6 ms·

I replied sub-thread, but adding here to give some more visibility to some of the issues DoH is causing and will cause: I work at a k12 school and I am involve

I replied sub-thread, but adding here to give some more visibility to some of the issues DoH is causing and will cause: I work at a k12 school and I am involved on many k12 IT communities. Some schools already removed Firefox from the students computers because it was being used as a "VPN" by some elementary students to access porn - at school. Guess what this VPN was? Just DNS over HTTPS. There is a fine line between protecting yourself from your ISP and local network operators that NEED to apply some security policies to their traffic. Even Google offers "Safe Search" for schools and libraries that removes porn content. Unfortunately, on our school network, we also allow BYOD (students with their own laptops and ipads), so we will have to have some strict rules to block DoH, the same way we block proxies and vpns. The only other option is going to full HTTPS MITM, forcing a root SSL cert to all computers that use our network, which is the last thing that anyone wants to do. Summary: This may lead to more HTTPS MITM or schools forbidding BYOD AND removing Firefox from their computers.

threatofrain 7y ago
Ultimately we cannot secure content without being able to look at it (encryption is the problem). We need to be able to look at what the kids are looking at if we want to control what information gets to them. DNS is a band-aid solution with side effects.
- nykolasz 7y ago
  Band-aid solution that worked pretty well. Very cheap to implement, widely supported and used by many schools. Our student's data was still private (no emails or passwords being decrypted) and we did the filtering only based on the domain name. It also didn't require an expensive appliance that would be need if did the filtering based on SNI.
  - rndgermandude 7y ago
    A student who really wants to see "the bad" on the internet isn't scared off by blocking some DNS/VPN/proxy traffic. This is wishful thinking. The easiest work-around for students who want to show their mates some "cool porn" is to just save it at home. Or connect to the free wifi of <random shop> in reach.
    - icebraining 7y ago
      But then it's not the school's fault.
  - deleted 7y ago
    [deleted]
  - threatofrain 7y ago
    When you allow BYOD you give up the ability to control the client, and you allow the mess of kids bringing their family computers to school, as well as this difference where other kids bring their own much-better computer.
- stirfrykitty 7y ago
  Palo Alto firewalls do decryption on the fly should you want to look at this. It can all be logged with short or long logging. Worked in your arena for 5 years. Kids are creative and crafty. We had kids getting around the MDM/DNS blocks by changing the DNS/Proxy settings in their iPads. This is not easily overcome with existing MDM solutions AND letting the iPad be usable. BYoD is a whole different animal since you cannot legally "touch" their devices, you have to implement the federally-mandated blocks at the infrastructure level. Kids can use VPNs all day and there is nothing that can be done in reality. At a previous job, believe it or not, I worked with a client with almost a zero budget who was having massive issues with malware/ads in their public space that offered free computer use. Being the budget was minimal (less and $100 to fix), I deployed two Pi-holes and taught the "admin" how to manage it. Cheap, effective, works. I set the whole thing up to fail back to the network's DNS should the Pi-holes fail. Still running almost two years later. The Pi-hole can block about any content you would like it to block with almost zero-configuration. Easy to block a single domain or with a new rule set subscription.
dooglius 7y ago
Sounds like it is working perfectly, you want a MITM and this is making that difficult.
- nykolasz 7y ago
  Quite the opposite. We don't want MITM and this may force that direction.
  - dooglius 7y ago
    Poor choice of term maybe... you want to get information about communication between endpoints without their consent.
    - captncraig 7y ago
      Well its a school. They (or their legal guardians) consent as a condition of using the network.
      - CydeWeys 7y ago
        It sounds like they have root access on the computers in question. There's plenty of options thus available to them.
        Tushon 7y ago
        The OP talked about BYOB, which rarely includes "root access" (either via a root cert for decrypting traffic or admin level access to the machine)..
        CydeWeys 7y ago
        I was referring to the machines they were preventing the installation of Firefox on. For BYOD, I don't know what you're gonna do. Many students have smartphones too (some with tethering), and you can't control what they look at on those either. Plus, even if the school could somehow magically lock everything down 100% within the confines of the school building, the students can still get access to whatever at home, or using coffeeshop WiFi, or whatever.
danarmak 7y ago
> Unfortunately, on our school network, we also allow BYOD (students with their own laptops and ipads), so we will have to have some strict rules to block DoH, the same way we block proxies and vpns. How can you block DoH without doing MITM on all outgoing HTTPS? For that matter, how can you block HTTPS based VPNs like OpenVPN? ETA: I understand you can block IP addresses of DNS resolvers that support DoH. I assumed that to make this work, Mozilla / Google / etc. would serve DoH from the same IPs as some big services, so you wouldn't be able to block DoH without blocking something like Google's homepage.
