A story on the Ungleich blog claims that Mozilla integrating two new DNS related security and privacy features into Firefox is dangerous.

The two features discussed in the opinion piece, DNS over HTTPS and Trusted Recursive Resolver are available in Nightly builds of the web browser currently.

We talked about DNS over HTTPS when Mozilla revealed it to the public back in March 2018 and published a guide to enable DNS over HTTPS in Firefox.

DNS is used to convert host names and domain names to IP addresses. The request is sent to a server which returns the IP address so that the connection can be established.

Firefox uses the default system DNS service by default which often is provided by the Internet Service Provider unless it has been changed by the user or an administrator.

Img

With DNS over HTTPS and Trusted Recursive Resolver enabled, Firefox would use the DNS service configured in the browser and not the one on the system anymore.

The author of the article identified two core issues with the implementation:

1. That the system is not opt-in but opt-out.
2. That a third-party, in the case of the current implementation Cloudflare, gets access to all DNS requests of all Firefox users (based on 1)

While it is certainly true that Mozilla would like to enable the functionality for all of its users eventually, it is not the case right now.

The feature is only available in Firefox Nightly at the time of writing. Nightly is a development version of Firefox that gets multiple updates every week; it is not intended for production environments and features that land in Nightly may or may not land in Firefox Stable.

It is true that Mozilla runs a Shield study but it is opt-in according to Mozilla. It is possible that the whole system won't be opt-in when (if) it is launched in Firefox Stable.

Mozilla signed a deal with Cloudflare for the test. Cloudflare agreed to even stronger privacy terms. There is no indication that Cloudflare will be the sole provider (or a provider at all) that Mozilla works with when it is launched in Firefox Stable.

If that would be the case, it would certainly be problematic from several points of view:

• Single point of failure: if Cloudflare goes down, down goes the ability to browse the Internet.
• Cloudflare is a U.S. company and a third-party.

Closing Words

Nightly is not Firefox Stable and it should be clear that Nightly's main purpose is to test new features and changes. While it may be possible at times to look at features that Mozilla plans to move to Firefox Stable, it is sometimes not that easy and it appears that this is the case with DNS over HTTPS and Mozilla's test that it run on the Nightly channel.

It would certainly be an issue if Mozilla decided to include the feature in Firefox Stable and make it opt-out and use Cloudflare as the sole company to provide DNS lookups. I think that it is very unlikely that this is going to happen as it would open a can of worms.

It is already possible to run custom DNS over HTTPS servers and Firefox's current implementation allows custom addresses to be used.

In other words: it is too early to come to a conclusion.