Gov't, ISP Website Blacklisting to be Less Effective

Mozilla is to make an important change to Firefox browser security. It could reduce risks for users, but has raised concerns among governments and Internet Service Providers (ISPs), as it could limit their tools for filtering and monitoring online activity.

The change has to do with a feature called DNS-over-HTTPS (DoH), and will first affect users in the US. It's already possible to enable DoH in Chrome, but it takes some technical know-how because the feature currently isn't widely used.

DoH is all to do with the DNS (Domain Name System), which is effectively the phone book of the Internet. It's what turns a website name (Infopackets.com) into an IP address. The IP address is then used to identify the location of where the web server is located, so that it can serve files (such as webpages) to the user and browser connecting to the site.

DNS Used To Blacklist Sites

DNS is a silent service that works behind the scenes.

For example, whenever a user visits a website by typing in its domain name into a web browser, a DNS server is contacted first, which then responds with the IP address for the site being looked up. With most browsers, the DNS lookup is unencrypted. That means its possible for somebody to intercept or spy on the DNS lookup requests and get some clues as to who is looking at which pages. (Source: zdnet.com)

The DNS-over-HTTPS (DoH) method works by encrypting the DNS request while in transit, in the same way data is sent to and from a secure website to a web browser, such when a user connects to their online bank. The end result of having a secure connection is either a positive or negative, depending on your viewpoint.

For example, governments won't be able to spot users visiting websites which they consider problematic. That could mean political dissidents visiting censored news sites, but could equally mean people bad people visiting sites with exploitative images of children.

Court Orders May Be Harder to Enforce

Another effect is that court orders for Internet Service Providers (ISPs) to block traffic to 'illegal' websites, such as file sharing sites that breach copyright, could be harder to enforce. Many providers currently use DNS requests as the easiest way to block access to such sites.

Mozilla says it will use a "canary domain" system which will automatically disable DNS-over-HTTPS (DoH) if it detects that the system, network, or domain is being controlled with parental locks or organization - such as a work environment which uses Windows Server to control DNS.

According to Mozilla, "This [type of fallback system] helps us in situations where the parental controls [or enterprise systems] operate on the network rather than an individual computer. If Firefox determines that our canary domain is blocked, this will indicate that opt-in parental controls [or enterprise systems] are in effect on the network, and Firefox will disable DoH automatically."

That may not satisfy everyone, as it effectively gives Mozilla control over which sites governments and Internet Service Providers can block through an otherwise blocked-DNS-at-the-ISP-level method. (Source: ispreview.co.uk)

What's Your Opinion?

Would you like DoH enabled on your browser? What types of site is it valid to block through DNS request monitoring? How should Mozilla respond to requests to switch off DoH for particular sites, thus letting Internet providers block them as normal?