Re: Mozilla Firefox DoH to CloudFlare by default (for US users)?
On Sun, Sep 08, 2019 at 11:17:13PM +0200, Marco d'Itri wrote:
> On Sep 08, Ondřej Surý <ondrej@sury.org> wrote:
>
> > I would rather see an explicit statement. I would be very surprised
> > with Debian’s usual stance regarding the users’ privacy that we would
> > not consider this as a privacy violation, but again I am not Firefox
> > maintainer in Debian and I would rather hear from them than speculate
> > on my own.
> I think that this is a privacy enhancement, since it prevents some major
> ISPs from spying on users DNS queries. When it will be enabled in other
> countries it will prevent government-mandated (or "encouraged")
> censorship.
DoH doesn't stop ISP-based spying nor censorship. On the other hand, it
allows a new third party (Cloudflare in Mozilla's default) to do both such
spying and censorship -- something it couldn't do before.
Let's compare; by "ISP" I mean every hop on the network path.
With local DNS:
* the target server knows about you (duh!)
* the ISP can read the destination of every connection
[reading the DNS packets, reading the IP header, reading SNI header]
* the ISP can block such connections
[blocking DNS packets, blocking actual connection]
* DNSSEC forbids falsifying DNS
With DoH:
* the target server knows about you (duh!)
* the ISP can read the destination of every connection
[reading the IP header, reading SNI header]
* the ISP can block such connections
[blocking actual connection]
* Cloudflare can read the destination of every connection
[they serve the DNS...]
* Cloudflare can falsify DNS¹
* Cloudflare can block connections
[blocking or falsifying DNS response]
So currently DoH is strictly worse.
In the future, once ESNI is implemented and deployed, the ISP will lose the
possibility of distinguishing sites served from the same IP, but that helps
with some random blogs while most sensitive sites can't trust a shared
hoster. Thus, ESNI hardly helps.
> It would be a terrible signal if Debian decided to disable an
> anti-censoship feature provided by an upstream vendor.
If that feature worked, that'd would indeed be terrible. But in the current
proposal, it's a privacy violation with no clear upside. I'd thus recommend
to _not_ enable DoH in our packages.
Meow!
[1]. It would be possible to, instead of sending just the answer, to pass
the entire chain of DNSSEC signatures over the DoH link. This has been
suggested in RFC8484, but doesn't seem to be implemented by Firefox.
--
⢀⣴⠾⠻⢶⣦⠀
⣾⠁⢠⠒⠀⣿⡁ Snowflakes? Socks drawer!
⢿⡄⠘⠷⠚⠋⠀
⠈⠳⣄⠀⠀⠀⠀
Reply to: