Mozilla’s DNS over HTTPs

Re:Mozilla’s DNS over HTTPs by userbinator on Tuesday February 25, 2020 @08:10AM (#22412864)

I'm not a network admin working in a business, but I am the network admin of my home network, and I really do not want applications starting to effectively contain their own VPN clients and subverting my control.

[ Parent | on HN ]

Re:Mozilla’s DNS over HTTPs by Jonnax on Tuesday February 25, 2020 @08:20AM (#22412932)

DNS isn't a VPN nor really a security product. It's just a look up table.

The job blocking domains should be the job of a firewall. Of course this becomes more complex. But any application can implement DNS over HTTPS.

Malware could even just get a list of IPs from another IP.

An application can even just hard code IPs rather than using DNS and then they're in the same position.

[ Parent | on HN ]

Re:Mozilla’s DNS over HTTPs by userbinator on Tuesday February 25, 2020 @08:26AM (#22412973)

Tunneling DNS inside HTTPS effectively forms part of a VPN already (and I wonder when Mozilla will decide to also stuff the rest of the traffic through...)

DNS-based blocking is not perfect, but is currently still very powerful for things like adblocking.

You're basically saying that Firefox is now behaving like malware, which I agree with...

Windows 10's telemetry is also another piece of software which has started to become hostile in this manner, hardcoding IPs and such.

[ Parent | on HN ]

Re:Mozilla’s DNS over HTTPs by silon42 on Tuesday February 25, 2020 @08:58AM (#22413189)

Exactly. To control DoH we need to start to MITM all connections and block everthing else unless whitelisted.

[ Parent | on HN ]

Re:Mozilla’s DNS over HTTPs by EvanAnderson on Tuesday February 25, 2020 @12:58PM (#22415409)

For home network operators who value controlling the name resolution of devices they 'own' MITM won't be enough once embedded device manufacturers start using certificate pinning w/ DoH.

[ Parent | on HN ]

Re:Mozilla’s DNS over HTTPs by silon42 on Wednesday February 26, 2020 @12:58AM (#22420676)

Obviously, there will be a choice not to buy them / keep them offline.

[ Parent | on HN ]

Re:Mozilla’s DNS over HTTPs by kibwen on Tuesday February 25, 2020 @09:09AM (#22413284)

> I wonder when Mozilla will decide to also stuff the rest of the traffic through

Mozilla has recently begun offering an integrated VPN with Firefox, though unlike DoH that has a monthly subscription fee (hell, I don't blame them for wanting to diversify their revenue). The partner in that case is Mullvad.

> You're basically saying that Firefox is now behaving like malware

This is hyperbole. End users should look out for their own best interests by using any means necessary, which includes hiding as much as they can from the network. If the network doesn't like that, then it has the choice not to allow that user to attach a device to the network.

[ Parent | on HN ]

Re:Mozilla’s DNS over HTTPs by judge2020 on Tuesday February 25, 2020 @10:13AM (#22413770)

It's the inherent problem of your network position being between a device and the outside internet, the same position that browser activity-selling, website blocking ISPs are. The only difference is that previously, DNS would be unencrypted so you could DPI dns and/or block DNS requests going outside of your custom resolver. If an attacker wanted to hide DNS previously, they would need a hard-coded IP address to send encrypted requests to; now they can use big providers like CF/Google for DoH.

[ Parent | on HN ]

Re:Mozilla’s DNS over HTTPs by maeln on Tuesday February 25, 2020 @10:18AM (#22413815)

If you don't want DoH, you are not forced to use it. Yes its enabled by default, but it doesn't mean you cannot go into the settings menu and deactivate it.

[ Parent | on HN ]

Re:Mozilla’s DNS over HTTPs by pbhjpbhj on Tuesday February 25, 2020 @11:05AM (#22414243)

Hmm, unless you're trying to control what comes in/out your home network .. in which case you're screwed. But you can switch it off in your own browser.

I was a happy pihole user. I could choose to allow DNS lookups, and blacklist using OpenDNS. If I install Firefox at home, then I can't block problematic sites; and Cloudflare will use this to sell the idea to advertiser for TVs and such, so it looks like Google/Cloudflare just used Firefox to obviate ad blocking.

[ Parent | on HN ]

Re:Mozilla’s DNS over HTTPs by maeln on Wednesday February 26, 2020 @05:09AM (#22421776)

I also use PiHole at home, and lets be honest, if we know how to setup a PiHole, deactivating Firefox DoH is not going to be a problem for us.

DoH is not meant for us, it is meant for the average people who have no tech background. Just because it will cost us a few minutes to configure, we shouldn't deny the overall benefit it will bring to most.

[ Parent | on HN ]