Catch up on stories from the past week (and beyond) at the Slashdot story archive

 



Forgot your password?
typodupeerror
×
Security Firefox Mozilla Network Networking Privacy The Internet IT

Security Researchers Express Concerns Over Mozilla's New DNS Resolution For Firefox (ungleich.ch) 301

With their next patch Mozilla will introduce two new features to their Firefox browser they call "DNS over HTTPs" (DoH) and Trusted Recursive Resolver (TRR). Mozilla says this is an additional feature which enables security. Researchers think otherwise. From a report: So let's get to the new Firefox feature called "Trusted Recursive Resolver" (TRR). When Mozilla turns this on by default, the DNS changes you configured in your network won't have any effect anymore. At least for browsing with Firefox, because Mozilla has partnered up with Cloudflare, and will resolve the domain names from the application itself via a DNS server from Cloudflare based in the United States. Cloudflare will then be able to read everyone's DNS requests.

From our point of view, us being security geeks, advertising this feature with slogans like "increases security" is rather misleading because in many cases the opposite is the case. While it is true that with TRR you may not expose the websites you call to a random DNS server in an untrustworthy network you don't know, it is not true that this increases security in general. It is true when you are somewhere in a network you don't know, i. e. a public WiFi network, you could automatically use the DNS server configured by the network. This could cause a security issue, because that unknown DNS server might have been compromised. In the worst case it could lead you to a phishing site pretending to be the website of your bank: as soon as you enter your personal banking information, it will be sent straight to the attackers.

But on the other hand Mozilla withholds that using their Trusted Recursive Resolver would cause a security issue in the first place for users who are indeed in a trustworthy network where they know their resolvers, or use the ISP's default one. Because sharing data or information with any third party, which is Cloudflare in this case, is a security issue itself.

This discussion has been archived. No new comments can be posted.

Security Researchers Express Concerns Over Mozilla's New DNS Resolution For Firefox

Comments Filter:
  • by cmaurand ( 768570 ) on Sunday August 05, 2018 @08:06PM (#57075464) Homepage
    I run my own local recursorsive nameservers even on my portable devices. totally not interested in using anyone's resolvers but my own. I hope they publish instructions on how to bypass the behavior.
  • by Anonymous Coward on Sunday August 05, 2018 @08:10PM (#57075474)

    Sorry I'll have to pass how Firefox these days. They are making to many decisions that really should be mine not there's. This should be a opt in if it happens at all. A lot of us use chosen DNS servers thank you very much Mozilla but no thanks.

    • by raymorris ( 2726007 ) on Sunday August 05, 2018 @10:11PM (#57075916) Journal

      > They are making to many decisions that really should be mine not there's. A lot of us use chosen DNS servers

      Like you, I would turn it off. I also recognize that 99.9% of users don't know what DNS is. So that goes to the question of "they [Firefox] are making too many decisions that should be mine, not theirs". I would say the *defaults* should be selected based on what is best for the 99% of users who can't and won't make a choice. Settings should be available for the 0.1% who will use them.

      That said, I'm not convinced that this particular choice is best for the 99% who don't know what we're talking about. That's an entirely separate question.

      • Two them CloudFlare is pwned by the NSA.
      • by gravewax ( 4772409 ) on Sunday August 05, 2018 @10:44PM (#57076000)
        It doesn't have to be black and white. Take an approach similar to Microsoft's where they show a screen on first use with all the defaults set but the ability to select your own, clueless users get to click next and keep what Mozilla thinks is best while knowledgeable users can make whatever choice that they see fit as they are being informed.
        • Yep

        • by AmiMoJo ( 196126 ) on Monday August 06, 2018 @08:21AM (#57077782) Homepage Journal

          That just trains users to blindly click "use recommended settings" all the time. Within about a week of Microsoft rolling that screen out you started seeing malware requesting permissions from the user with "use recommended settings" or "accept (recommended)". Worst of all, having gone with the recommendation the next pop-up from Windows asking them to confirm if they are really really sure also becomes a blind click-through.

