<story><title>Mozilla’s DNS over HTTPs</title><url>https://blog.mozilla.org/netpolicy/2020/02/25/the-facts-mozillas-dns-over-https-doh/</url></story><parent_chain><item><author>badrabbit</author><text>Your ISP is literally selling this information right now in the US. What are you even talking about? Use google if you don&amp;#x27;t like CF, or just disable it!&lt;p&gt;Do a little threat modeling here please. Let&amp;#x27;s say CF sells this data, what do they know about you other than your IP and the sites you visit? While your ISP,employer,school,etc... Can tie that activity to you as a person. Being compelled legally? I did not know privacy meant breaking laws, suddenly law enforcement can&amp;#x27;t do the same thing with your ISP dns?&lt;p&gt;This is not adding a new party that can surveil you, this is reducing risk by  separating who can see your DNS from who can see your traffic. The idea is to have eSNI ubiquity to where TLS traffic will conceal the sites you visit while DoH will conceal the traffic metadata.  Oh, and beauty of DoH: you can run it through a web proxy, and if you have alot of users behind a NAT it becomes very hard to pin point which actual machine generated the DNS lookup.</text></item><item><author>nullc</author><text>I&amp;#x27;m so sad to see Mozilla move forward with this massive attack on user privacy.&lt;p&gt;Firefox DoH is snake oil, plain and simple.  It sends all the users DNS queries to Cloudflare, adding a new party which can surveil the user&amp;#x27;s traffic (and can be legally compelled to do so and not disclose this fact)-- providing a convenient choke point to save spies and hackers the trouble and exposure of extracting the data from tens of thousands of individual ISPs.&lt;p&gt;Simultaneously, it does not protect the user from monitoring by their ISP or parties situated there because the user&amp;#x27;s destination IPs remain unencrypted, as well as the hostnames via SNI (for cases of shared hosting, e.g. on cloudflare, where the IP alone wouldn&amp;#x27;t be enough).&lt;p&gt;At the moment you can disable this across your whole lan by blocking traffic to 104.16.248.249, 104.16.249.249, 2606:4700::6810:f8f9, and 2606:4700::6810:f9f9 and by DNS blackholing use-application-dns.net and cloudflare-dns.com.&lt;p&gt;iptables -t raw -A PREROUTING -d 104.16.248.249 -j DROP&lt;p&gt;iptables -t raw -A PREROUTING -d 104.16.249.249 -j DROP&lt;p&gt;ip6tables -t raw -A PREROUTING -d 2606:4700::6810:f8f9 -j DROP&lt;p&gt;ip6tables -t raw -A PREROUTING -d 2606:4700::6810:f9f9 -j DROP&lt;p&gt;And if you&amp;#x27;re using bind:&lt;p&gt;zone &amp;quot;use-application-dns.net&amp;quot; {
        type master;
        file &amp;quot;&amp;#x2F;etc&amp;#x2F;bind&amp;#x2F;db.empty&amp;quot;;
};&lt;p&gt;zone &amp;quot;cloudflare-dns.com&amp;quot; {
       type master;
       file &amp;quot;&amp;#x2F;etc&amp;#x2F;bind&amp;#x2F;db.empty&amp;quot;;
};&lt;p&gt;Or unbound:&lt;p&gt;local-zone: &amp;quot;use-application-dns.net&amp;quot; static&lt;p&gt;local-zone: &amp;quot;cloudflare-dns.com&amp;quot; static&lt;p&gt;But there is no guarantee that these mitigations will continue to work.&lt;p&gt;[Edit: Aside, this comment and many&amp;#x2F;most(?) comments on this thread were moved from a more recent thread with a headline &amp;quot;Firefox turns on DoH as default for US users&amp;quot;.  The new title which omits the on-as-default, is kinda burying the lead.]</text></item></parent_chain><comment><author>fefe23</author><text>Sorry for channeling the dude here but that is just, like your opinion man.&lt;p&gt;I think many of the critical voices now are coming from the EU. We have data protection laws. The ISP can&amp;#x27;t just sell browsing data. That has been illegal since before we had data protection laws, that is actually legally the same as opening other people&amp;#x27;s letters and reading them. So ... different threat model over here.&lt;p&gt;I am always using the US-EN Firefox version because frankly why would I use translated software when I can understand and use the original.&lt;p&gt;I hope you can see how it might be of concert to me whether Mozilla decides to give my browsing data to Cloudflare, whom I have about as much reason to trust as GCHQ or the NSA.</text></comment>
