SoylentNews is people
SoylentNews
How to Enable DNS-Over-HTTPS (DoH) in Firefox:
The DNS-over-HTTPS [(Doh)] protocol works by taking a domain name that a user has typed in their browser and sending a query to a DNS server to learn the numerical IP address of the web server that hosts that specific site.
This is how normal DNS works, too. However, DoH takes the DNS query and sends it to a DoH-compatible DNS server (resolver) via an encrypted HTTPS connection on port 443, rather than plaintext on port 53.
This way, DoH hides DNS queries inside regular HTTPS traffic, so third-party observers won't be able to sniff traffic and tell what DNS queries users have run and infer what websites they are about to access.
Further, a secondary feature of DNS-over-HTTPS is that the protocol works at the app level. Apps can come with internally hardcoded lists of DoH-compatible DNS resolvers where they can send DoH queries.
This mode of operation bypasses the default DNS settings that exist at the OS level, which, in most cases are the ones set by local internet service providers (ISPs).
This also means that apps that support DoH can effectively bypass local ISPs traffic filters and access content that may be blocked by a local telco or local government -- and a reason why DoH is currently hailed as a boon for users' privacy and security.
[...] The below step-by-step guide will show Firefox users in the UK and Firefox users all over the world how to enable the feature right now, and not wait until Mozilla enables it later down the road -- if it will ever do. There are two methods of enabling DoH support in Firefox.
The fine article then presents step-by-step instructions on two methods to enable DoH in Firefox, as well as an explanation of what the various setting values mean.
(Score: 0) by Anonymous Coward on Tuesday July 09 2019, @12:41AM
This now means assumptions you made about being secure because your /etc/resolv.conf (or windows equivalent) is controlling all non-direct IP accesses to the internet for you no longer holds true. As a result compartmentalized OSes/firewalling+proxy/etc are the only ways to secure your applications now.
As an additional concern, they mention applications hardcoding lists of urls/websites which do the dns handling for you, instead of using ones you the user specified. That means that marketing/google/facebook/etc can more easily gather and corroborate your dns queries, unlike the current system where they are normally kept at the ISP level. In addition, this doesn't help in countries with deep packet inspection, where they are already overriding the chain of authenticity in the browser in order to MITM https connections, which will result in them being able to both confirm you send a particular DNS query, as well as redirect you to a site of their choosing.
This is a huge clusterfuck all around that was not thought out at all. Reactionary projects like this are only making the Web worse, not better.