<story><title>Firefox 83 introduces HTTPS-Only Mode</title><url>https://blog.mozilla.org/security/2020/11/17/firefox-83-introduces-https-only-mode/</url></story><parent_chain><item><author>ignoramous</author><text>&amp;gt; &lt;i&gt;I want my OS to do DNS - including DOH, not my browser.&lt;/i&gt;&lt;p&gt;The cat is out the bag, so to speak. I foresee a lot of adware, spyware, and malware leveraging DoH now to evade just about every DNS-based monitoring&amp;#x2F;blocking&amp;#x2F;provisioning solutions.&lt;p&gt;Anyway, the right layer to monitor for Internet traffic has always been the IP layer (VPNs notwithstanding).</text></item><item><author>iso1631</author><text>I want my OS to do DNS - including DOH, not my browser. I want a single source for my DNS&lt;p&gt;I want my network to tell me a DNS server to use. As I own my computer I can override that, but much of the time I want to use the network provided DNS server.</text></item><item><author>jchw</author><text>I’m surprised at the negative knee-jerk reaction. I actually love this idea immediately. It encapsulates something I kind of already wanted when using HTTPS Everywhere.&lt;p&gt;This doesn’t guarantee the transport is end-to-end secure; I’m sure plenty will strip the encryption at an LB and then possibly send it back over the internet. But, I think it’s a good addition nevertheless. Here’s to hoping for more DoH and encrypted SNI adoption as well. No good reason to leave anything unencrypted if it doesn&amp;#x27;t have to be.&lt;p&gt;(I’m less happy with Firefox’s approach to DoH rollout, but I’m still glad to see DoH gaining some traction. Let’s hope the end result is worth it...)</text></item></parent_chain><comment><author>akerl_</author><text>This has always felt like a strange concern to me. It’s a bit like refusing to have gloves in your house, so that a burglar can’t borrow your gloves to avoid leaving fingerprints.&lt;p&gt;Adware, spyware, and malware has always had the ability to avoid system DNS. At its most basic, they could hardcode lists of IPs into their malicious code. At its most complex, the same building blocks that DoH&amp;#x2F;DoT use were available to them: they could build similar tools that tunnel over HTTPS&amp;#x2F;SSH&amp;#x2F;etc, whichever protocol they felt was least conspicuous on their target system. Drop a list of hostnames into a pastebin post, tell your malware to check the list for updates, profit.&lt;p&gt;DoH in Firefox simply makes the above issue harder to ignore. Before this, an enterprise or individual sysadmin could implement DNS inspection at the border, see logs showing their users browsing naughty websites, and feel like they’d made progress. But they’d always be blind to attackers (or nefarious users) who just didn’t bother using the stock DNS offering to bootstrap their hijinks. Detecting that has always required device-level monitoring or further MITM of traffic; learning about DoH makes that more obvious to sysadmins, but it doesn’t materially change what adversaries were able to do already.</text></comment>
<story><title>Firefox 83 introduces HTTPS-Only Mode</title><url>https://blog.mozilla.org/security/2020/11/17/firefox-83-introduces-https-only-mode/</url></story><parent_chain><item><author>ignoramous</author><text>&amp;gt; &lt;i&gt;I want my OS to do DNS - including DOH, not my browser.&lt;/i&gt;&lt;p&gt;The cat is out the bag, so to speak. I foresee a lot of adware, spyware, and malware leveraging DoH now to evade just about every DNS-based monitoring&amp;#x2F;blocking&amp;#x2F;provisioning solutions.&lt;p&gt;Anyway, the right layer to monitor for Internet traffic has always been the IP layer (VPNs notwithstanding).</text></item><item><author>iso1631</author><text>I want my OS to do DNS - including DOH, not my browser. I want a single source for my DNS&lt;p&gt;I want my network to tell me a DNS server to use. As I own my computer I can override that, but much of the time I want to use the network provided DNS server.</text></item><item><author>jchw</author><text>I’m surprised at the negative knee-jerk reaction. I actually love this idea immediately. It encapsulates something I kind of already wanted when using HTTPS Everywhere.&lt;p&gt;This doesn’t guarantee the transport is end-to-end secure; I’m sure plenty will strip the encryption at an LB and then possibly send it back over the internet. But, I think it’s a good addition nevertheless. Here’s to hoping for more DoH and encrypted SNI adoption as well. No good reason to leave anything unencrypted if it doesn&amp;#x27;t have to be.&lt;p&gt;(I’m less happy with Firefox’s approach to DoH rollout, but I’m still glad to see DoH gaining some traction. Let’s hope the end result is worth it...)</text></item></parent_chain><comment><author>2ion</author><text>&amp;gt; The cat is out the bag, so to speak. I foresee a lot of adware, spyware, and malware leveraging DoH now to evade just about every DNS-based monitoring&amp;#x2F;blocking&amp;#x2F;provisioning solutions.&lt;p&gt;But tunnelling X in Y is not new at all and has a long tradition (even in regular protocol design). Is this really a shift waiting to happen in malware? As I would think, this has been available all along. Except for browser-based malware.</text></comment>