{"id":71411,"date":"2020-02-26T03:10:13","date_gmt":"2020-02-26T00:10:13","guid":{"rendered":"https:\/\/prohoster.info\/blog\/dns-over-https-vklyuchyon-po-umolchaniyu-v-firefox-dlya-polzovatelej-iz-ssha"},"modified":"2020-03-03T16:10:46","modified_gmt":"2020-03-03T13:10:46","slug":"dns-over-https-vklyuchyon-po-umolchaniyu-v-firefox-dlya-polzovatelej-iz-ssha","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/news\/dns-over-https-vklyuchyon-po-umolchaniyu-v-firefox-dlya-polzovatelej-iz-ssha","title":{"rendered":"DNS-over-HTTPS je ve Firefoxu ve v\u00fdchoz\u00edm nastaven\u00ed povolen pro u\u017eivatele v USA","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

V\u00fdvoj\u00e1\u0159i Firefoxu ozn\u00e1mili<\/a><\/noindex> ohledn\u011b v\u00fdchoz\u00ed aktivace re\u017eimu DNS p\u0159es HTTPS (DoH, DNS over HTTPS) pro u\u017eivatele v USA. \u0160ifrov\u00e1n\u00ed DNS provozu se pova\u017euje za z\u00e1sadn\u00ed faktor ochrany u\u017eivatel\u016f. Od dne\u0161n\u00edho dne je DoH aktivov\u00e1no ve v\u00fdchoz\u00edm nastaven\u00ed pro v\u0161echny nov\u00e9 instalace proveden\u00e9 u\u017eivateli v USA. St\u00e1vaj\u00edc\u00ed u\u017eivatel\u00e9 v USA budou na DoH p\u0159epnuti b\u011bhem n\u011bkolika t\u00fddn\u016f. V Evropsk\u00e9 unii a dal\u0161\u00edch zem\u00edch zat\u00edm nemaj\u00ed pl\u00e1ny DoH ve v\u00fdchoz\u00edm nastaven\u00ed aktivovat. nepl\u00e1nuj\u00ed<\/a><\/noindex>.<\/p>\n

Po aktivaci DoH obdr\u017e\u00ed u\u017eivatel upozorn\u011bn\u00ed, kter\u00e9 mu umo\u017e\u0148uje, pokud si to p\u0159eje, vzd\u00e1t se kontaktu se centralizovan\u00fdmi servery DoH DNS a vr\u00e1tit se k tradi\u010dn\u00edmu zp\u016fsobu zas\u00edl\u00e1n\u00ed neza\u0161ifrovan\u00fdch dotaz\u016f k DNS serveru poskytovatele. M\u00edsto distribuovan\u00e9 infrastruktury resolver\u016f DNS, je v DoH pou\u017eito v\u00e1z\u00e1n\u00ed na konkr\u00e9tn\u00ed slu\u017ebu DoH, kterou lze pova\u017eovat za jedin\u00fd bod selh\u00e1n\u00ed. V sou\u010dasnosti jsou nab\u00edzeny slu\u017eby prost\u0159ednictv\u00edm dvou poskytovatel\u016f DNS \u2014 CloudFlare (v\u00fdchoz\u00ed) a NextDNS<\/a><\/noindex>. <\/p>\n

\"DNS-over-HTTPS<\/a><\/noindex><\/center><\/p>\n

Zm\u011bnit poskytovatele nebo vypnout DoH lze<\/a><\/noindex> v nastaven\u00edch s\u00ed\u0165ov\u00e9ho p\u0159ipojen\u00ed. Nap\u0159\u00edklad lze uv\u00e9st alternativn\u00ed server DoH \u201ehttps:\/\/dns.google\/dns-query\u201c pro kontaktov\u00e1n\u00ed server\u016f Google, \u201ehttps:\/\/dns.quad9.net\/dns-query\u201c \u2014 Quad9 a \u201ehttps:\/\/doh.opendns.com\/dns-query\u201c \u2014 OpenDNS. V about:config je tak\u00e9 mo\u017en\u00e9 nastavit network.trr.mode, pomoc\u00ed kter\u00e9 lze zm\u011bnit re\u017eim DoH: hodnota 0 zcela vypne DoH; 1 \u2014 vyu\u017e\u00edv\u00e1 se DNS nebo DoH v z\u00e1vislosti na tom, co je rychlej\u0161\u00ed; 2 \u2014 pou\u017e\u00edv\u00e1 se DoH jako v\u00fdchoz\u00ed, a DNS jako z\u00e1lo\u017en\u00ed mo\u017enost; 3 \u2014 pou\u017e\u00edv\u00e1 se pouze DoH; 4 \u2014 re\u017eim zrcadlen\u00ed, ve kter\u00e9m jsou DoH a DNS vyu\u017e\u00edv\u00e1ny paraleln\u011b. <\/p>\n

