News for hackers. Stuff that matters.

A comment on What’s Next in Making Encrypted DNS-over-HTTPS the Default.

Re:What’s Next in Making Encrypted DNS-over-HTTPS the Default by jlgaddis on Saturday September 07, 2019 @02:52AM (#20902207)
I didn't see it mentioned in the article. Has Mozilla said whose servers they will be sending unsuspecting users queries to by default? (IIRC, it was Cloudflare previously. Any reason to believe this has changed?)

---

If, like me, you already have a solution in place you are happy with and don't like the idea of others (deciding they know what's best for you and) circumventing it, simply ensure that your existing resolvers are configured as described in [0]:

> Network administrators may configure their networks as follows to signal that their local DNS resolver implemented special features that make the network unsuitable for DoH:

> DNS queries for the A and AAAA records for the domain “use-application-dns.net” must respond with NXDOMAIN rather than the IP address retrieved from the authoritative nameserver.

[0]: https://support.mozilla.org/en-US/kb/configuring-networks-di...

[ Parent | on HN ]
Re:What’s Next in Making Encrypted DNS-over-HTTPS the Default by josteink on Saturday September 07, 2019 @03:09AM (#20902278)
If true that DoH can be disabled at network level, ad-blocking solutions like pihole should probably implement it by default.

Anyone have any idea if this is the case?

That would at least save me a lot of trouble and work.

[ Parent | on HN ]
Re:What’s Next in Making Encrypted DNS-over-HTTPS the Default by Dylan16807 on Saturday September 07, 2019 @04:30AM (#20902555)
Pihole is great because it can do all your non-browser activity.

But for a browser, an ad-blocking extension works better and is less than a minute to set up. Why force it to use the same DNS blocking?

[ Parent | on HN ]
Re:What’s Next in Making Encrypted DNS-over-HTTPS the Default by josteink on Saturday September 07, 2019 @09:41AM (#20903710)
Most mobile-browsers don’t support ad-blocking, especially on iOS.
[ Parent | on HN ]
Re:What’s Next in Making Encrypted DNS-over-HTTPS the Default by Dylan16807 on Saturday September 07, 2019 @03:47PM (#20906060)
They're not threatening to use DNS-over-HTTPS either.

But didn't iOS get browser adblocking capability in the last couple years?

[ Parent | on HN ]
Re:What’s Next in Making Encrypted DNS-over-HTTPS the Default by josteink on Saturday September 07, 2019 @04:47PM (#20906417)
Not for third-party browsers like Chrome or Firefox. In a classic Apple-move, it’s for Safari only.
[ Parent | on HN ]
Re:What’s Next in Making Encrypted DNS-over-HTTPS the Default by Dylan16807 on Saturday September 07, 2019 @10:45PM (#20908281)
Even though those browsers have to use a safari core anyway? How strange.
[ Parent | on HN ]
Re:What’s Next in Making Encrypted DNS-over-HTTPS the Default by josteink on Sunday September 08, 2019 @04:04AM (#20909198)
Technically speaking they are not using Safari, but a WebView.
[ Parent | on HN ]
Re:What’s Next in Making Encrypted DNS-over-HTTPS the Default by EvanAnderson on Saturday September 07, 2019 @04:41AM (#20902592)
Already proposed: https://discourse.pi-hole.net/t/support-for-returning-nxdoma...
[ Parent | on HN ]
Re:What’s Next in Making Encrypted DNS-over-HTTPS the Default by josteink on Saturday September 07, 2019 @06:47AM (#20902995)
Make that already merged: https://github.com/pi-hole/pi-hole/pull/2915

Pi-hole is awesome.

[ Parent | on HN ]
Re:What’s Next in Making Encrypted DNS-over-HTTPS the Default by jedisct1 on Saturday September 07, 2019 @11:45AM (#20904476)
Already implemented in the latest dnscrypt-proxy version.
[ Parent | on HN ]
Re:What’s Next in Making Encrypted DNS-over-HTTPS the Default by TazeTSchnitzel on Saturday September 07, 2019 @07:12AM (#20903076)
I wonder if UK ISPs that complained about DoH will block use-application-dns.net network-wide.
[ Parent | on HN ]