          Besides which, I don't see any value in such a screen when the settings menu is two clicks away and power users are going in there anyway.

      • This would be a neat feature for the .1% as well, if you could explicitly define what service back-end provides the TRR. Then it is just a redundant failsafe DNS alternative that you can still control.

        The issue is not that there is an alternative resolver that can work even when DNS is down; the issue is that it makes a decision for you that you don't like-- specifically, the choice of who is providing the resolution services. If they give you that control too, then this "issue" disappears completely.

    • by Billly Gates ( 198444 ) on Sunday August 05, 2018 @11:04PM (#57076068) Journal

      I suppose you prefer to do yoru forwarding requests to your ISP DNS who sells your browsing information instead hu?

      FYI cloudflare's business model is to help business customers secure their connections. You can read it here [1.1.1.1] which is a plus for grandma. But if you're technical like most of us then I am sure you can disable it.

    • by jbn-o ( 555068 ) <mail@digitalcitizen.info> on Sunday August 05, 2018 @11:12PM (#57076108) Homepage

      Sorry I'll have to pass how Firefox these days. They are making to many decisions that really should be mine not there's.

      It's a shame you're reaching such a radical decision with no clear indication of how you'll achieve this desired end. The other popular browsers (Edge, Safari, Chrome, or Opera) are proprietary (nonfree software, user-subjugating software). So without more information it seems like you're likely going to choose a browser that will, ironically, give you considerably less control over your browser and you'll end up making a choice to have fewer "decisions that really should be mine not [theirs]". You're overreacting in response to something that is literally a preference change away (as far as we know now). Encrypted DNS lookups could be a very good thing, but pushing users into using a particular DNS server is bad and choosing an organization with a track record for going back on their promises (as Cloudflare is famous for doing [torrentfreak.com]) makes this decision worse.

      But regardless of the change or how easy it is to switch the behavior back to using only your preferred DNS server and never informing an unwanted third-party about your browsing, the saving grace of Firefox remains the same: Firefox is licensed such that one can make a free derivative browser (as others have done). We're all allowed to inspect the code, make changes, run the now-trusted version, and help others by distributing a derivative browser. You can't legally do any of that with other popular browsers.

      We make free software better by improving it and using the improved versions, not abandoning free software when it becomes inconvenient or undesirable. The privacy you obviously, and rightly, want to keep depends on software freedom.

      • by tepples ( 727027 )

        The other popular browsers (Edge, Safari, Chrome, or Opera) are proprietary (nonfree software, user-subjugating software).

        Chromium is free software. Or do proprietary Google Chrome and free Chromium differ specifically in a way relevant to this article? That is, do they differ in how they send DNS requests?

    • At least Firefox says openly what they're doing. Edge and Chrome close-software do not, but who knows what happens under the hood.
    • 90% people who don't even know what DNS is, and who wouldn't be able to select this security feature in the first place (since they don't understand it) do welcome the feature, unknowingly.
    • by Junta ( 36770 )

      Problem is Firefox is eager to give Cloudfare *all* the DNS traffic, and Chrome is also talking about doing the same, but to 8.8.8.8 (Google's).

      So... now what?

  • by williamyf ( 227051 ) on Sunday August 05, 2018 @08:11PM (#57075488)

    ... need this feature a lot.

    And since the Firefox developer team has a big subset of that demographic, is quite clear why this was included.

    All the rest of us, who carefully configured our DNS resolvers (or set up our own DNS servers), get screwed by default. Please tell me how to turn this off in Firefox for Mac/Android...

    All the hipster developers using wifi in starbucks and other hipster coffee shops should be thanking Mozilla right now. All the rest of us, not so much.

    PS: How does this work when one needs to go to a captive web portal in order to authenticate on the Wifi?

