Firefox’s Trusted Recursive Resolver DNS feature is dangerous

Re:Firefox’s Trusted Recursive Resolver DNS feature is dange... by trumped on Sunday August 05, 2018 @09:08AM (#17691142)

but your ISP will still be able to see all your connections even if you don't use its DNS servers unless you use a VPN... this just spreads the information to a third party.

[ Parent | on HN ]

Re:Firefox’s Trusted Recursive Resolver DNS feature is dange... by trumped on Sunday August 05, 2018 @11:43AM (#17691861)

https://en.wikipedia.org/wiki/Server_Name_Indication#Securit...

Downvote me all you want, but domain names are still being sent to the ISP unencrypted, as of TLS 1.3... so it doesn't matter who processes your DNS queries, your ISP still knows everything about which sites you are accessing... but anyways, bare IP addresses still reveal a lot (metadata)

[ Parent | on HN ]

Re:Firefox’s Trusted Recursive Resolver DNS feature is dange... by patrickmcmanus on Sunday August 05, 2018 @12:00PM (#17691929)

right - but we're coming for cleartext sni too:

https://tools.ietf.org/html/draft-rescorla-tls-esni-00

interestingly, something like DoH is a pre-requisite for pulling off esni.

[ Parent | on HN ]

Re:Firefox’s Trusted Recursive Resolver DNS feature is dange... by trumped on Sunday August 05, 2018 @12:47PM (#17692136)

that's great, but are you coming for the ip addresses too (probably the bigger challenge)?

[ Parent | on HN ]

Re:Firefox’s Trusted Recursive Resolver DNS feature is dange... by patrickmcmanus on Sunday August 05, 2018 @02:56PM (#17692838)

wrt esni the anonymity pool is definitely the set of content that can share the same address pool. In a world with lots of CDNS (and several multi-CDN switching services) this covers a huge amount of content - but I agree - not everything.

[ Parent | on HN ]

Re:Firefox’s Trusted Recursive Resolver DNS feature is dange... by trumped on Sunday August 05, 2018 @03:12PM (#17692913)

If you think about the best/worst case scenario, would you be happy if one CDN would deliver everything? I think that we would be in a worst situation... ideally, I think that everyone would have their own servers and that your ISP would not even be able to see which IP addresses you are talking too (completely decentralized)

[ Parent | on HN ]

Re:Firefox’s Trusted Recursive Resolver DNS feature is dange... by patrickmcmanus on Sunday August 05, 2018 @03:18PM (#17692948)

cdn switchers/sharers are very interesting here. e.g. cedexis

[ Parent | on HN ]

Re:Firefox’s Trusted Recursive Resolver DNS feature is dange... by eastdakota on Sunday August 05, 2018 @05:30PM (#17693640)

Yes, we are. After ESNI we’re working on DNS IP address randomization.

[ Parent | on HN ]

Re:Firefox’s Trusted Recursive Resolver DNS feature is dange... by trumped on Sunday August 05, 2018 @09:42PM (#17694614)

is that a joke? sorry I don't see how that would help... where could I get more info?

[ Parent | on HN ]