- nykolasz 7y ago
  IP-based and domain-based. We have a long list of domains/IPs used by VPN providers. Won't prevent someone from setting up its own SSH-based proxy on port 443, but covers things that are accessible and easy to use by young students (talking about elementary school on our case). Again, we are talking about a school network with young kids (under 12/13).
  - danarmak 7y ago
    If DoH is backed by e.g. Google, won't they just end up exposing DoH on the same IP addresses serving www.google.com? Similarly, what if e.g. CloudFlare expose their DoH on all their addresses? This seems like the obvious next step for them.
    - judge2020 7y ago
      +1 And Cloudflare already does expose DoH on all addresses, as long as SNI/Host header is one of the vhost hostnames. You can currently make DoH requests to cloudflare-dns.com , the "mozilla" subdomain, one.one.one.one, 1.1.1.1, and 1.0.0.1 (there may be others that i'm not aware of ).
  - judge2020 7y ago
    This would probably require new equipment (or just an update) but at that point, you could use an SNI whitelist, then drop port 443 traffic that isn't TLS. You could even drop the request when SNI is not present, in the case of encrypted SNI (if the network box has this feature).
judge2020 7y ago
I don't think there is a good solution. Yes, you own the network and think you should be technologically able to block access to certain websites (which the school has the right to do), but ISPs also "own" the network and would also be able to block access to certain websites if it were possible with DoH+eSNI. I guess a solution is MDM, but that's still getting students to install something on their device.
- ronsor 7y ago
  I would not install a school managed backdoor on my device.
  - shittyadmin 7y ago
    So your options are then: - Cry about it and hope they change the policy (they won't) - Accept using your cell data at school instead of their wifi (works, but is expensive) - Bypass it using a VM (requires moderate technical knowledge, networking skills and possibly the ability to bypass vm detection) - Reverse engineer it and crack it to behave the way you want (requires some pretty advanced technical skills) As such, the vast majority of people will just go ahead and install it. This is the problem with these sorts of applications...
    - zrm 7y ago
      Or you can have the local interface and the cellular interface up at the same time, have the default route through the local interface but have a route to your preferred DNS server through cellular. Then the only traffic you have to pay for over cellular is DNS, which is very small.
      - deleted 7y ago
        [deleted]
    - Avamander 7y ago
      Kids are clever, if one of their classmates is known to be tech-literate and (s)he's saying the school is snooping on you the amount of shadow IT will rise. Vast majority will install, but also have some other device to bypass.
floatingatoll 7y ago
Why did the schools remove Firefox rather than enforcing no-DoH in the Firefox config files (not about:config)?
- est31 7y ago
  Of course you can lock stuff via enterprise settings so that about:config entries can't be modified by local users, but that takes time to find out and test, while removing the weird non-Chrome browser that's still present mostly for inertia reasons but nowadays only gets used for evil porn is much easier.
  - close04 7y ago
    Saving time by applying a non-solution 9like removing one browser instead of treating the root cause) is not actually saving anything. You just kick the problem further down the road. Firefox prefs are documented even if not in the most user friendly way [0][1][2][3]. For the most part performing some basic hardening and other useful config on the browser takes less than a day. A person with some IT background shouldn't have too much problems doing it and it's more or less a one time thing. [0] https://dxr.mozilla.org/mozilla-release/source/modules/libpref/init/all.js https://dxr.mozilla.org/mozilla-release/source/modules/libpr... [1] https://dxr.mozilla.org/mozilla-release/source/browser/app/profile/firefox.js https://dxr.mozilla.org/mozilla-release/source/browser/app/p... [2] https://developer.mozilla.org/en-US/docs/Mozilla/Firefox/Enterprise_deployment_before_60 https://developer.mozilla.org/en-US/docs/Mozilla/Firefox/Ent... [3] https://support.mozilla.org/en-US/products/firefox-enterprise/policies-customization-enterprise/policies-overview-enterprise https://support.mozilla.org/en-US/products/firefox-enterpris...
    - simondedalus 7y ago
      no, using the nuclear option of removing the browser outright when others work is the smart, efficient option that someone who actually works in IT with limited resources would (and should) use. this stuff about finding all the right config files during "basic hardening" and having it just work is the stuff of armchair commenters and people who do IT/security on a well funded, sufficiently redundant team. assuming the latter would be the people in charge of school IT is hopelessly naive.
pwnna 7y ago
To add to this issue from a personal level: for those who use a Pihole or operate other internal services from within their own home network will now have to change the settings for _every application_ using DoH on that network. This could become a major hassle if the number of devices and owners become large. There's not even a work around for this because I do not directly manage family members' devices (nor would they want me to). I really like Firefox for they are the only real option these days. I use it and I encourage all those around me to use it. This change will require me to do a lot more manual work and likely lead to confusion over whether a service is down or not.