<story><title>Mozilla’s DNS over HTTPs</title><url>https://blog.mozilla.org/netpolicy/2020/02/25/the-facts-mozillas-dns-over-https-doh/</url></story><parent_chain><item><author>badrabbit</author><text>Your ISP is literally selling this information right now in the US. What are you even talking about? Use google if you don&amp;#x27;t like CF, or just disable it!&lt;p&gt;Do a little threat modeling here please. Let&amp;#x27;s say CF sells this data, what do they know about you other than your IP and the sites you visit? While your ISP,employer,school,etc... Can tie that activity to you as a person. Being compelled legally? I did not know privacy meant breaking laws, suddenly law enforcement can&amp;#x27;t do the same thing with your ISP dns?&lt;p&gt;This is not adding a new party that can surveil you, this is reducing risk by  separating who can see your DNS from who can see your traffic. The idea is to have eSNI ubiquity to where TLS traffic will conceal the sites you visit while DoH will conceal the traffic metadata.  Oh, and beauty of DoH: you can run it through a web proxy, and if you have alot of users behind a NAT it becomes very hard to pin point which actual machine generated the DNS lookup.</text></item><item><author>nullc</author><text>I&amp;#x27;m so sad to see Mozilla move forward with this massive attack on user privacy.&lt;p&gt;Firefox DoH is snake oil, plain and simple.  It sends all the users DNS queries to Cloudflare, adding a new party which can surveil the user&amp;#x27;s traffic (and can be legally compelled to do so and not disclose this fact)-- providing a convenient choke point to save spies and hackers the trouble and exposure of extracting the data from tens of thousands of individual ISPs.&lt;p&gt;Simultaneously, it does not protect the user from monitoring by their ISP or parties situated there because the user&amp;#x27;s destination IPs remain unencrypted, as well as the hostnames via SNI (for cases of shared hosting, e.g. on cloudflare, where the IP alone wouldn&amp;#x27;t be enough).&lt;p&gt;At the moment you can disable this across your whole lan by blocking traffic to 104.16.248.249, 104.16.249.249, 2606:4700::6810:f8f9, and 2606:4700::6810:f9f9 and by DNS blackholing use-application-dns.net and cloudflare-dns.com.&lt;p&gt;iptables -t raw -A PREROUTING -d 104.16.248.249 -j DROP&lt;p&gt;iptables -t raw -A PREROUTING -d 104.16.249.249 -j DROP&lt;p&gt;ip6tables -t raw -A PREROUTING -d 2606:4700::6810:f8f9 -j DROP&lt;p&gt;ip6tables -t raw -A PREROUTING -d 2606:4700::6810:f9f9 -j DROP&lt;p&gt;And if you&amp;#x27;re using bind:&lt;p&gt;zone &amp;quot;use-application-dns.net&amp;quot; {
        type master;
        file &amp;quot;&amp;#x2F;etc&amp;#x2F;bind&amp;#x2F;db.empty&amp;quot;;
};&lt;p&gt;zone &amp;quot;cloudflare-dns.com&amp;quot; {
       type master;
       file &amp;quot;&amp;#x2F;etc&amp;#x2F;bind&amp;#x2F;db.empty&amp;quot;;
};&lt;p&gt;Or unbound:&lt;p&gt;local-zone: &amp;quot;use-application-dns.net&amp;quot; static&lt;p&gt;local-zone: &amp;quot;cloudflare-dns.com&amp;quot; static&lt;p&gt;But there is no guarantee that these mitigations will continue to work.&lt;p&gt;[Edit: Aside, this comment and many&amp;#x2F;most(?) comments on this thread were moved from a more recent thread with a headline &amp;quot;Firefox turns on DoH as default for US users&amp;quot;.  The new title which omits the on-as-default, is kinda burying the lead.]</text></item></parent_chain><comment><author>dang</author><text>&amp;gt; What are you even talking about?&lt;p&gt;Can you please edit swipes like that out of your comments when posting to HN? They break the site guidelines and provoke others into doing worse.&lt;p&gt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;news.ycombinator.com&amp;#x2F;newsguidelines.html&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;news.ycombinator.com&amp;#x2F;newsguidelines.html&lt;/a&gt;</text></comment>