News for hackers. Stuff that matters.

A comment on Turn off DoH, Firefox. Parent comment

Re:Turn off DoH, Firefox by cesarb on Wednesday September 11, 2019 @08:38AM (#20939376)
The default (which the majority of people will be using) is not Google, it's their ISP. And in the vast majority of cases, their ISP is under the jurisdiction of their country, while Google and Cloudflare have to obey the laws of a foreign country. Said foreign country might one day decide that for instance Google and Cloudflare now have to log the IP address of everyone who does a DNS lookup for news.ycombinator.com, even if the laws in the user's country forbid it.
[ Parent | on HN ]
Re:Turn off DoH, Firefox by magashna on Wednesday September 11, 2019 @09:26AM (#20939869)
Mozilla is only applying this in the US.
[ Parent | on HN ]
Re:Turn off DoH, Firefox by bennyp101 on Wednesday September 11, 2019 @09:32AM (#20939948)
To start with
[ Parent | on HN ]
Re:Turn off DoH, Firefox by southerntofu on Thursday September 12, 2019 @07:02AM (#20950085)
According to a CCC talk about DNS security, Mozilla is going to enable providers on a regional-basis by partnering with privacy-friendly non-profits.

DigitalCourage was one of the names mentioned as a potential EU-based DoH provider.

[ Parent | on HN ]
Re:Turn off DoH, Firefox by darkhorn on Wednesday September 11, 2019 @03:55PM (#20944021)
This!

This is very bad for Erdoğan. They won't be able to block DNS over HTTPS. Thus teir classic DNS blocks will be useless. Last time I've checked there was over 300K blocked domains via DNS. Even 8.8.8.8 doesn't work.

[ Parent | on HN ]
Re:Turn off DoH, Firefox by icebraining on Thursday September 12, 2019 @05:29AM (#20949603)
> They won't be able to block DNS over HTTPS

Of course they will. The DoH server can be blocked just like any other.

[ Parent | on HN ]
Re:Turn off DoH, Firefox by pixl97 on Thursday September 12, 2019 @08:09AM (#20950505)
Eh, this is a losing battle for them. In theory any HTTPS server can be a DoH server if set up for it. One key for the future is to have so many DoH servers available for people in countries that filter that there is no way the government can block them all.
[ Parent | on HN ]
Re:Turn off DoH, Firefox by icebraining on Thursday September 12, 2019 @09:57AM (#20951473)
My uBlock Origin contains over 100k filter rules, and I pay zero for it. I doubt a company can't sell a list of open DoH servers for a reasonable price.
[ Parent | on HN ]
Re:Turn off DoH, Firefox by darkhorn on Thursday September 12, 2019 @11:36AM (#20952687)
How they are going to block servers who have DoH url? DNS level block or IP block. May be SNI level block but in few years we will have ESNI.
[ Parent | on HN ]
Re:Turn off DoH, Firefox by icebraining on Thursday September 12, 2019 @06:25PM (#20957122)
To access a DNS-over-HTTP server, you need its IP (otherwise it would be a circular problem - must have DNS to access DNS). So they can just block the IP/port.
[ Parent | on HN ]
Re:Turn off DoH, Firefox by okasaki on Thursday September 12, 2019 @05:03AM (#20949462)
Why can't they block 1.1.1.1?
[ Parent | on HN ]
Re:Turn off DoH, Firefox by darkhorn on Thursday September 12, 2019 @11:29AM (#20952592)
They can block but you can make any https page into DoH. What they are going to do? Block every web site?
[ Parent | on HN ]
Re:Turn off DoH, Firefox by okasaki on Friday September 13, 2019 @03:02AM (#20959854)
No, just the ones that run DoH.
[ Parent | on HN ]
Re:Turn off DoH, Firefox by diffeomorphism on Thursday September 12, 2019 @04:25AM (#20949231)
Wrong way around.

Said own country might one day decide to restrict access/log visits to controversial site X (e.g. Tibet, government critical news, piratebay etc.), which does not affect your DNS based in foreign country

[ Parent | on HN ]
Re:Turn off DoH, Firefox by icebraining on Thursday September 12, 2019 @05:28AM (#20949600)
Said country will just block the Cloudflare DoH server as well, forcing users to switch to a controlled DNS server.
[ Parent | on HN ]