- deleted 7y ago
  [deleted]
- nykolasz 7y ago
  Yep. What happens when Chrome adds DoH support? And Safari? And whatever Gaming app the kids download? Suddenly it will become impossible to manage and maintain. Not even talking about the troubleshooting nightmare. DNS should be a system-level setting, not an App-level setting.
  - tlrobinson 7y ago
    How far off are we from DoH being supported by common operating systems, DHCP, etc? It would be nice if these apps could detect whether the system is using DoH and only fall back to their own DoH resolver in the case they're using "legacy" DNS.
    - coldacid 7y ago
      Honestly, all these apps shouldn't even bother detecting for DoH or not. If people want to use DoH they can set up their own local resolver and configure their network for it (and for folks on Windows, that could even be packaged third-party).
      - tlrobinson 7y ago
gruez 7y ago
Sounds like the bigger problem is that your porn filters can be circumvented with a DNS change. If you're banning DoH, you also need to ban custom hosts files.
- AndyMcConachie 7y ago
  DoH is different because it masquerades as HTTPS traffic. You can block DNS traffic sent to servers configured in custom hosts files, but you can't block DoH unless you either have a list of every DoH server in existance, or block all HTTPS traffic. That's kind of the entire point of DoH. DNS-over-TLS (DoT) provides TLS encryption for DNS traffic, but runs over port 853 so network operators can control where queries go.
  - packet_nerd 7y ago
    > You can block DNS traffic sent to servers configured in custom hosts files You're thinking of configuring a custom DNS server, which is not related to the hosts file. The hosts file replaces DNS so there would be no network traffic to block. Theoretically a kid who really wants his porn could manually add the name-to-IP entries for his favorite sites to his local hosts file, completely bypassing any DNS based filtering you might have on the network.
    - simondedalus 7y ago
      amusingly, putting enough safeguards in place that kids would do this would actually be providing some good education for kids on the path to hacking.
    - close04 7y ago
      If you want to prevent anything like this you either have strong (centralized) controls on the client side - policies hardening the client to the point where no reasonable exploitation avenue is left (no hosts file, no running portable browser, no changing settings, etc.), or strong controls on the network - proxy and make sure no matter what the client wants it goes only where it's allowed (no VPN, no DNS filter bypass, etc.). Maybe the occasional brilliant kids will find a way, good for them. But there's a limit to how much "ghetto administration" you can do without expending any resources on it and still have your measures hold after a few weeks of curious students probing at them.
drexlspivey 7y ago
So the students are advanced enough to change their firefox config but not enough to change their DNS in their computers?
- Tushon 7y ago
  There are plenty of ways to lockdown the ability to change DNS settings on your enterprise computers (you can also lockdown Firefox with the right deployment) and you can block port 53 traffic to outside your network, but you can't block DNS -> HTTPS w/o the interventions cited above.
jeroenhd 7y ago
What would removing Firefox accomplish? Why would students not just download one of the bazillion Chrome VPN addons? Or regular VPNs that they can just turn on and off? How is _removing Firefox_ a solution? What these schools need is to set up sensible group policies. Managing BYOD on a school with kids (as opposed to grown-up people whose jobs are on the line) is simply impossible.
- est31 7y ago
  I think the poster was talking about two separate schools. One which doesn't allow BYOD and tackled the problem by removing Firefox, and a second where the poster works at which does allow BYOD and therefore removing Firefox is not an option.
kodablah 7y ago
Curious, how does your school solve this with students' phones? Have y'all considered requiring mandatory monitoring apps? Or cell phone data jammers and requiring them use y'all's wifi and require a CA cert install?
- Avamander 7y ago
  Reading these comments I'm more and more disgusted really, how is it okay (to even suggest) that personal devices of kids are so invasively monitored? They deserve their internet privacy just as much as grown ups do even more so actually given their higher trust in others, if schools are scared of internet's dangers then schools should educate, not wrap kids into digital bubble wrap that will disappear when they leave school leaving them tech-illiterate and vulnerable.
  - kodablah 7y ago
    > how is it okay (to even suggest) that personal devices of kids are so invasively monitored? It isn't. Sorry my sarcasm didn't come through clear enough, but what you're saying and disagreeing with is my point.
- amalcon 7y ago
  If it becomes a problem, they'll just ban them again. Students got by just fine twenty years ago, when phones were confiscated on sight.
Avamander 7y ago
