OpenBSD Disabled DoH by Default in Firefox

https://undeadly.org/cgi?action=article;sid=20190911113856

by katzeilla • 7 years ago

73 75 7 years ago

undeadly.org

bureaucrat5• 7 years ago

DoH should be supported on the OS network stack, if needed.

I can’t understand this move. Firefox should retreat from this default.

swiley• 7 years ago

The problem with this is that the language runtimes now have to have an http client implementation. DNS isn’t super simple but I would argue it’s much simpler than http. DoH is a very good idea and we need the security it provides but I think using http as the protocol is probably a mistake and will prevent it from being widely adopted.

asveikau• 7 years ago

So perhaps the right solution is to run a plaintext DNS server bound to localhost, and it calls out using whatever encrypted protocol deemed necessary, systemwide.

masklinn• 7 years ago

You probably don't need a full-fledged general-purpose HTTP implementation to do DOH.

However you'd need a pretty complete TLS implementation in the network stack. Which I guess you also need to provide DNS over TLS.

easilyconfused• 7 years ago

Why? I assumed everyone asking for it to be OS level would mean that the system resolver does DoH while normal clients continue doing regular DNS. Otherwise what would it even mean to be OS-level if all the client applicatios are doing DoH themselves...?

ori_b8• 7 years ago

Yes. A DNS client was trivial to implement for Myrddin. 550 lines of code. HTTP2 would be incredibly big in comparison.

https://git.eigenstate.org/ori/mc.git/tree/lib/std/resolve+p...

osstack• 7 years ago

Are Linux/Mac/Windows actually working on adding DoH to their network stack? I never heard anything regarding this.

And what would be the relationship to DHCP?

katzeilla4• 7 years ago

Not sure about Linux/Mac/Windows, but for OpenBSD, you can simply use unbound in base system to enable DoH (EDIT: No, it's not DoH, it's DoT) for everything in your system.

https://man.openbsd.org/unbound.conf

bigbaguette• 7 years ago

Some argue that it's better than nothing, seeing the lack of progress on this matter at the OS level

Jonnax• 7 years ago

DNS over HTTPS is great for the average user.

Anyone who needs some other configuration, clearly is knowledgeable enough to change the behavior.

lucb1e8• 7 years ago

I have mixed feelings about this. Yes, we should do what is best for most people, and in particular those who cannot or will not configure it by themselves. But I, too, would like to have good defaults.

In this particular case it seems relatively easy: have a blacklist of bad ISPs (similar to how we keep track of phishing sites) and enable it by default for those users (they already have lots of remote calls built in, such as http://detectportal.firefox.com/success.txt or the update check, which could easily check to which ISP the request comes from).

In the general case, I guess it would be something to choose on first run, which nobody wants. Perhaps there should be a flag/setting "I do want first-run questions for questionable defaults", so that I don't have to hear through the media which settings I have to change after the next update?

zrm4• 7 years ago

It's not a matter of knowledge. If each application ignores the OS DNS configuration in favor of its own, it's no longer possible to make a system-wide change to it. You have to change each application individually, and then go back and do it again for each one that updates to a version that adds its own support for DoH.

You also then end up with each application using its own implementation, but DoH is a complex protocol (DNS+TLS+HTTP), so that's a lot of attack surface. Better to have one high-quality up-to-date implementation in the OS than dozens of applications that each get their own chance to screw it up.

It also breaks all of the usual things that make local DNS work. Your local DHCP server provides your local DNS server which includes entries for the local names with RFC1918 addresses that are only accessible on the local network. Move to DoH via some default external provider and that breaks and requires touching every application on every client to fix it.

m45t3r4• 7 years ago

It also breaks all of the usual things that make local DNS work. Your local DHCP server provides your local DNS server which includes entries for the local names with RFC1918 addresses that are only accessible on the local network. Move to DoH via some default external provider and that breaks and requires touching every application on every client to fix it.

