{"id":71411,"date":"2020-02-26T03:10:13","date_gmt":"2020-02-26T00:10:13","guid":{"rendered":"https:\/\/prohoster.info\/blog\/dns-over-https-vklyuchyon-po-umolchaniyu-v-firefox-dlya-polzovatelej-iz-ssha"},"modified":"2020-03-03T16:10:46","modified_gmt":"2020-03-03T13:10:46","slug":"dns-over-https-vklyuchyon-po-umolchaniyu-v-firefox-dlya-polzovatelej-iz-ssha","status":"publish","type":"post","link":"https:\/\/prohoster.info\/da\/blog\/news\/dns-over-https-vklyuchyon-po-umolchaniyu-v-firefox-dlya-polzovatelej-iz-ssha","title":{"rendered":"DNS-over-HTTPS er som standard aktiveret i Firefox for brugere i USA","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Firefox-udviklere at de kun havde to blokke tilbage \/8.<\/a><\/noindex> om aktivering af DNS over HTTPS (DoH) som standardindstilling for brugere i USA. Kryptering af DNS-trafik betragtes som en grundl\u00e6ggende beskyttelsesfaktor for brugerne. Fra i dag er DoH aktiveret som standard for alle nye installationer foretaget af brugere i USA. Eksisterende brugere i USA forventes at blive overf\u00f8rt til DoH inden for de n\u00e6ste par uger. I EU og andre lande planl\u00e6gger man ikke at aktivere DoH som standard endnu. det planl\u00e6gger man ikke<\/a><\/noindex>.<\/p>\n

N\u00e5r DoH aktiveres, vises der en advarsel til brugeren, som g\u00f8r det muligt at frav\u00e6lge forbindelsen til de centraliserede DoH-DNS-servere og vende tilbage til den traditionelle metode for at sende ukrypterede foresp\u00f8rgsler til udbyderens DNS-server. I DoH er der en binding til en bestemt DoH-tjeneste i stedet for en distribueret infrastruktur af DNS-resolv\u00f8rer, hvilket kan ses som et enkelt fejlpunk. I \u00f8jeblikket tilbydes der forbindelser gennem to DNS-udbydere \u2013 CloudFlare (som standard) og NextDNS<\/a><\/noindex>. <\/p>\n

\"DNS-over-HTTPS<\/a><\/noindex><\/center><\/p>\n

Skift udbyder eller deaktiver DoH you can<\/a><\/noindex> i indstillingerne for netv\u00e6rksforbindelsen. For eksempel kan man angive en alternativ DoH-server \u2018https:\/\/dns.google\/dns-query\u2019 for at oprette forbindelse til Googles servere, \u2018https:\/\/dns.quad9.net\/dns-query\u2019 \u2013 Quad9, og \u2018https:\/\/doh.opendns.com\/dns-query\u2019 \u2013 OpenDNS. I about:config kan man ogs\u00e5 finde indstillingen network.trr.mode, som g\u00f8r det muligt at \u00e6ndre DoH-tilstand: v\u00e6rdi 0 deaktiverer helt DoH; 1 \u2013 anvender DNS eller DoH, afh\u00e6ngigt af hvad der er hurtigere; 2 \u2013 anvender DoH som standard, og DNS som backup; 3 \u2013 anvender kun DoH; 4 \u2013 spejlingsmode, hvor DoH og DNS arbejder parallelt. <\/p>\n

Vi minder om, at DoH kan v\u00e6re nyttigt til at forhindre l\u00e6kager af oplysninger om de anmodede v\u00e6rt-navne via udbydernes DNS-servere, bek\u00e6mpelse af MITM-angreb og manipulation af DNS-trafik (for eksempel ved forbindelse til offentligt Wi-Fi), modst\u00e5 blokeringer p\u00e5 DNS-niveau (DoH kan ikke erstatte VPN i forhold til at omg\u00e5 blokeringer implementeret p\u00e5 DPI-niveau) eller til at sikre drift i tilf\u00e6lde af, at der ikke kan foretages direkte henvendelser til DNS-servere (for eksempel ved brug af proxy). I almindelige situationer sendes DNS-anmodninger direkte til de systemkonfigurerede DNS-servere, men i tilf\u00e6ldet med DoH indkapsles anmodningen om at bestemme IP-adressen for v\u00e6rten i HTTPS-trafikken og sendes til en HTTP-server, hvor resolveren behandler anmodninger via Web API. Den eksisterende standard DNSSEC bruger kryptering kun til at autentificere klienten og serveren, men beskytter ikke trafikken mod opsnapning og garanterer ikke fortrolighed for foresp\u00f8rgsler. <\/p>\n

For at udv\u00e6lge de DoH-udbydere, der tilbydes i Firefox, er der formuleret krav<\/a><\/noindex> til p\u00e5lidelige DNS-resolv\u00f8rer, if\u00f8lge hvilke DNS-operat\u00f8ren kun m\u00e5 bruge de data, der modtages til opl\u00f8sning, til at sikre tjenestens drift, ikke m\u00e5 opbevare logs i mere end 24 timer, ikke m\u00e5 overdrage data til tredjeparter og er forpligtet til at afsl\u00f8re oplysninger om datah\u00e5ndteringsmetoder. Tjenesten skal ogs\u00e5 forpligte sig til ikke at censurere, filtrere, blande sig i og blokere DNS-trafik, undtagen under betingelser som foreskrevet af lovgivningen. <\/p>\n

