news.volyx.in

Mozilla’s DNS over HTTPs (blog.mozilla.org)

648 points by Vinnl · 2419 days ago · 757 comments on HN

Article summary

Mozilla has enabled DNS over HTTPS (DoH) by default in Firefox for US users, aiming to close the privacy gap in the web's infrastructure. DoH encrypts DNS traffic, making it harder for third parties to intercept or tamper with users' web browsing. Mozilla has partnered with Cloudflare and NextDNS as trusted recursive resolvers, which have agreed to strong policy requirements on data handling. This move is part of Mozilla's efforts to enhance user privacy and security online.

Main themes

  • DNS over HTTPS
  • privacy and security
  • browser vs OS implementation
  • centralization and decentralization
  • ISP snooping and data collection
  • Cloudflare and data anonymization
  • ESNI and TLS 1.3
  • online privacy and security measures

What commenters say

  • Implementing DoH at the browser level is a second-best solution, as it would be better implemented at the OS level, but it's a step in the right direction.
  • Centralizing DoH to a few providers may not be more decentralized than the current ISP-based system, potentially creating new privacy concerns.
  • DoH provides a security upgrade and makes it harder for ISPs to hijack unencrypted DNS, but it may not significantly increase privacy without other measures like ESNI.
  • Some argue that DoH creates a new privacy problem by giving Cloudflare access to users' data, while others believe it's a necessary step to prevent ISP snooping and selling of browsing history.
  • The effectiveness of DoH in enhancing privacy is debated, with some arguing that it can be circumvented by ISPs and governments, while others see it as a valuable improvement.
  • The use of Cloudflare as a default DoH provider raises concerns about data collection and anonymization, with some questioning the company's ability to keep user data private.
  • DoH may not be a silver bullet for privacy, but it's a necessary step towards a more secure and private internet, and its implementation should be seen as part of a broader effort to enhance online privacy and security.