P\u0159ipome\u0148me, \u017ee DoH m\u016f\u017ee b\u00fdt u\u017eite\u010dn\u00fd k vylou\u010den\u00ed \u00fanik\u016f informac\u00ed o dotazovan\u00fdch n\u00e1zvech hostitel\u016f p\u0159es DNS servery poskytovatel\u016f, k boji proti MITM \u00fatok\u016fm a podvr\u017een\u00ed DNS provozu (nap\u0159\u00edklad p\u0159i p\u0159ipojen\u00ed k ve\u0159ejn\u00e9mu Wi-Fi), k p\u0159ekon\u00e1v\u00e1n\u00ed blokac\u00ed na \u00farovni DNS (DoH nem\u016f\u017ee nahradit VPN v oblasti obch\u00e1zen\u00ed blokac\u00ed realizovan\u00fdch na \u00farovni DPI) nebo k organizaci pr\u00e1ce v p\u0159\u00edpad\u011b nemo\u017enosti p\u0159\u00edm\u00e9ho p\u0159\u00edstupu k DNS server\u016fm (nap\u0159\u00edklad p\u0159i pr\u00e1ci p\u0159es proxy). Pokud jsou v b\u011b\u017en\u00e9 situaci DNS dotazy p\u0159\u00edmo odes\u00edl\u00e1ny na ur\u010dit\u00e9 DNS servery definovan\u00e9 v konfiguraci syst\u00e9mu, pak v p\u0159\u00edpad\u011b DoH je dotaz na ur\u010den\u00ed IP adresy hostitele zahu\u0161t\u011bn do HTTPS provozu a odesl\u00e1n na HTTP server, na kter\u00e9m resolver zpracov\u00e1v\u00e1 dotazy p\u0159es Web API. St\u00e1vaj\u00edc\u00ed standard DNSSEC pou\u017e\u00edv\u00e1 \u0161ifrov\u00e1n\u00ed pouze pro autentizaci klienta a serveru, ale nechr\u00e1n\u00ed provoz p\u0159ed odposlechem a nezaru\u010duje d\u016fv\u011brnost dotaz\u016f. <\/p>\n

Pro v\u00fdb\u011br poskytovatel\u016f DoH nab\u00edzen\u00fdch ve Firefoxu byla formulov\u00e1na po\u017eadavky<\/a><\/noindex> k d\u016fv\u011bryhodn\u00fdm DNS resolver\u016fm, podle nich\u017e m\u016f\u017ee DNS oper\u00e1tor pou\u017e\u00edvat z\u00edskan\u00e9 \u00fadaje pro resolvov\u00e1n\u00ed pouze k zaji\u0161t\u011bn\u00ed provozu slu\u017eby, nesm\u00ed uchov\u00e1vat z\u00e1znamy d\u00e9le ne\u017e 24 hodin, nesm\u00ed p\u0159ed\u00e1vat \u00fadaje t\u0159et\u00edm stran\u00e1m a mus\u00ed zve\u0159ejnit informace o metod\u00e1ch zpracov\u00e1n\u00ed \u00fadaj\u016f. Slu\u017eba mus\u00ed tak\u00e9 p\u0159isl\u00edbit, \u017ee nebude cenzurovat, filtrovat, zasahovat a blokovat DNS provoz, s v\u00fdjimkou situac\u00ed p\u0159edepsan\u00fdch legislativou. <\/p>\n

Pou\u017e\u00edvat DoH je t\u0159eba opatrn\u011b. Nap\u0159\u00edklad v Rusk\u00e9 federaci jsou IP adresy 104.16.248.249 a 104.16.249.249, spojen\u00e9 s p\u0159edvolen\u00fdm DoH serverem mozilla.cloudflare-dns.com ve Firefoxu, za\u0159azeny<\/a><\/noindex> v na seznamy<\/a><\/noindex> blokace<\/a><\/noindex> Roskomnadzoru<\/a><\/noindex> na z\u00e1klad\u011b soudn\u00edho p\u0159\u00edkazu z m\u011bsta Stavropolu ze dne 10.06.2013.<\/p>\n