Don't worry. Soon Chrome will also implement DoH and ESNI, then you actually have to either forbid BYOD or actually start teaching students manners, how browsing porn is not okay in school context. I'm really quite annoyed by the connotation that kids should rather be helicopter-parented (by tech or by people) than actually taught what's okay and what's not. The very least the new tech provides is that any silent helicopter parenting is becoming more visible and I'm grateful for that. Kids deserve internet privacy just as much as real-life privacy.
- asark 7y ago
  I definitely don't want my six year old to be able to use their school-provided, Internet-connected iPad any way they please, with plenty of privacy. And yeah the actual solution is "don't fucking give a six year old an Internet-connected device of any sort, obviously, you idiots" but they do, so monitoring and blocking are absolutely necessary.
  - Avamander 7y ago
    The original commenter talked about BYOD though, maybe school-given devices are set-up so that they don't let kids do whatever they want. In the case of BYOD, if you're not okay with your kid having an Internet-connected device and that they're going to use it responsibly then don't give him/her one or only allow it under parental supervision. If we're carefully watching and teaching kids kids when they're handling knives or matches, why not do so with internet connected devices?
    - michaelt 7y ago
      If your child is supervised on the internet and doesn't have a tablet, and mine isn't and does, and my child showed your child stuff you disapproved of while in school, would you complain to the school? Because some parents would.
      - Avamander 7y ago
        > Because some parents would. Some parents complain about sex ed and vaccination, satisfying the lowest common denominator doesn't really work. If some kid showed actually NSF-School images, such as nudity, to other kids and it was a first time offense a warning should suffice. If it's a repeated offense then maybe the kid needs psychological help. Just as a hypothetical scenario, there's the possibility that a kid shows others a picture of for example Michelangelo's David (or similar art piece), do you think that kid should be punished for showing nudity to other kids?
deleted 7y ago
[deleted]
xorcist 7y ago
This is perhaps a stupid question without context, but doesn't every kid of the age where this kind of things is an issue carry their own smartphone nowadays? With mobile Internet?
JohnFen 7y ago
I consider DoH too dangerous to allow on my own network, so here's what I did: if you want to use HTTPS from my network, you need to install my root cert. I then proxy all HTTPS traffic to detect and drop DoH exchanges. I expect that we'll see this sort of thing more and more.
- nixgeek 7y ago
  I’d consider you installing a root onto my device far more dangerous than DoH, because how do I know you’re only dropping DoH, and not actively logging everything? I have to assume you are evil. As a consequence I would not use your network. This may also be considered success from your point-of-view.
  - JohnFen 7y ago
    That's totally fair. My network, my rules. You are not required to use my network. However, I'm not completely heartless. I also run an open WiFi AP that, although limited, is available for guests who aren't comfortable with my security measures. You can't reach the rest of my network through it, but it's there and will get you internet access.
glennpratt 7y ago
Good! IT security theater can go away or own the device, install a root cert and really filter to your hearts content. DNS filtering was always easily circumvented; a time sucking cat and mouse game at best.
apostacy 7y ago
So, it is bad that Firefox was removed? Are you saying that you think that Firefox needs to be crippled enough that school districts feel comfortable using it? The fact that it is enabling students (or anyone) to bypass restrictions is a good thing. Why don't you try looking at this from another point of view. Firefox is a powerful important tool, and I want it to continue to be so, even if it is not ideal for everyone.
zaarn 7y ago
It's entirely within the intentions of browser vendors to make blocking of content without consent of a user hard or even impossible. If the school cannot be bothered to block content properly (ie, only via DNS block) then that is their own fault. The tools exist to block on an IP level. For all computers the school owns, they SHOULD definitely do HTTPS MitM.
- yardstick 7y ago
  IP level is too coarse grained to block sites hosted on Cloudflare etc which host sites you also wish to allow access to. SNI filtering is a reasonable middle ground - it has its flaws but nowhere near invasive as full MITM filtering yet achieves most of the filtering objectives of the organisation. Ie it is “good enough”. Sadly ESNI may be the end of usefulness of this approach.
hafta 7y ago
> I replied sub-thread, but adding here to give some more visibility > to some of the issues DoH is causing and will cause: > > I work at a k12 school and I am involved on many k12 IT communities. > > Some schools already removed Firefox from the students computers > because it was being used as a "VPN" by some elementary students > to access porn - at school. Guess what this VPN was? Just DNS over HTTPS. Firefox now has enterprise support where the administrator can force all desktops to use certain Firefox settings including enabling/disabling/configuring DoH. See https://www.mozilla.org/en-US/firefox/enterprise/ https://www.mozilla.org/en-US/firefox/enterprise/ And here's a link to details for configuration DNS over HTTPs. https://github.com/mozilla/policy-templates/blob/master/README.md#dnsoverhttps https://github.com/mozilla/policy-templates/blob/master/READ... (I work at Mozilla)