This is not true, Firefox will fallback to your OS configured name resolver if it can't find a name. You can also set it to strict mode so it will only use DOH, but this is not the option that Firefox set by default.

https://blog.mozilla.org/futurereleases/2019/09/06/whats-nex...

techntoke2• 7 years ago

While I agree with everything you're saying, maybe this should be a wake up call about who Mozilla is as a company. They are very manipulative too, so expect anything negative about them to get downvoted.

dontbenebby3• 7 years ago

Also what would I change it to? Cloudflare was already my selected dns provider. Is the issue that DoH will leak individual pages, not just domains? If not I'm not clear what the issue is. I trust cloudflare more than my isp.

falcolas• 7 years ago

Quite literally anything you wanted to change it too. Google. Cloudflare. Your local ISP. Amazon. Verasign. Level3.

Or you can run your own and do your own recursive lookups.

m45t3r4• 7 years ago

You can also argue that an OpenBSD user is not your average user. So I think the default from Firefox makes sense (since most of Firefox users are on Windows and should probably be average users), and the fact that OpenBSD override that default also makes sense.

artemiszenk• 7 years ago

I don’t see anything sinister here. Many of us who care about utilizing DoH may already have an appliance that performs this task, but leaving it as an option users can eventually opt into is a good thing.

If Google was the one offering DoH, and Otto made this change basically saying, “We don’t want all our traffic going to Google,” I think it would add perspective.

Faark• 7 years ago

There are arguments against Mozilla's current DoH rollout. DNS should be an OS setting and it should not default to a single commercial company. Both are totally valid and I hope be addressed as DoH matures.

Or do you mean nothing sinister in this OpenBSD move? Well, it is kind of ironic to downgrade Firefox defaults to unencrypted DNS, since the absence of any modern & encrypted DNS on OSes was likely the only reason Mozilla felt the need for the switch in the first place. And this move doesn't seem to address this underlying issue of unsafe defaults caused by OSes like OpenBSD and thus feels a lot like some "no, shut up, everything is fine" reaction to criticism.

windexh8er• 7 years ago

Agreed. But I do see it as very similar to preloaded/preselected search. We're numb to that feature of browsers and sometimes fail to remember we don't need them. In many regards DNS in the browser gives back control to the end user. As governments and service providers encroach DoH and DoT are leveling the playing field.

Also keep in mind there are different modes DoH in Firefox can operate in. [0] Ultimately I welcome the feature and hope we see more not-for-profit options as defaults in Firefox.

[0] https://wiki.mozilla.org/Trusted_Recursive_Resolver

jlgaddis• 7 years ago

If Google was the one offering DoH, ...

Related: With Chrome 78, Google is starting to "experiment" with ("an auto-upgrade approach" to) DNS over HTTPS (DoH) [0], as previously discussed [1] a few days ago.

There are some very notable differences from Firefox's testing, however (in particular, they will be "keeping the user’s DNS provider unchanged").

[0] https://www.chromium.org/developers/dns-over-https

[1] https://news.ycombinator.com/item?id=20929720

lucb1e8• 7 years ago

As a European, I also find it very weird to enable this globally by default. I really don't want to send my traffic to a third party on some other continent that gives me a service for free. I pay my ISP good money to do this for me.

No idea how common this is in other countries, but my ISP doesn't sniff or sell my traffic. I've only ever heard about that on HN or Reddit, which are USA-centric. I guess it also happens in other countries, but in the EU such a thing would have to be made known to the user because it processes personal data.

Somehow, adding a Pocket button is bad but sending all visited websites to Cloudflare is good. The top two comments (and many others) on the thread about Pocket can be applied here as well if you just replace the name "Pocket" with "Cloudflare": https://news.ycombinator.com/item?id=9667809

Santosh83• 7 years ago

Indian here. My ISP does inject ads into plain HTTP traffic, so based on that user-hostile behaviour I assume that they also record my DNS queries and/or sell them. Also whether or not they do that, they are mandated by govt to keep DNS query records for at least 18 months (last I looked) and then anonymise them. Under the current authoritarian leaning govt, I wouldn't be surprised if rules have been revised mandating indefinite recording.

lucb1e8• 7 years ago

Interesting, thanks for adding that data point. I'm wondering if there is a list of this somewhere, it seems like the kind of thing we'd want to track (similar to e.g. the press freedom map https://rsf.org/en/ranking )

mtsr2• 7 years ago

But the proper solution for that is DNS-over-TLS and picking or running your own recursive DNS resolver.