Pou\u017eit\u00ed DoH m\u016f\u017ee tak\u00e9 v\u00e9st k probl\u00e9m\u016fm v oblastech, jako jsou syst\u00e9my rodi\u010dovsk\u00e9 kontroly, p\u0159\u00edstup k intern\u00edm prostor\u016fm n\u00e1zv\u016f v podnikov\u00fdch syst\u00e9mech, v\u00fdb\u011br tras v syst\u00e9mech optimalizace doru\u010dov\u00e1n\u00ed obsahu a pln\u011bn\u00ed soudn\u00edch p\u0159\u00edkaz\u016f v oblasti boje proti \u0161\u00ed\u0159en\u00ed nez\u00e1konn\u00e9ho obsahu a vyko\u0159is\u0165ov\u00e1n\u00ed nezletil\u00fdch. Pro obch\u00e1zen\u00ed t\u011bchto probl\u00e9m\u016f byl implementov\u00e1n a otestov\u00e1n syst\u00e9m kontrol, kter\u00fd automaticky deaktivuje DoH za ur\u010dit\u00fdch podm\u00ednek. <\/p>\n

Pro ur\u010den\u00ed podnikov\u00fdch resolver\u016f se prov\u00e1d\u011bj\u00ed kontroly netypick\u00fdch dom\u00e9n prvn\u00edho stupn\u011b (TLD) a vracen\u00ed intranetov\u00fdch adres syst\u00e9mov\u00fdm resolverem. Pro ur\u010den\u00ed zapnut\u00ed rodi\u010dovsk\u00e9 kontroly se pokou\u0161\u00edme o rozli\u0161en\u00ed n\u00e1zvu exampleadultsite.com a pokud v\u00fdsledek neodpov\u00edd\u00e1 skute\u010dn\u00e9 IP, pova\u017euje se za aktivn\u00ed blokaci obsahu pro dosp\u011bl\u00e9 na \u00farovni DNS. Jako p\u0159\u00edznaky se tak\u00e9 kontroluj\u00ed IP adresy Google a YouTube na mo\u017enost jejich p\u0159esm\u011brov\u00e1n\u00ed na restrict.youtube.com, forcesafesearch.google.com a restrictmoderate.youtube.com. Tato ov\u011b\u0159en\u00ed umo\u017e\u0148uj\u00ed \u00fato\u010dn\u00edk\u016fm, kte\u0159\u00ed maj\u00ed kontrolu nad chodem resolveru nebo kte\u0159\u00ed mohou zasahovat do provozu, simulovat takov\u00e9to chov\u00e1n\u00ed pro deaktivaci \u0161ifrov\u00e1n\u00ed DNS provozu.<\/p>\n

Pr\u00e1ce p\u0159es jednotn\u00fd DoH servis m\u016f\u017ee tak\u00e9 potenci\u00e1ln\u011b v\u00e9st k probl\u00e9m\u016fm s optimalizac\u00ed provozu v s\u00edt\u00edch doru\u010dov\u00e1n\u00ed obsahu, kter\u00e9 prov\u00e1d\u011bj\u00ed vyrovn\u00e1v\u00e1n\u00ed provozu pomoc\u00ed DNS (DNS server CDN s\u00edt\u011b vytv\u00e1\u0159\u00ed odpov\u011b\u010f s ohledem na adresu resolveru a poskytuje nejbli\u017e\u0161\u00ed hostitele pro z\u00edsk\u00e1n\u00ed obsahu). Odesl\u00e1n\u00ed DNS dotazu z nejbli\u017e\u0161\u00edho resolveru k u\u017eivateli v takov\u00fdch CDN vede k vracen\u00ed adresy nejbli\u017e\u0161\u00edho hostitele k u\u017eivateli, ale p\u0159i odesl\u00e1n\u00ed DNS dotazu z centralizovan\u00e9ho resolveru bude vr\u00e1cena adresa hostitele, kter\u00e1 je nejbl\u00ed\u017ee serveru DNS-over-HTTPS. Testov\u00e1n\u00ed v praxi uk\u00e1zalo, \u017ee pou\u017eit\u00ed DNS-over-HTTP p\u0159i pou\u017e\u00edv\u00e1n\u00ed CDN t\u00e9m\u011b\u0159 nezp\u016fsobovalo zpo\u017ed\u011bn\u00ed p\u0159ed za\u010d\u00e1tkem p\u0159enosu obsahu (pro rychl\u00e9 p\u0159ipojen\u00ed zpo\u017ed\u011bn\u00ed nep\u0159esahovala 10 milisekund, zat\u00edmco na pomalej\u0161\u00edch spoj\u00edch bylo pozorov\u00e1no dokonce zrychlen\u00ed). Pro p\u0159ed\u00e1n\u00ed resolveru CDN informace o poloze klienta bylo tak\u00e9 zv\u00e1\u017eeno pou\u017eit\u00ed roz\u0161\u00ed\u0159en\u00ed EDNS Client Subnet.<\/p>\n

