Hoping To Combat ISP Snooping, Mozilla Enables Encrypted DNS
from the encrypt-ALL-the-things! dept
Historically, like much of the internet, DNS hasn't been all that secure. That's why Mozilla last year announced it would begin testing something called "DNS over HTTPS," a significant security upgrade to DNS that encrypts and obscures your domain requests, making it more difficult (though not impossible) to see which websites a user is visiting. Obviously, this puts a bit of a wrinkle in government, telecom, or other organizational efforts to use DNS records to block and filter content, or track and sell user activity.
As a result, a lot of these folks have been throwing temper tantrums in recent weeks.
The telecom sector, which makes plenty of cash selling your daily browsing habits, have spent much of the last year trying to demonize the Google and Mozilla efforts any way they can, from insisting the move constitutes an antitrust violation on Google's part (it doesn't), to saying it's a threat to national security (it's not), to suggesting it even poses a risk to 5G deployments (nah, that's an entirely different mess). Mozilla's response to telecoms' face fanning? To first urge Congress to investigate telecom's long history of privacy abuses, then proceeding this week to enable the feature by default in the Mozilla browser.
In a blog post, Mozilla explains its thinking as such:
"At the creation of the internet, these kinds of threats to people’s privacy and security were known, but not being exploited yet. Today, we know that unencrypted DNS is not only vulnerable to spying but is being exploited, and so we are helping the internet to make the shift to more secure alternatives. We do this by performing DNS lookups in an encrypted HTTPS connection. This helps hide your browsing history from attackers on the network, helps prevent data collection by third parties on the network that ties your computer to websites you visit."
While there's a lot of overheated rhetoric about the risk of DNS over HTTPS from the likes of big telecom and government surveillance aficionados, there are some legitimate concerns about the standard from more above-board cybersecurity professionals. They'll be quick to note there's several other points at which ISPs can still engage in data surveillance and sales. They'll also argue that DNS over HTTPS really complicates life for enterprise IT managers, and in some instances encrypted DNS could derail existing cybersecurity solutions or parental control solutions.
I find DNS over HTTP unwise from a Corp security perspective for a few reasons (particularly NIDS and legacy malware detection), but this is a good explanation and I’d pay close attention to the sections on how to force-disable it as an organization if you rely on that detection. https://t.co/i2yjATPbP9 pic.twitter.com/I7bgyCMCtW
— Lesley Carhart @RSAC (@hacks4pancakes) February 25, 2020
Mozilla says it's listening to these complaints, so it's starting slowly with a gradual roll out across the US only. The organization says Firefox will disable encrypted DNS if it conflicts with parental controls. The feature will also be disabled by default in enterprise configurations. Firefox's encrypted DNS will use Cloudflare by default, though users can switch to other encrypted DNS providers manually in their browser settings. Those curious about the particulars can dig through Mozilla's FAQ here.
Thank you for reading this Techdirt post. With so many things competing for everyone’s attention these days, we really appreciate you giving us your time. We work hard every day to put quality content out there for our community.
Techdirt is one of the few remaining truly independent media outlets. We do not have a giant corporation behind us, and we rely heavily on our community to support us, in an age when advertisers are increasingly uninterested in sponsoring small, independent sites — especially a site like ours that is unwilling to pull punches in its reporting and analysis.
While other websites have resorted to paywalls, registration requirements, and increasingly annoying/intrusive advertising, we have always kept Techdirt open and available to anyone. But in order to continue doing so, we need your support. We offer a variety of ways for our readers to support us, from direct donations to special subscriptions and cool merchandise — and every little bit helps. Thank you.
–The Techdirt Team
Filed Under: browsers, dns, dns-over-https, encryption, firefox, privacy, snooping
Companies: mozilla
Reader Comments
Subscribe: RSS
View by: Time | Thread
Bonus
One bonus to using DNS over HTTPS that I haven't seen mentioned is that it's faster resolving addresses. Given all the snooping and tracking regular DNS goes through, I had significant delays on address lookups that went away when I switched to encrypted DNS.
[ link to this | view in chronology ]
Re: Bonus
I expect that's because of the caching at Cloudflare. An DNS request/reply requires only two UDP packets, setting up a TLS connection requires several roundtrips to the server and should (in theory) be slower.
If the DNS server you use has the answer cached it can directly reply. however if the answer is not cached it can take several inquiries for the DNS server to obtain the answer in a recursive lookup.
[ link to this | view in chronology ]
Re: Re: Bonus
Why wouldn't Firefox leave that connection open?
[ link to this | view in chronology ]
Re: Re: Bonus
"An DNS request/reply requires only two UDP packets, setting up a TLS connection requires several roundtrips to the server and should (in theory) be slower."
That's true...and yet I've had the same experience as JoeCool. Once i'm on my VPN ping latency and jitter both drop noticeably as compared to when i'm online outside of the tunnel.
Something is making an encrypted connection a lot faster despite going through more loops and through more servers.
[ link to this | view in chronology ]
Re: Bonus
This is simply not true. While I can't speak to why you were seeing delays, standard DNS has so many layers that cache requests for you to speed them up the next time you ask that there's zero chance doing it over HTTPS could be faster for the sole reason that you lose all those caches.
Your own router maintains a DNS cache so most common requests you make never even have to go over the internet to get resolved.