pitaj• 7 years ago

There's a huge difference though. Regardless of what you choose, your DNS requests have to go somewhere. The alternative to sending everything encrypted to Cloudflare is sending everything in plain text to your ISP and anyone else who wants to snoop on your DNS.

lucb1e8• 7 years ago

You're going to have to explain that last bit: "and everyone else who wants to snoop"? Are you talking about someone who MITMs the connection between every subscriber and the ISP's DNS servers, e.g. intelligence agencies? Or like evil employees at the ISP? In either case, sending it plaintext to a benevolent foreign entity doesn't make it any better (Cloudflare still has employees that can be evil, and I'd rather the AIVD snoops on me than the NSA), so I guess there is some other risk you're talking about?

zzzcpan• 7 years ago

The alternative to sending everything encrypted to Cloudflare is sending everything in plain text to your ISP and anyone else who wants to snoop on your DNS.

It's not the alternative. With DoH you are sending DNS queries, IP addresses, OS information and possibly even tracking cookies to Cloudflare over an encrypted channel, but Cloudflare still makes plain text queries to authoritative DNS servers from there. While your ISP's network is actually private, sometimes even encrypted, and sending plain text queries over it to its DNS servers is almost the same as having an encrypted channel. On top of that whether you use DoH to Cloudflare or not, your ISP sitll has the ability to spy on what websites you are visiting and in fact is what an ISP typically would use for that purpose anyway, not DNS data.

m-p-3• 7 years ago

At least Pocket belongs to Mozilla.

https://en.wikipedia.org/wiki/Pocket_%28service%29

lucb1e8• 7 years ago

I thought so too but it turns out they are only owned by Mozilla as of 2017. The Pocket integration launched in 2015.

bscphil2• 7 years ago

Somehow, adding a Pocket button is bad but sending all visited websites to Cloudflare is good.

I think this is an interesting point. Given that quite a few people here on HN have problems with both of these "features", should OpenBSD be disabling them both on their builds?

AstralStorm• 7 years ago

Pocket is opt-in. You can remove or ignore the button and it will not be used.

wbl3• 7 years ago

Firefox is only making this change in the US.

lucb1e8• 7 years ago

Are they? I've not seen that mentioned anywhere.

bjoli• 7 years ago

ISPs in Sweden have been working hard at "dis-earning" my trust. Telia shared user data to torrening blackmail companies and some other ISP apparently had many of their clients get blackmails concerning their porn surfing.

Cloudflare discloses what data it logs and with whom they share it (APNIC gets properly anonymised data that can only be used for limited purposes iirc).

My ISP has a blanket "we share your data with selected partners as a way to better provide you with our services" (as has all my previous ISPs). When I have time I am hitting them and my bank with GDPR requests.

lucb1e8• 7 years ago

GDPR requests shouldn't be a lot of work, most data protection agencies provide example letters. I usually customize them a little, but it's mostly copy-paste. I guess the most laborious part is censoring and watermarking a picture/scan of your ID/passport.

dontbenebby3• 7 years ago

Does anyone know a good resource for someone who hasn't done a deep dive on networking in a while, but wants to brush up on the technicals of how DoH works?

katzeilla4• 7 years ago

How about this APNIC blog post?

https://blog.apnic.net/2018/10/12/doh-dns-over-https-explain...

aloknnikhil• 7 years ago

https://en.wikipedia.org/wiki/Zooko%27s_triangle

There have been attempts at solving this through P2P DNS resolution. But, it's just hard to store all those records locally and keep them up-to-date regularly. Perhaps, we could cache and update records for the "popular" domains regularly and reach out to Cloudflare/other DoH or DoTLS providers when the tier 1 lookup fails?

karmakaze• 7 years ago

Possible Future abuses aside, I much prefer knowing who I'm trusting Mozilla and CloudFlare with a public reputations to preserve than ISPs that make no assertions and regularly voilate privacy.

ysleepy• 7 years ago

Instead of using a different DoH server than the user set DNS servers, Firefox should test if the user supplied DNS servers support DoH and opportunistically switch over to that.

OpenBSD Disabled DoH by Default in Firefox

Related Stories