    • by Greyfox ( 87712 ) on Sunday August 05, 2018 @08:31PM (#57075580) Homepage Journal
      I dropped them years ago for their willingness to fuck with standard network behavior. If I put an address in, I want my browser to ask my OS to resolve it. Period. I don't want to search for the thing if it's not found. I don't want someone's re-implemented name service protocol. I certainly don't want some half-assed application written by some half-assed application developer to try to re-invent how networking works, along with all the ways we already figured out that networking could be attacked for the last four decades.
      • Not that shocking behavior. WHen you use a VPN (you do right?) the default config (of course you changed that) is to have DNS res done by the VPN server, not your computer.
    • Again, bad idea, this only helps the browser and will add a common well known attack vector, it will not help any installed applications or services making internet calls.

      Keep it separate, if you want to avoid resolving DNS over your network connection get a service/application that will curate your hosts file or act as a local personal DNS server/service itself. This way more than just your browser gets the benefits.

      keep it separate

    • If you're grandma or a hipster yes this is a good thing and it offers better performance too. Cloudflare is a company that offers protection from DDOS attacks, CDN, as well as networking security. Cloudflare's DNS guarantees privacy as well [1.1.1.1].

      If you are the slashdotter nerd then you will go into about:config and turn it off so what is the big deal.

      • Reghardless of whether Cloudflare is God or the devil, it is NOT what I want. Not what I have configured, and if I get it, then it causes me a lot of support calls from users who don't get what they paid for, It is like having Systemd bypass your settings for DNS resolve - a source of very difficult to diagnose harassment for support workers, with no warning

        This should not be done without a popup saying "Do you want me to fuck with your settings without asking?" then the person who codes it will understan

    • ... need this feature a lot.

      And since the Firefox developer team has a big subset of that demographic, is quite clear why this was included.

      This is of course complete bullshit.

      As if anyone with something better to do than snoop on the wire at Starbucks won't see destination IP, SNI or servers public key identity and have access to the exact same data DNS provides.

      What they really need is 802.1x.

    • Where do you get your DNS information for your resolvers? From your ISP? From Google? Why do you trust those people more than Cloudflare? Why do you think this ONLY works with Cloudflare?

      The DNS over HTTPs allows you to connect to any server capable of DNS relay through HTTPs. That means you can setup your mobile browser to use YOUR OWN DNS RESOLVERS in your house and it cannot be intercepted (because it's being encrypted) nor will those reading the traffic KNOW you are getting DNS over the HTTPS (because i

  • by SirAstral ( 1349985 ) on Sunday August 05, 2018 @08:15PM (#57075500)

    once again, this is a bad idea!

    browsers are not the only things using DNS, additionally, it is just one more attack vector on an already sizable surface area.

    And if FF enforces this feature... they will only risk losing market share in the browser space every time their "vision" is used to attack systems.

    • I don't understand why Mozilla thinks the browser has any business directing DNS to whoever they think it should go to. So, once this update happens, as a Firefox user, all my DNS-related browsing info goes to Cloudflare? At the moment, I'm just using my ISP's default DNS. They already know where I'm browsing. Now, both my ISP and Cloudflare know where I'm browsing. How is this better? At the moment, we can disable it, of course, but no one but Slashdot denizens might do this.

      • How is this better?

        It is not "better" for me, but this behaviour should have an interesting, unintended effect for Australian users of Firefox. Australian ISPs are, for the most part, subject to a series of court orders requiring them to serve fake IP addresses when asked for The Pirate Bay, Rarbg etc. That fake address leads a browser to a information/warning page. It is trivially circumvented for tech savvy users by not using the ISP DNS. It strikes me that this change will, at least in the short term, make Firefox au

        • For about 5 seconds, until Cloudfare configure their resolver to appear to be local to where the request originated (if they haven't already done so).

          This is just like the behaviour of Google's 8.8.8.8 resolver.