[ link to this | view in chronology ]
Re: Re: Bonus
That depends on the router and its configuration. In any case, the local cache only contains things that were looked up locally (and recently), while the DoH cache could contain things looked up by other users. If the DoH server connection is kept open, and has sufficiently low latency, there's a good chance that DoH will give a significant net improvement.
The CDNs do try to put themselves close to people, and their DoH server may be closer than a national ISP's central DNS cluster. For sites run by the same CDN it won't even have to forward the requests. Don't say "zero chance" without measuring.
[ link to this | view in chronology ]
Re: Re: Bonus
Never underestimate how incompetently run a lot of ISP's infrastructure is. DNS servers are no exception. DNS resolution can take hundreds of ms in the wild.
[ link to this | view in chronology ]
[ link to this | view in chronology ]
Re:
Have you heard of the MVP Hosts file?
http://winhelp2002.mvps.org/hosts.htm
It's a big list of advertising and malware servers that's constantly being updated. Start with that and add your own sites to the bottom. :)
[ link to this | view in chronology ]
Re:
Go to https://1.1.1.1 and look at the certificate via your browser's interface. It does, in fact, have a valid HTTPS certificate with several IP addresses as alternate names.
[ link to this | view in chronology ]
The last mile network
Telecoms don't want to give up control of DNS lookups to companies like CloudFlare because of the lucrative business of CDNs (Content Delivery Network).
The DNS lookup determines which CDN the browser uses to download the file. This allows the DNS lookup to choose a CDN in a physical location that is closer to the user to improve speeds. CloudFlare is a CDN provider and many Telecoms are also CDN providers.
While CDNs are free to the end user, they cost the telecom money when a user tries to load data found an "out of network" CDN because then the telecom will have to pay the network where the CDN is located for usage of their network. It is in the telecom's best interest to serve content from a CDN already on their network and they can generate more money by getting other people to download from their CDN too.
Large telecoms already have carrier exchange agreements in place because counting all the bytes that they each exchange would be too much work. But telecoms can strong-arm smaller companies like CloudFlare to pay more. If CloudFlare is able to control the DNS, they have leverage against the telecoms and can divert traffic to networks that offer lower rates and CloudFlare can pay less.
[ link to this | view in chronology ]
Re: The last mile network
[ link to this | view in chronology ]
Re: Re: The last mile network
If you mean DNS over HTTPS, now. Go to the FAQ page and follow the "disable DoH" steps; but when you get to the preference, enable it instead.
[ link to this | view in chronology ]
Re: Re: The last mile network
You can enable it by going into preferences->general, and clicking network setting at the bottom of that page. Enable DNS over HTTPS is at the bottom of the page that that brings up.
[ link to this | view in chronology ]
I'm confused about one point; Supposedly this is to prevent ISP snooping, but probably 99% of average internet users' account will be setup to use the ISP's own DNS servers by default. How does it prevent ISP snooping if you encrypt the connection, then ask the ISP to look up a DNS address for you?
And even if users change their DNS server to a third-party one, and the ISP can't snoop on the request, the browser is just going to turn around and ask the ISP to connect it to the address that was looked up anyway.
Unless you're using a VPN (which most average users aren't), the ISP has to know what sites you want to connect to, to you know, connect you to them.
[ link to this | view in chronology ]
Re:
When using the DNS-over-HTTPS feature you're no longer using your ISP's DNS servers. You're using DNS-over-HTTPS via mozilla.cloudflare. Your ISP no longer has any visibility into your DNS queries. It can, however, still see the IPs/hosts from which you're pulling traffic which is still pretty thorough tracking of sites visited. The only thing they can't see is failed DNS lookups.
[ link to this | view in chronology ]
Re: Re:
I should also add that they can no longer serve up their own ads for sites that do not resolve via DNS. Super annoying and most ISPs do this. I thought it was ruled illegal over a decade ago...
[ link to this | view in chronology ]
Re: Re: Re:
Are you confusing it with Verisign's Site Finder? ICANN said it wasn't allowed by their domain registry agreement, plus a lot of people blocked it via technical means, and Verisign eventually disabled it. There were some legal proceedings but no court ever ruled on it.
[ link to this | view in chronology ]
Re: Re:
It puts the public one step ahead in the arms race. DNS-based tracking is easy: a national ISP can have everyone use one server, and have it log everything. IP-based tracking will need a completely different setup: they'll need hooks to grab the metadata at every network interconnection, reduce it to a manageable amount of data, and forward it to headquarters. If they're not set up for it now, it could take a while.
CDNs work against this technique, unless the ISPs also decode the HTTPS setup to grab the hostname. But Mozilla started encrypting this last year ("encrypted SNI"). They'll know someone's connecting to Cloudflare for DNS and/or other content, but it's much harder to tell what they're doing.
[ link to this | view in chronology ]
Re: Re: Re:
At the moment, SNI is still largely unencrypted.
Encrypted SNI is still just a draft, Firefox doesn't implement the current version draft, and it is not yet supported by Apache or nginx.
At the moment, ESNI effectively only works between Firefox and Cloudflare. (I'm not sure about Chrome's status. I didn't look it up).
ESNI will eventually arrive and fix this leakage as well.
[ link to this | view in chronology ]
Re: Re: Re: Re:
If they can get that done before the ISPs can start sniffing these hostnames in response to DNS-over-HTTPS, it's still good. Then we'll need to do more about IP addresses.
[ link to this | view in chronology ]
but the dns itself can snoop. more security snake oil.
[ link to this | view in chronology ]