• 0 Posts
  • 9 Comments
Joined 1 year ago
cake
Cake day: June 12th, 2023

help-circle



  • Sure, Firefox introduced a security feature: DNS over HTTPs. So instead if asking some DNS server that is configured on the local system, for the IP that belongs to a Domain name, am external service is asked via HTTPs.

    While this is in theory a good idea, and has some benefits, the Firefox implementation was bad:

    • the external partner was cloudflare. There where no additional informations out at that time.
    • there where no opt out option

    Users, that where forced into DNS over HTTPS could no longer resolve internal hostnames. This was a killer in office environments. And after the fix for that, everything was first submitted to cloudflare and only if cloudflare could not resolve the hostname, the local DNS server was asked, leading to potential information leaks. Also a no go for companies.

    Firefox has fixed these issues by providing privacy policies, the option to choose other DNS over HTTPS providers and the option to define what domains should never be resolved externally.

    But they lost trust in many professional environments because of that move.