Firefox’s Trusted Recursive Resolver DNS feature is dangerous

Re:Firefox’s Trusted Recursive Resolver DNS feature is dange... by chrismorgan on Sunday August 05, 2018 @06:51AM (#17690685)

I live in Australia; ISPs are basically all big entities, altogether unworthy of trust. The US is broadly similar. In both countries, you do get some obscure tiny ISPs, but they’re fairly rare overall.

I’ve also spent time in India with a small ISP, and I hated their DNS: they actively intercepted all DNS and replaced it with their own OpenDNS arrangement, involving the horrible NXDOMAIN replacement that was still a thing at the time, and in such a way that you couldn’t opt out of it! I don’t know how trustworthy they might or might not have been (I didn’t personally know them), but I do know that I loathed their technical decisions and would fain have bypassed them.

[ Parent | on HN ]

Re:Firefox’s Trusted Recursive Resolver DNS feature is dange... by telmich on Sunday August 05, 2018 @06:53AM (#17690692)

I get the point. If your ISP is also not trustworthy, the situation probably does not change much for you. Then again, maybe the right solution is to look at how to get back trustworthy ISPs.

[ Parent | on HN ]

Re:Firefox’s Trusted Recursive Resolver DNS feature is dange... by cptskippy on Sunday August 05, 2018 @10:29AM (#17691487)

Which is a goal to strive for as well however this endeavor is still valid as the client can be mobile and transient across ISPs. So until you can trust all Is as you might come into contact with, having a secure and hardened client is the better of the two.

[ Parent | on HN ]