Talk about the fox guarding the hen house. Comcast to handle DNS-over-HTTPS for Firefox-using subscribers Comcast has agreed to be the first home broadband internet provider to handle secure DNS-over-HTTPS queries for Firefox browser users in the US, Mozilla has announced. This means the ISP, which has joined Moz's Trusted Recursive Resolver (TRR) Program, will perform domain-name-to-IP-address lookups for subscribers using …
It's like musical chairs. Trying to figure out which browser you trust, and then which ISP and which DNS provider.
I'll just use whatever Jared uses. It must be secure and have multiple exit points in Moscow and St. Petersburg. With some undisclosed hops to Israel and China. Damn, my latency is really g.r..o...w...i.....n.....
No, Tor routes DNS through Tor. Your VPN will work as usual. But Firefox, if you use the default and are on Comcast's broadband network, will send its DNS via Comcast over HTTPS.
Bear in mind most or many subscribers send their plain-text DNS via Comcast anyway, due to their cable modem's DHCP setup, so for them this is no change except it's via HTTPS and Moz has made Comcast swear it'll be nice.
In a way, DNS-over-HTTPS was an opportunity to shield DNS lookups and route them where you want, but instead, yeah, nah, Comcast will just handle it anyway.
C.
So at best, a no-op, and at worst, a false sense of security.
If you're using ISP resolver(s) anyway, who are you hiding your DNS queries from using DoH?
In any case, applications like Web browsers shouldn't be making their own name resolution plans; that's a site-based setting and apps should use the OS's setup (including proxy setup). Neither should 'devices' be hardcoded with 8.8.8.8 for DNS. That's how leaks happen.
So at best, a no-op, and at worst, a false sense of security.
also breaking dns, e.g. dns load balancing or perd hacks, local blacklists etc.
dns/https is a powergrab, as soon as mozilla made it acceptable Google do it. so most of the world just get another wall around their Internet and a single point of contact for your local cops.
OK, so if I have explicitly set 1.1.1.1 as my DNS server, will I have to change that, or is it simply a matter of telling Firefox to just leave it alone? Or will having Comcast as my provider under this new scheme allow them to snoop it anyway?
For what end?
In this example, Comcast can inspect all your UDP/53 traffic coming out of your home which contains all your questions.
Sure, might be a bit harder than correlating some DNS logs and it (shouldn't) allow them to choose one answer over another... but Comcast is running DPI throughout their environment, so let's consider it a trivial matter.
The correct answer to this is to look no further than DoT.
I might add that DoH (and DoT) isn't the panacea that everyone is talking about. Pure opaqueness (outside of the company that's providing that DoH infrastructure) for DoH and DoT requires TLS 1.3, Encrypted SNI and DNSSEC to be supported by both ends of each query/connection. We're still a long way from that, and that seems like a lot of potential weak links in each request.
You know that Chrome/Chromium also uses DoH, and will automatically send traffic to your ISP (eg. Comcast) if they support DoH too? I understand Windows itself will also support DoH at the operating-system level, in a similar manner to Chrone.
Firefox is the only one that is making DNS providers agree to privacy policies before sending DNS traffic to them.
So what browser are you going to recommend to normal people?
ISPs have plenty of information on you without DNS. DNS is just a cherry on the top that puts a name to an IP (which isn't a PTR RR). They record every single data flow in and out of your home. They know the IP you're going to, how much data is transiting that flow, what AS you're communicating to and over what port and packet type (6 or 17 most likely) that flow is communicating over.
With that information, your ISP can infer the places your going based on the IP(s) that other ISP customers are getting from unprotected DNS queries.
And with a bit of inspection, it is trivial to know precisely where you're going with a little packet inspection of the TLS ClientHello packet and the bit of it called "SNI" (Server Name Indication). This is a critical piece of the TLS protocol that allows for more one secured FQDN to exist on the same IPv4 address and the website FQDN is listed in plaintext. I don't know if this is a thing for IPv6 hosted sites.
Fortunately, this glaring hole was sorted in TLS1.3 with the creation of ESNI (E=encrypted). But I'm sure all the firewall and security appliances manufacturers out there are looking for ways to re-filter corporate comms. Maybe they'll just block "_esni.FQDN" queries.
Hopefully TLS1.3 will be adapted faster than IPv6. But it does seem to have almost as many moving parts and fall-back processes to provide continuity.
is going to play nice and follow the DNS privacy program's rules.
Yeah. Of course they are. No megacorp has ever said that and done the opposite. No-sir-ee.
[Imagines Comcast as a stereotypical evil moustache-twirling villain] Yes, of course, this information is completely safe with us and will never be abused for corporate or personal gain. You can trust us.
I get all the arguments for DoH but the more I read the more I’m thinking what is the f’ing point?!
If you want genuinely secure DNS then build or find a secure service. However big a bow you stick on it, DoH is NOT such a service - it’s utter bollocks that has been and will continue to be bastardised by the tech industry to circumvent any perceived “security” it ever had (which, in practical terms, is fuck-all)
with DoH only you and Comcast (and whoever they flog the information to) know the content of your request, with plain old DNS anyone can see whats in the request anywhere between you and comcast
This is the difference, its slight, but better ...
DoT would also serve this purpose and allow DNS traffic to be treated diffently
But as said before DoT or DoH is only one part of securing DNS, you still need to sort the other bits to make the whole lot worth while.
This announcement hasn't changed anything. You can continue to use whatever you're using now. Mozilla and Comcast aren't forcing you to use DoH.
Whatever you use, at least one entity will be looking at your DNS traffic, your only choice is to pick which entity that will be.
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2024
