure about weilding it for political power, but I did find this https://www.independent.co.uk/tech/o2-changes-porn-filter-af...

I think this is what Snowden referred to as the concept of "TurnKey tyranny".

At the application level, it's happening right now all over social media sites. The risk is too great that our delicate minds, unable to separate fact from fiction, will ingest something deviating from the approved narrative.

In the UK snoopers charter was supposed to specifically target child porn, the actual wording of the law made it legal for your bin man to see your internet history for any reason.

Do they actually use their massive unchecked power to target child porn? We don't know because it's unchecked the government doesn't report on how the law is used it just uses it.

If the government actually used it to lock up a thousand pedos that would be pretty great it would get me voting for that government so why haven't they reported how success-full this law has been in the 4 years its been in affect? we haven't heard a peep, probably because there hasn't been any success for them to boast about.

Around 2 years ago my country blocked access to change.org as it contains "prohibited content" (it is widely believed to be an appeal for Germany not to permit Thai king to take up long-term residence there; people believe that the ruler should behave properly and stand with the people in its country)

The appeal itself appears to be reasonable, but Thailand is notorious about the enforcement of lèse-majesté law [1], and anything that could be interpreted, even slightly, to fall under this law often saw a summary judgment, less burden of proof, and harsh punishment. This is the reason the authority cited as a basis to block it. AFAIK, the website fought back; the block lasts only 6 months.

[1] See https://en.wikipedia.org/wiki/Lèse-majesté_in_Thailand for more information.

> Once you have a centralized server, with a huge number of minor queries passing through it, the operators get uppity.

This is currently the case, no? DNS is already, as far as the user concerned, a centralised service where any slippery-slope censoring can (and im sure does) already happen.

Dns block at the isp level is already widely used for piracy, and non isp DNS are getting sued over not doing it: https://deepdotwebs.com/quad9-must-block-dns-queries-to-a-pi...

As opposed by your "trusted" partner ie. your internet provider? Ignoring that these are the organisations that keep getting hacked, they also outright try to monetize your DNS queries whichever way they can (even falsifying real sites).

And that's ignoring the obnoxious government interference ISPs tend to implement through DNS. From piratebay to youtube blocks.

You have to trust someone with DNS. And Firefox's trusted partner is better than the current status quo.

How is it an advantage to have to trust both your ISP and Clouldflare?

You don't have to trust your ISP with DNS-over-HTTPS

https://en.wikipedia.org/wiki/DNS_over_HTTPS

This is actually considered "a disadvantage" by wikipedia, because of course it means captive portals don't work.

Can I ask what you would prefer? If FF adds an additional choice among the status quo, are you saying you would prefer the status quo minus the additional option of FF?

How is this different from offering a default search engine provided by a "trusted partner"?

Exactly, and how is it different from offering a default installed browser in an OS by a "trusted partner"?

Simple: when you use the default search in a browser, you immediately see who is providing search results. If you have a problem with Google, for instance, you see that it's Google and you go and change it.

Mozilla decided to turn on DoH by default, without asking, without prompting, without any indication whatsoever. Even if you configure a canary domain, that doesn't disable the DoH preference - it just temporarily turns it off.

Organizations making unilateral decisions about sharing my private information with an untrusted, for-profit company that has a history of abuse and social irresponsibility is a very bad thing, not a good one.

>That's what I don't want - Firefox offering services.

That's what I actually want from Mozilla — offering (but not forcing) privacy-enhancing services, preferably for free.

> Once you have a centralized server

DNS is not centralized. You can enter whatever DNS server you want. The problem with plain text DNS is that in countries like Turkey over half million domains are blocked in DNS level. Even if you enter your custom DNS, Turkish ISPs MITM the queries and respond with are IP adrress that says that the domain is blocked. DoH prevents such attacks. For this reason once again huge thanks to Mozilla who fights against opressing regimes.

The traffic already flows through their browser. If they wanted to filter content, they could do it now at render time. There’s nothing stopping a browser from doing content analysis before it chooses to display it to you. The fact that they haven’t, is a pretty good sign.

Reply on news.ycombinator.com