Fenix: DNS over HTTPS

[jawadalkassim]

Why/User Benefit/User Problem

As a user i want to Protect myself while browsing the web From Man-in-the-middle attack and make sure Attackers cannot trick users into visiting a fake website by manipulating DNS responses for domains that are outside their control.

What/Requirements:

Secure DNS:
To ensure your DNS queries remain private, you should use a resolver that supports secure DNS transport such as DNS over HTTPS (DoH) or DNS over TLS (DoT).
DNSSEC:
DNSSEC allows a user, application, or recursive resolver to trust that the answer to their DNS query is what the domain owner intends it to be.
TLS 1.3 : is Supported In Firefox Fenix 👍
Encrypted SNI:
Encrypted SNI keeps the hostname private when you are visiting an Encrypted SNI enabled site on Cloudflare by concealing your browser’s requested hostname from anyone listening on the Internet.

Acceptance Criteria (how do I know when I’m done?)

Dns-over-Https option in the settings or in about:config like Fennec browser.
You can test your browser here:
https://www.cloudflare.com/ssl/encrypted-sni/

[genodeftest]

Why not use DoT instead? It is less complex and has less overhead.

[finn0]

In Firefox Android, we do have support for DoH, but there is no UI to easily configure DoH settings like Firefox Quantum, we've to configure it from about:config settings which make things harder for novice FF users; although from Android 9 pie, we've support for DoT, but using DoH has its own pros like our DNS traffic is hidden inside HTTPS traffic.

@vesta0, Do we've plans for implementing an UI for DoH configuration?

[vesta0]

@finn0 yes this is something we will be looking into later this year!

[hansoli68]

ESNI works well in latest Firefox Beta 75.0.0-beta.6

[SergeiFranco]

I would like the opposite (ability to turn off the DoT or DoH) as I pihole everything via VPN and my own VPS and I definitely do not trust cloudflare or whoever with my DNS data.

[hsaito]

As of 79.0.0 (Build #2015753875) even the ability to turn on this feature without GUI is no longer available since about:config is no longer accessible and essentially completely locked out of using this feature, which is very unfortunate :-(

[yoasif]

Launching on Chrome in 85 https://blog.chromium.org/2020/09/a-safer-and-more-private-browsing.html

[madb1lly]

Hi all,

The settings are available in about:config, so is this just a UI thing or is there more to it? I have enabled it in about:config and according to about:networking#dns it's working.

Cheers 🙂

[andrew-aitchison]

hsaito is correct; this functionality is not available in v80 as about:config is no longer available.

madb1lly: As I understand it, this bug is abiut the UI.
https://github.com/mozilla-mobile/fenix/issues/14261 is _not_ a duplicate; it is a _regression_ - please reopen it.

[hsaito]

I'm bit surprised why they've decided to disable about:config, it's a very powerful feature that makes Firefox very flexible. Some of the other tuning including enterprise trust, etc., are currently only accessible through about:config. If that's not feasible to bring back about:config for any reason., I would at least want to see prefs.js somewhere that users can edit.

[0x391F]

I'm bit surprised why they've decided to disable about:config, it's a very powerful feature that makes Firefox very flexible. Some of the other tuning including enterprise trust, etc., are currently only accessible through about:config. If that's not feasible to bring back about:config for any reason., I would at least want to see prefs.js somewhere that users can edit.

Yeah, I'm also couldn't understand why they dicide to disable about:config, what an awful decision!

[valenting]

I'm bit surprised why they've decided to disable about:config, it's a very powerful feature that makes Firefox very flexible. Some of the other tuning including enterprise trust, etc., are currently only accessible through about:config. If that's not feasible to bring back about:config for any reason., I would at least want to see prefs.js somewhere that users can edit.

Yeah, I'm also couldn't understand why they dicide to disable about:config, what an awful decision!

You can still use about:config on the Nightly channel.

[yoasif]

You can still use about:config on the Nightly channel.

Or beta, if you prefer less possible breakage. :smile:

[0x391F]

You can still use about:config on the Nightly channel.

Or beta, if you prefer less possible breakage. 😄

Hmm... How about stable release? Will about:config still exist?

[cadeyrn]

see also https://bugzilla.mozilla.org/show_bug.cgi?id=1664878

[minutesinch]

cool

[lordgurke]

If you roll this out, please make it an optional Opt-In and not an Opt-Out feature!
I'm more concerned about privacy with using DoH with Cloudflare or Google as with using my provider's regular DNS (Germany has more strict rules about privacy as Cloudflare or Google could offer)

[andreicristianpetcu]

@lordgurke Mozilla made it opt-out for US and opt-in for everybody else. US ISPs are really bad with privacy. It's looking into adding more DoH providers. Currently nextdns is an option on desktop. https://wiki.mozilla.org/Security/DOH-resolver-policy

[sheikh-azharuddin]

There must be a UI option to configure secure dns or dns resolver like other chromium browser..
Esni feature is removed from about:config in latest nightly....not sure why😡😒

[valenting]

ESNI has been deprecated in favour of ECH: https://blog.cloudflare.com/encrypted-client-hello/

[sheikh-azharuddin]

ESNI has been deprecated in favour of ECH: https://blog.cloudflare.com/encrypted-client-hello/

Thanks for the info... As per article the feature is still in testing and not ready to be deployed.. It also says esni will be supported by cloudflare till ech is ready.. So can you please enable the feature again till ech is fully ready?

[valenting]

This issue is not the proper place for these discussions.
https://bugzilla.mozilla.org/show_bug.cgi?id=1667743