          • Might take more than 5 seconds but it will happen given the small number of targets. The existing court orders would need to be extended to to cover non-parties to the original law suits, or new suits raised with handy precedent, and the Copyright Act might need to change to cover entities other than "carriage service providers" (which may not cover Cloudflare at the moment). Nothing that money cannot buy.

          • They'll have to do that anyway, as CDNs sometimes use DNS to direct users to a content server local to the user.

      • Because they can tap the requests on the DNS resolvers and resell it. Verisign did something commercially similar by putting a wildcard at *.com instead of returning an "invalid address" response.

      • Coding for the sake of coding. The same reason Gnome is a mess along with systemd. One could also argue design by committee.

      • I don't understand why Mozilla thinks the browser has any business directing DNS to whoever they think it should go to

        I don't understand how anyone (including Firefox's design team) can think this is different from any other malware doing the same thing. Surely it is a criminal act?

    • Security issues aside this would result in some very strange behaviour on a misconfigured network:

      - Different content being served to different applications.
      - An apparent network outage for one application is transparent to the other.

  • Because if it does, I think I can overall live with it.
    • only as long as the thing you looking for is not censored by cloudflare - and even then, only the most basic censorship.
      • only as long as the thing you looking for is not censored by cloudflare

        ... or Mozilla.

      • See my own comment further down the page.

        What we really need anyway is Distributed DNS so it can't be bogarted.

        Yes, I know that's not an easy thing to ask for. But sooner or later, it will be figured out.

        In the meantime, Cloudflare's guaranteed secure and private DNS servers are the best we have, other than OpenDNS.

        Granted, it's all based on a privacy guarantee in their Terms of Service, but it's worded correctly and I trust that a lot more than I trust Google.
        • What we really need anyway is Distributed DNS so it can't be bogarted.

          Facepalm.

          the meantime, Cloudflare's guaranteed secure and private DNS servers are the best we have, other than OpenDNS.

          When cloudflare uses system to resolve names guess what ... that process itself uses insecure protocol to query root resolvers up to whoever owns the zone so claiming that cloudflare is secure is rather comical. It's actually no more secure than running your own server using default root list without a forwarder.

          Why is it even relevant whether name resolution is secure? The underlying network isn't secure. Anyone in the network path can fuck you. Heck there is a long history of those normally o

  • by bobstreo ( 1320787 ) on Sunday August 05, 2018 @08:39PM (#57075606)

    They should be allowed to do so, at the OS level.

    The summary didn't mention if this "feature" was possible to disable.

    I DO NOT want every freaking app to use a different DNS to resolve my queries.

    • by markdavis ( 642305 ) on Sunday August 05, 2018 @10:01PM (#57075880)

      >"The summary didn't mention if this "feature" was possible to disable."

      about:config
      network.trr.mode = 5 to completely disable it

      0 Off. To use operating system resolver.
      1 Race native against TRR. Do both in parallel and go with the one that returns a result first. Most likely the native one will win.
      2 First. Use TRR first, and only if the secure resolution fails use the operating system resolver.
      3 Only. Only use TRR. Never use the native (after the initial setup).
      4 Shadow. Runs the TRR resolves in parallel with the native for timing and measurements but uses only the native resolver results.
      5 Off by choice This is the same as 0 but marks it as done by choice and not done by default.

      https://blog.usejournal.com/ge... [usejournal.com]

  • Hmmm. I haven't looked at this... but it sounds like it'll break any host names I've set up locally (for development) and not published to global DNS...

  • Please tell me that this will break internal DNS for non-existent top level domains. I've recently encountered several business partners who insisted on inventing their own internal top level domains, and simply accepting that there is no HTTPS signatory for those top level domains.

  • Good Job, Mozilla, in making an unexcusable privacy-raping tool..

    Fuck off,
    Signed,
    The majority of reality, faggots.

    And I'm gay, so I can call you faggots all day long without repercussion, dick-suckers.