threatofrain 7y ago

Ultimately we cannot secure content without being able to look at it (encryption is the problem). We need to be able to look at what the kids are looking at if we want to control what information gets to them. DNS is a band-aid solution with side effects.

nykolasz 7y ago
Band-aid solution that worked pretty well. Very cheap to implement, widely supported and used by many schools. Our student's data was still private (no emails or passwords being decrypted) and we did the filtering only based on the domain name. It also didn't require an expensive appliance that would be need if did the filtering based on SNI.
- rndgermandude 7y ago
  A student who really wants to see "the bad" on the internet isn't scared off by blocking some DNS/VPN/proxy traffic. This is wishful thinking. The easiest work-around for students who want to show their mates some "cool porn" is to just save it at home. Or connect to the free wifi of <random shop> in reach.
  - icebraining 7y ago
    But then it's not the school's fault.
- deleted 7y ago
  [deleted]
- threatofrain 7y ago
  When you allow BYOD you give up the ability to control the client, and you allow the mess of kids bringing their family computers to school, as well as this difference where other kids bring their own much-better computer.
stirfrykitty 7y ago
Palo Alto firewalls do decryption on the fly should you want to look at this. It can all be logged with short or long logging. Worked in your arena for 5 years. Kids are creative and crafty. We had kids getting around the MDM/DNS blocks by changing the DNS/Proxy settings in their iPads. This is not easily overcome with existing MDM solutions AND letting the iPad be usable. BYoD is a whole different animal since you cannot legally "touch" their devices, you have to implement the federally-mandated blocks at the infrastructure level. Kids can use VPNs all day and there is nothing that can be done in reality. At a previous job, believe it or not, I worked with a client with almost a zero budget who was having massive issues with malware/ads in their public space that offered free computer use. Being the budget was minimal (less and $100 to fix), I deployed two Pi-holes and taught the "admin" how to manage it. Cheap, effective, works. I set the whole thing up to fail back to the network's DNS should the Pi-holes fail. Still running almost two years later. The Pi-hole can block about any content you would like it to block with almost zero-configuration. Easy to block a single domain or with a new rule set subscription.

dooglius 7y ago

Sounds like it is working perfectly, you want a MITM and this is making that difficult.

nykolasz 7y ago
Quite the opposite. We don't want MITM and this may force that direction.
- dooglius 7y ago
  Poor choice of term maybe... you want to get information about communication between endpoints without their consent.
  - captncraig 7y ago
    Well its a school. They (or their legal guardians) consent as a condition of using the network.
    - CydeWeys 7y ago
      It sounds like they have root access on the computers in question. There's plenty of options thus available to them.
      - Tushon 7y ago
        The OP talked about BYOB, which rarely includes "root access" (either via a root cert for decrypting traffic or admin level access to the machine)..
        CydeWeys 7y ago
        I was referring to the machines they were preventing the installation of Firefox on. For BYOD, I don't know what you're gonna do. Many students have smartphones too (some with tethering), and you can't control what they look at on those either. Plus, even if the school could somehow magically lock everything down 100% within the confines of the school building, the students can still get access to whatever at home, or using coffeeshop WiFi, or whatever.

danarmak 7y ago

> Unfortunately, on our school network, we also allow BYOD (students with their own laptops and ipads), so we will have to have some strict rules to block DoH, the same way we block proxies and vpns. How can you block DoH without doing MITM on all outgoing HTTPS? For that matter, how can you block HTTPS based VPNs like OpenVPN? ETA: I understand you can block IP addresses of DNS resolvers that support DoH. I assumed that to make this work, Mozilla / Google / etc. would serve DoH from the same IPs as some big services, so you wouldn't be able to block DoH without blocking something like Google's homepage.

