On April 9 Mozilla announced its plan to enable DOH by default in the Firefox browser, committing to an earlier informal description of Mozilla's plans that were outlined by Mozilla's Eric Rescorla at the end of March.
To place this announcement into a broader perspective it should be noted that the market share of Mozilla's Netscape browser, while large, is by no means dominant. The statscounter site reports a market share of 4.69% for Firefox in March 2019. This implies that these moves by Mozilla are not intrinsically all that significant in terms of the profile of the larger Internet and the average Internet user. A major concern with this announcement is that the move by the Firefox browser to make DOH the default means of DNS name resolution is a precursor for similar changes to the Chrome browser. Chrome is definitely the dominant browser in today's Internet ecosystem, with some 62.63% market share according to statscounter. If Chrome were to use a default setting that pushed all its DNS name resolution activities to a Chrome-selected DOH server then the implications for the DNS are very significant.
In APNIC's in-progress study of the use of open DNS resolvers (such as the services operated by Google, Cloudflare and Quad9, among others) the total market share of these open DNS resolvers encompasses approximately 20% of the Internet's user population, while most other users use ISP-provided DNS resolvers. If some two thirds of the Internet's user base had their DNS queries redirected to one, or even just a handful of these DOH-based DNS services, as would likely be the case were Chrome to enable DOH by default, then this would be a major change to the Internet. The open source DNS resolver effort, populated at present by ISC's Bind DNS resolver, NLNet's unbound, CZNIC's KNOT and PowerDNS, among others, would probably not survive this scale of change, and the risk is that the open DNS itself may not survive. The privacy implications are also serious. The DNS would still create a rich vein of information about each user's activities, but the parties who are privy to this information flow would change, creating potential new winners and losers in the marketplace of surveillance capitalism.
By pushing client-side DNS queries into HTTPS the Internet itself has effectively lost control of the client end of DNS, and each and every application, including the vast array of malware, can use DOH and the DNS as a command and control channel in a way that is undetectable by the client or client's network operator.
Much of today's malware containment frameworks, including DNS firewalling, are rendered useless by DOH. Whether or not the browser has DOH enabled by default, applications can generate DOH requests for DNS resolution in a manner that bypasses today's DNS-based malware containment mechanisms. As has been recently observed on a DOH-related mailing list: "Pandora's box is now open and DOH has escaped, and there seems to be little we can do about it now. The times they are a changing."
I raised the question in the previous article: "Have we now provided the private surveillance framework with a whole new trove of personal data to mine by ruthlessly exploiting the DNS in a manner that is entirely out of sight? Once the browsers and even the apps direct their name queries through encrypted channels to resolvers operated by the same browser and app providers, then have we dealt a body blow to any efforts to safeguard personal privacy on the Internet?"
Google state that: "We don't correlate or combine information from our temporary or permanent logs with any personal information that you have provided Google for other services." [https://developers.google.com/speed/public-dns/privacy].
Cloudflare are also quite explicit in this area: "Cloudflare's business has never been built around tracking users or selling advertising. We don't see personal data as an asset; we see it as a toxic asset. While we need some logging to prevent abuse and debug issues, we couldn't imagine any situation where we'd need that information longer than 24 hours. And we wanted to put our money where our mouth was, so we committed to retaining KPMG, the well-respected auditing firm, to audit our practices annually and publish a public report confirming we're doing what we said we would." [https://blog.cloudflare.com/announcing-1111/]. Engaging a third party to audit a private enterprise's claims of privacy practices seems like a good move, as without some form of visible accountability, the company's privacy policies are, ultimately, just words.
The above views do not necessarily represent the views of the Asia Pacific Network Information Centre.
GEOFF HUSTON B.Sc., M.Sc., is the Chief Scientist at APNIC, the Regional Internet Registry serving the Asia Pacific region.