  • This whole so-called "security issue" ignores the fact that Cloudflare already offers its own DNS resolvers, at 1.1.1.1 and 1.0.0.1.

    AND -- this is the big point -- they guarantee that they keep no records and do not even log the traffic going through those servers.

    Frankly, I trust that a whole lot more than any promise from Google.

    And yes... as long as cloudflare continues the same policy, and live up to it, it is a heck of a lot more secure than going through some random DNS resolver you don't eve
    • https://developers.cloudflare.... [cloudflare.com]

      Eh I'll just post this link here and you can draw your own conclusions.

    • -- this is the big point -- they guarantee that they keep no records and do not even log the traffic going through those servers.

      LOL...

      Cloudflare will collect only the following information from Firefox users:
      âTimestamp
      âIP Version (IPv4 vs IPv6)
      âResolver IP address + Port the Query Originated From
      âProtocol (TCP, UDP, TLS or HTTPS)
      âQuery Name
      âQuery Type
      âQuery Class
      âQuery Rd bit set
      âQuery Do bit set
      âQuery Size Query EDNS
      âEDNS Version
      âEDNS Payload
      âEDNS Nsid
      âResponse Type (normal, timeout, blocked)
      âResponse Code
      âResponse Size
      âResponse Count
      âResponse

  • by Billly Gates ( 198444 ) on Sunday August 05, 2018 @11:01PM (#57076054) Journal

    First off your ISP guarantees they sell your browser history to advertisers and some EVEN INSERT ads into your browsing experience. Cloudflare who is behind 1.1.1.1 guarantees your privacy as well as gives you the lowest latency if you read the agreement at www.1111.com. [1.1.1.1]

    Cloudflare is used for companies that have been hacked for security as well as CDN services. Experia consulted with them after the scandal.

    • I already set my DNS servers to cloudflare (1.1.1.1) when they launched their service. Now I can use it over https so no one along the network path can snoop my dns queries. If there is a faster or more private dns service, I'd like to know about it so I can switch to it.

      https://en.wikipedia.org/wiki/... [wikipedia.org]

    • Cloudflare is an adversary and is doing its utmost to break the world wide web [notabug.org]. You can have no reasonable expectation of privacy from them, either [device5.co.uk]. Cloudflare is a MiTM attack on the web and should be treated as such. They have a track record of spreading disinformation and even messing with bug tickets of privacy projects like tor to try to make themselves look better without fixing anything.

      Your ISP should not *have* your browser history. You should be using tor [eff.org]. If your ISP can see your browsing

  • by bferrell ( 253291 ) on Sunday August 05, 2018 @11:36PM (#57076242) Homepage Journal

    zero visibility to internal DNS resolution for corporate networks

    Ham handed is the kindest thing I can say about this.

  • And if this is disabled by default why is everybody so pissed off ?
    • This is from "we know better than you" Mozilla. I bet it's enabled by default.

  • DNS is one of the few remaining services yet to be totally centralized. Assertions centralized systems (Mozilla) are more trustworthy and privacy preserving than federated ones is doublespeak.

    Mozilla is basically asserting without evidence everyone's DNS servers are untrustworthy and therefore for users own good only theirs can be trusted.

    It is not even clear what even practical theoretical benefit to the end user would be given anyone in data path can see destination address, SNI, PKI Identity and TLS ses

  • In security world, changing DNS servers being used without notifying the owner of the machine is known as "hijacking DNS".

    How on earth is Mozilla getting away with hijacking DNS?

  • Because sharing data or information with any third party, which is Cloudflare in this case, is a security issue itself.

    Exposing data to a particular party is an issue iff the security model treats that data as confidential and not intended for that party. In the current model of things, DNS queries are sent in the clear and so there is no confidentiality with respect to any party that happens to be eavesdropping.

    So then thinking for a bit, we could have some transport layer security for DNS, this would prov

"I got everybody to pay up front...then I blew up their planet." "Now why didn't I think of that?" -- Post Bros. Comics

Working...