Mozilla just upped its security game by introducing two new features to their Firefox browser that they call “DNS over HTTPs” (DoH) and “Trusted Recursive Resolver” (TRR). According to Mozilla, this is an attempt on their part to enhance security. They want to make one of the oldest parts of the internet architecture- the DNS- more private and safe. This will be done by encrypting DNS queries and by testing a service that keeps DNS providers from collecting and sharing users browsing history. But internet security geeks far from agree to this claim made by Mozilla.
DoH and TRR explained
A DNS converts a computer’s domain name into an IP address. This means that when you enter the domain of a particular website in your browser, a request is automatically sent to the DNS server that you have configured. The DNS server then looks up this domain name and returns an IP address for your browser to connect to. However, this DNS traffic is unencrypted and shared with multiple parties, making data vulnerable to capture and spy on. Enter Mozilla with two new updates to save the day.
The DNS over HTTPS (DoH) protocol encrypts DNS requests and responses.DNS requests sent to the DoH cloud server are encrypted while old style DNS requests are not protected.
The next thing up Mozilla’s alley is building a default configuration for DoH servers that puts privacy first- also known as the Trusted Recursive Resolver (TRR). With Trusted Recursive Resolver (TRR) turned on as default, any DNS changes that a Firefox user configured in the network will be overridden.
Mozilla has partnered up with Cloudflare after agreeing to a very strong privacy policy that protects users data.
Why security Geeks don’t prefer Mozilla’s DNS updates?
Even though Mozilla has made an attempt to transport requests over https- thus encrypting the data- the main concern was that the DNS servers used are local and hence the parties that spy on you will, well, also be local! Adding to this, while browsing with Firefox, Cloudflare will can read everyone’s DNS requests. This is because Mozilla has partnered up with Cloudflare, and will resolve the domain names from the application itself via a DNS server from Cloudflare based in the United States. Now this itself poses as a threat since Cloudflare is a third party bearer and we all know the consequences of having a third party interfere with our data and network.
Despite the assurance that Cloudflare has signed a “pro-user privacy policy” that deletes all personally identifiable data within 24 hours, you can never say what will be done with your data. After the Cambridge analytica scandal- nothing virtual can be trusted.
Here’s a small overview of what can go wrong because of the TRR.
TRR fully disables anonymity. Before Mozilla implemented this change, the DNS resolution was local and could be attacked. However, with Mozilla’s change, all DNS requests are seen by Cloudflare and in turn also by any government agency that has legal right to request data from Cloudflare. So in short, any (US) government agency can basically trace you down if you have information to spill or benefit them.
So to save everyone the trouble, let’s explore what you can do with the situation. It’s simple- turn TRR off!
Hackernews users suggest the following workaround:
Enter about:config in the address bar
- Search for network.trr
- Set network.trr.mode = 5 to completely disable it
If you want to explore more about mode 5, head over to mozilla.org.
You can Change network.trr.mode to 2 to enable DoH. This will try and use. DoH but will fallback to insecure DNS under some circumstances like captive portals. (Use mode 5 to disable DoH under all circumstances.) The other modes are described on usejournal.com
You may be surprised at how such a simple update can fuel so much discussion. It all comes down to the pitfalls of blind trusting a third party service or being your own boss and switching the TRR off. Whose side are you on?
To know more about this update, head over to Mozilla’s Blog.
Read next-
Firefox Nightly browser: Debugging your app is now fun with Mozilla’s new ‘time travel’ feature
Mozilla is building a bridge between Rust and JavaScript
Firefox has made a password manager for your iPhone