nykolasz 7y ago
IP-based and domain-based. We have a long list of domains/IPs used by VPN providers. Won't prevent someone from setting up its own SSH-based proxy on port 443, but covers things that are accessible and easy to use by young students (talking about elementary school on our case). Again, we are talking about a school network with young kids (under 12/13).
- danarmak 7y ago
  If DoH is backed by e.g. Google, won't they just end up exposing DoH on the same IP addresses serving www.google.com? Similarly, what if e.g. CloudFlare expose their DoH on all their addresses? This seems like the obvious next step for them.
  - judge2020 7y ago
    +1 And Cloudflare already does expose DoH on all addresses, as long as SNI/Host header is one of the vhost hostnames. You can currently make DoH requests to cloudflare-dns.com , the "mozilla" subdomain, one.one.one.one, 1.1.1.1, and 1.0.0.1 (there may be others that i'm not aware of ).
- judge2020 7y ago
  This would probably require new equipment (or just an update) but at that point, you could use an SNI whitelist, then drop port 443 traffic that isn't TLS. You could even drop the request when SNI is not present, in the case of encrypted SNI (if the network box has this feature).

judge2020 7y ago

I don't think there is a good solution. Yes, you own the network and think you should be technologically able to block access to certain websites (which the school has the right to do), but ISPs also "own" the network and would also be able to block access to certain websites if it were possible with DoH+eSNI. I guess a solution is MDM, but that's still getting students to install something on their device.

ronsor 7y ago
I would not install a school managed backdoor on my device.
- shittyadmin 7y ago
  So your options are then: - Cry about it and hope they change the policy (they won't) - Accept using your cell data at school instead of their wifi (works, but is expensive) - Bypass it using a VM (requires moderate technical knowledge, networking skills and possibly the ability to bypass vm detection) - Reverse engineer it and crack it to behave the way you want (requires some pretty advanced technical skills) As such, the vast majority of people will just go ahead and install it. This is the problem with these sorts of applications...
  - zrm 7y ago
    Or you can have the local interface and the cellular interface up at the same time, have the default route through the local interface but have a route to your preferred DNS server through cellular. Then the only traffic you have to pay for over cellular is DNS, which is very small.
    - deleted 7y ago
      [deleted]
  - Avamander 7y ago
    Kids are clever, if one of their classmates is known to be tech-literate and (s)he's saying the school is snooping on you the amount of shadow IT will rise. Vast majority will install, but also have some other device to bypass.

floatingatoll 7y ago

Why did the schools remove Firefox rather than enforcing no-DoH in the Firefox config files (not about:config)?

est31 7y ago
Of course you can lock stuff via enterprise settings so that about:config entries can't be modified by local users, but that takes time to find out and test, while removing the weird non-Chrome browser that's still present mostly for inertia reasons but nowadays only gets used for evil porn is much easier.
- close04 7y ago
  Saving time by applying a non-solution 9like removing one browser instead of treating the root cause) is not actually saving anything. You just kick the problem further down the road. Firefox prefs are documented even if not in the most user friendly way [0][1][2][3]. For the most part performing some basic hardening and other useful config on the browser takes less than a day. A person with some IT background shouldn't have too much problems doing it and it's more or less a one time thing. [0] https://dxr.mozilla.org/mozilla-release/source/modules/libpref/init/all.js https://dxr.mozilla.org/mozilla-release/source/modules/libpr... [1] https://dxr.mozilla.org/mozilla-release/source/browser/app/profile/firefox.js https://dxr.mozilla.org/mozilla-release/source/browser/app/p... [2] https://developer.mozilla.org/en-US/docs/Mozilla/Firefox/Enterprise_deployment_before_60 https://developer.mozilla.org/en-US/docs/Mozilla/Firefox/Ent... [3] https://support.mozilla.org/en-US/products/firefox-enterprise/policies-customization-enterprise/policies-overview-enterprise https://support.mozilla.org/en-US/products/firefox-enterpris...
  - simondedalus 7y ago
    no, using the nuclear option of removing the browser outright when others work is the smart, efficient option that someone who actually works in IT with limited resources would (and should) use. this stuff about finding all the right config files during "basic hardening" and having it just work is the stuff of armchair commenters and people who do IT/security on a well funded, sufficiently redundant team. assuming the latter would be the people in charge of school IT is hopelessly naive.

pwnna 7y ago

To add to this issue from a personal level: for those who use a Pihole or operate other internal services from within their own home network will now have to change the settings for _every application_ using DoH on that network. This could become a major hassle if the number of devices and owners become large. There's not even a work around for this because I do not directly manage family members' devices (nor would they want me to). I really like Firefox for they are the only real option these days. I use it and I encourage all those around me to use it. This change will require me to do a lot more manual work and likely lead to confusion over whether a service is down or not.