<\/a><\/noindex><\/p>\n

Zdroj: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 Firefox \u043e\u0431\u044a\u044f\u0432\u0438\u043b\u0438 \u043e \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0438 \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e \u0440\u0435\u0436\u0438\u043c\u0430 DNS \u043f\u043e\u0432\u0435\u0440\u0445 HTTPS (DoH, DNS over HTTPS) \u0434\u043b\u044f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u0421\u0428\u0410. \u0428\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u0435 DNS-\u0442\u0440\u0430\u0444\u0438\u043a\u0430 \u0440\u0430\u0441\u0441\u043c\u0430\u0442\u0440\u0438\u0432\u0430\u0435\u0442\u0441\u044f \u043a\u0430\u043a \u043f\u0440\u0438\u043d\u0446\u0438\u043f\u0438\u0430\u043b\u044c\u043d\u043e \u0432\u0430\u0436\u043d\u044b\u0439 \u0444\u0430\u043a\u0442\u043e\u0440 \u0437\u0430\u0449\u0438\u0442\u044b \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439. \u041d\u0430\u0447\u0438\u043d\u0430\u044f \u0441 \u0441\u0435\u0433\u043e\u0434\u043d\u044f\u0448\u043d\u0435\u0433\u043e \u0434\u043d\u044f \u0432\u043e \u0432\u0441\u0435\u0445 \u043d\u043e\u0432\u044b\u0445 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0430\u0445, \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u043d\u044b\u0445 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c\u0438 \u0438\u0437 \u0421\u0428\u0410, DoH \u0430\u043a\u0442\u0438\u0432\u0438\u0440\u043e\u0432\u0430\u043d \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e. \u0421\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0445 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u0421\u0428\u0410 \u043f\u043b\u0430\u043d\u0438\u0440\u0443\u0435\u0442\u0441\u044f \u043f\u0435\u0440\u0435\u043a\u043b\u044e\u0447\u0438\u0442\u044c \u043d\u0430 DoH \u0432 \u0442\u0435\u0447\u0435\u043d\u0438\u0435 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u0438\u0445 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":71412,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-71411","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47 DNS-over-HTTPS je ve v\u00fdchoz\u00edm nastaven\u00ed aktivov\u00e1no v prohl\u00ed\u017ee\u010di Firefox pro u\u017eivatele v USA | ProHoster","description":"V\u00fdvoj\u00e1\u0159i Firefoxu ozn\u00e1mili, \u017ee bude zapnuto ve v\u00fdchoz\u00edm nastaven\u00ed.","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/news\/dns-over-https-vklyuchyon-po-umolchaniyu-v-firefox-dlya-polzovatelej-iz-ssha","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47DNS-over-HTTPS \u0432\u043a\u043b\u044e\u0447\u0451\u043d \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e \u0432 Firefox \u0434\u043b\u044f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u0421\u0428\u0410 | ProHoster","og:description":"\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 Firefox \u043e\u0431\u044a\u044f\u0432\u0438\u043b\u0438 \u043e \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0438 \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e.","og:url":"https:\/\/prohoster.info\/cs\/blog\/news\/dns-over-https-vklyuchyon-po-umolchaniyu-v-firefox-dlya-polzovatelej-iz-ssha","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-02-26T00:10:13+00:00","article:modified_time":"2020-03-03T13:10:46+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"71411","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 19:02:24","updated":"2022-10-03 11:24:30","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/71411","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=71411"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/71411\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media\/71412"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=71411"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=71411"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=71411"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}