deleted 7y ago
[deleted]
nykolasz 7y ago
Yep. What happens when Chrome adds DoH support? And Safari? And whatever Gaming app the kids download? Suddenly it will become impossible to manage and maintain. Not even talking about the troubleshooting nightmare. DNS should be a system-level setting, not an App-level setting.
- tlrobinson 7y ago
  How far off are we from DoH being supported by common operating systems, DHCP, etc? It would be nice if these apps could detect whether the system is using DoH and only fall back to their own DoH resolver in the case they're using "legacy" DNS.
  - coldacid 7y ago
    Honestly, all these apps shouldn't even bother detecting for DoH or not. If people want to use DoH they can set up their own local resolver and configure their network for it (and for folks on Windows, that could even be packaged third-party).
    - tlrobinson 7y ago

gruez 7y ago

Sounds like the bigger problem is that your porn filters can be circumvented with a DNS change. If you're banning DoH, you also need to ban custom hosts files.

AndyMcConachie 7y ago
DoH is different because it masquerades as HTTPS traffic. You can block DNS traffic sent to servers configured in custom hosts files, but you can't block DoH unless you either have a list of every DoH server in existance, or block all HTTPS traffic. That's kind of the entire point of DoH. DNS-over-TLS (DoT) provides TLS encryption for DNS traffic, but runs over port 853 so network operators can control where queries go.
- packet_nerd 7y ago
  > You can block DNS traffic sent to servers configured in custom hosts files You're thinking of configuring a custom DNS server, which is not related to the hosts file. The hosts file replaces DNS so there would be no network traffic to block. Theoretically a kid who really wants his porn could manually add the name-to-IP entries for his favorite sites to his local hosts file, completely bypassing any DNS based filtering you might have on the network.
  - simondedalus 7y ago
    amusingly, putting enough safeguards in place that kids would do this would actually be providing some good education for kids on the path to hacking.
  - close04 7y ago
    If you want to prevent anything like this you either have strong (centralized) controls on the client side - policies hardening the client to the point where no reasonable exploitation avenue is left (no hosts file, no running portable browser, no changing settings, etc.), or strong controls on the network - proxy and make sure no matter what the client wants it goes only where it's allowed (no VPN, no DNS filter bypass, etc.). Maybe the occasional brilliant kids will find a way, good for them. But there's a limit to how much "ghetto administration" you can do without expending any resources on it and still have your measures hold after a few weeks of curious students probing at them.

drexlspivey 7y ago

So the students are advanced enough to change their firefox config but not enough to change their DNS in their computers?

Tushon 7y ago
There are plenty of ways to lockdown the ability to change DNS settings on your enterprise computers (you can also lockdown Firefox with the right deployment) and you can block port 53 traffic to outside your network, but you can't block DNS -> HTTPS w/o the interventions cited above.

jeroenhd 7y ago

What would removing Firefox accomplish? Why would students not just download one of the bazillion Chrome VPN addons? Or regular VPNs that they can just turn on and off? How is _removing Firefox_ a solution? What these schools need is to set up sensible group policies. Managing BYOD on a school with kids (as opposed to grown-up people whose jobs are on the line) is simply impossible.

est31 7y ago
I think the poster was talking about two separate schools. One which doesn't allow BYOD and tackled the problem by removing Firefox, and a second where the poster works at which does allow BYOD and therefore removing Firefox is not an option.

kodablah 7y ago

Curious, how does your school solve this with students' phones? Have y'all considered requiring mandatory monitoring apps? Or cell phone data jammers and requiring them use y'all's wifi and require a CA cert install?

Avamander 7y ago
Reading these comments I'm more and more disgusted really, how is it okay (to even suggest) that personal devices of kids are so invasively monitored? They deserve their internet privacy just as much as grown ups do even more so actually given their higher trust in others, if schools are scared of internet's dangers then schools should educate, not wrap kids into digital bubble wrap that will disappear when they leave school leaving them tech-illiterate and vulnerable.
- kodablah 7y ago
  > how is it okay (to even suggest) that personal devices of kids are so invasively monitored? It isn't. Sorry my sarcasm didn't come through clear enough, but what you're saying and disagreeing with is my point.
amalcon 7y ago
If it becomes a problem, they'll just ban them again. Students got by just fine twenty years ago, when phones were confiscated on sight.

Avamander 7y ago

Don't worry. Soon Chrome will also implement DoH and ESNI, then you actually have to either forbid BYOD or actually start teaching students manners, how browsing porn is not okay in school context. I'm really quite annoyed by the connotation that kids should rather be helicopter-parented (by tech or by people) than actually taught what's okay and what's not. The very least the new tech provides is that any silent helicopter parenting is becoming more visible and I'm grateful for that. Kids deserve internet privacy just as much as real-life privacy.

asark 7y ago
I definitely don't want my six year old to be able to use their school-provided, Internet-connected iPad any way they please, with plenty of privacy. And yeah the actual solution is "don't fucking give a six year old an Internet-connected device of any sort, obviously, you idiots" but they do, so monitoring and blocking are absolutely necessary.
- Avamander 7y ago
  The original commenter talked about BYOD though, maybe school-given devices are set-up so that they don't let kids do whatever they want. In the case of BYOD, if you're not okay with your kid having an Internet-connected device and that they're going to use it responsibly then don't give him/her one or only allow it under parental supervision. If we're carefully watching and teaching kids kids when they're handling knives or matches, why not do so with internet connected devices?
  - michaelt 7y ago
    If your child is supervised on the internet and doesn't have a tablet, and mine isn't and does, and my child showed your child stuff you disapproved of while in school, would you complain to the school? Because some parents would.
    - Avamander 7y ago
      > Because some parents would. Some parents complain about sex ed and vaccination, satisfying the lowest common denominator doesn't really work. If some kid showed actually NSF-School images, such as nudity, to other kids and it was a first time offense a warning should suffice. If it's a repeated offense then maybe the kid needs psychological help. Just as a hypothetical scenario, there's the possibility that a kid shows others a picture of for example Michelangelo's David (or similar art piece), do you think that kid should be punished for showing nudity to other kids?

deleted 7y ago

[deleted]

xorcist 7y ago

This is perhaps a stupid question without context, but doesn't every kid of the age where this kind of things is an issue carry their own smartphone nowadays? With mobile Internet?

JohnFen 7y ago

I consider DoH too dangerous to allow on my own network, so here's what I did: if you want to use HTTPS from my network, you need to install my root cert. I then proxy all HTTPS traffic to detect and drop DoH exchanges. I expect that we'll see this sort of thing more and more.

nixgeek 7y ago
I’d consider you installing a root onto my device far more dangerous than DoH, because how do I know you’re only dropping DoH, and not actively logging everything? I have to assume you are evil. As a consequence I would not use your network. This may also be considered success from your point-of-view.
- JohnFen 7y ago
  That's totally fair. My network, my rules. You are not required to use my network. However, I'm not completely heartless. I also run an open WiFi AP that, although limited, is available for guests who aren't comfortable with my security measures. You can't reach the rest of my network through it, but it's there and will get you internet access.

glennpratt 7y ago

Good! IT security theater can go away or own the device, install a root cert and really filter to your hearts content. DNS filtering was always easily circumvented; a time sucking cat and mouse game at best.

apostacy 7y ago

So, it is bad that Firefox was removed? Are you saying that you think that Firefox needs to be crippled enough that school districts feel comfortable using it? The fact that it is enabling students (or anyone) to bypass restrictions is a good thing. Why don't you try looking at this from another point of view. Firefox is a powerful important tool, and I want it to continue to be so, even if it is not ideal for everyone.

zaarn 7y ago

It's entirely within the intentions of browser vendors to make blocking of content without consent of a user hard or even impossible. If the school cannot be bothered to block content properly (ie, only via DNS block) then that is their own fault. The tools exist to block on an IP level. For all computers the school owns, they SHOULD definitely do HTTPS MitM.

yardstick 7y ago
IP level is too coarse grained to block sites hosted on Cloudflare etc which host sites you also wish to allow access to. SNI filtering is a reasonable middle ground - it has its flaws but nowhere near invasive as full MITM filtering yet achieves most of the filtering objectives of the organisation. Ie it is “good enough”. Sadly ESNI may be the end of usefulness of this approach.

hafta 7y ago

> I replied sub-thread, but adding here to give some more visibility > to some of the issues DoH is causing and will cause: > > I work at a k12 school and I am involved on many k12 IT communities. > > Some schools already removed Firefox from the students computers > because it was being used as a "VPN" by some elementary students > to access porn - at school. Guess what this VPN was? Just DNS over HTTPS. Firefox now has enterprise support where the administrator can force all desktops to use certain Firefox settings including enabling/disabling/configuring DoH. See https://www.mozilla.org/en-US/firefox/enterprise/ https://www.mozilla.org/en-US/firefox/enterprise/ And here's a link to details for configuration DNS over HTTPs. https://github.com/mozilla/policy-templates/blob/master/README.md#dnsoverhttps https://github.com/mozilla/policy-templates/blob/master/READ... (I work at Mozilla)