DoH b\u00f8r anvendes med forsigtighed. For eksempel er IP-adresserne 104.16.248.249 og 104.16.249.249, der er knyttet til den DoH-server, som er standard i Firefox mozilla.cloudflare-dns.com, opf\u00f8rt<\/a><\/noindex> i listen<\/a><\/noindex> l\u00e5sninger<\/a><\/noindex> Roskomnadzor<\/a><\/noindex> if\u00f8lge afg\u00f8relsen fra retten i Stavropol den 10.06.2013.<\/p>\n

Brugen af DoH kan ogs\u00e5 medf\u00f8re problemer inden for omr\u00e5der som for\u00e6ldrebeskyttelsessystemer, adgang til interne navnerum i virksomhedssystemer, rutevalg i systemer til optimering af indholdslevering og udf\u00f8relse af retskendelser vedr\u00f8rende bek\u00e6mpelse af ulovligt indhold og udnyttelse af mindre\u00e5rige. For at omg\u00e5 s\u00e5danne problemer er der implementeret og testet et system af kontroller, der automatisk deaktiverer DoH under bestemte betingelser. <\/p>\n

For determining corporate resolvers, checks are performed on atypical top-level domains (TLD) and the system resolver returns intranet addresses. To identify the inclusion of parental controls, an attempt to resolve the name exampleadultsite.com is made, and if the result does not match the actual IP, it is considered that blocking of adult content at the DNS level is active. Also, Google and YouTube IP addresses are checked for their replacement with restrict.youtube.com, forcesafesearch.google.com, and restrictmoderate.youtube.com. These checks allow attackers controlling the resolver or able to interfere with traffic to simulate such behavior to disable DNS traffic encryption.<\/p>\n

At arbejde gennem en enhed DoH-service kan ogs\u00e5 potentielt f\u00f8re til problemer med trafikoptimering i indholdsleveringsnetv\u00e6rk, der udf\u00f8rer trafikbalancering ved hj\u00e6lp af DNS (DNS-serveren i CDN-netv\u00e6rket genererer svar, der tager h\u00f8jde for resolverens adresse og giver den n\u00e6rmeste v\u00e6rt til at f\u00e5 indhold). Afsendelse af DNS-foresp\u00f8rgsler fra den n\u00e6rmeste resolver til brugeren i s\u00e5danne CDN'er f\u00f8rer til, at adressen for den n\u00e6rmeste v\u00e6rt til brugeren returneres, men n\u00e5r en DNS-foresp\u00f8rgsel sendes fra en centraliseret resolver, gives adressen til den v\u00e6rt, der er t\u00e6ttest p\u00e5 DNS-over-HTTPS-serveren. Praktisk test har vist, at anvendelsen af DNS-over-HTTP ved brug af CDN n\u00e6sten ikke f\u00f8rte til forsinkelser f\u00f8r indholdslevering (for hurtige forbindelser oversteg forsinkelserne ikke 10 millisekunder, og p\u00e5 langsomme forbindelser blev der endda observeret en hastighedsfor\u00f8gelse). For at overf\u00f8re oplysninger til resolveren om klientens placering, blev der ogs\u00e5 overvejet anvendelse af EDNS Client Subnet-udvidelsen.<\/p>\n

<\/a><\/noindex><\/p>\n

Kilde: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 Firefox \u043e\u0431\u044a\u044f\u0432\u0438\u043b\u0438 \u043e \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0438 \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e \u0440\u0435\u0436\u0438\u043c\u0430 DNS \u043f\u043e\u0432\u0435\u0440\u0445 HTTPS (DoH, DNS over HTTPS) \u0434\u043b\u044f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u0421\u0428\u0410. \u0428\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u0435 DNS-\u0442\u0440\u0430\u0444\u0438\u043a\u0430 \u0440\u0430\u0441\u0441\u043c\u0430\u0442\u0440\u0438\u0432\u0430\u0435\u0442\u0441\u044f \u043a\u0430\u043a \u043f\u0440\u0438\u043d\u0446\u0438\u043f\u0438\u0430\u043b\u044c\u043d\u043e \u0432\u0430\u0436\u043d\u044b\u0439 \u0444\u0430\u043a\u0442\u043e\u0440 \u0437\u0430\u0449\u0438\u0442\u044b \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439. \u041d\u0430\u0447\u0438\u043d\u0430\u044f \u0441 \u0441\u0435\u0433\u043e\u0434\u043d\u044f\u0448\u043d\u0435\u0433\u043e \u0434\u043d\u044f \u0432\u043e \u0432\u0441\u0435\u0445 \u043d\u043e\u0432\u044b\u0445 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0430\u0445, \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u043d\u044b\u0445 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c\u0438 \u0438\u0437 \u0421\u0428\u0410, DoH \u0430\u043a\u0442\u0438\u0432\u0438\u0440\u043e\u0432\u0430\u043d \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e. \u0421\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0445 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u0421\u0428\u0410 \u043f\u043b\u0430\u043d\u0438\u0440\u0443\u0435\u0442\u0441\u044f \u043f\u0435\u0440\u0435\u043a\u043b\u044e\u0447\u0438\u0442\u044c \u043d\u0430 DoH \u0432 \u0442\u0435\u0447\u0435\u043d\u0438\u0435 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u0438\u0445 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":71412,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-71411","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47DNS-over-HTTPS is enabled by default in Firefox for users in the USA | ProHoster","description":"Firefox developers have announced that it will be enabled by default.","canonical_url":"https:\/\/prohoster.info\/da\/blog\/news\/dns-over-https-vklyuchyon-po-umolchaniyu-v-firefox-dlya-polzovatelej-iz-ssha","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"da_DK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47DNS-over-HTTPS \u0432\u043a\u043b\u044e\u0447\u0451\u043d \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e \u0432 Firefox \u0434\u043b\u044f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u0421\u0428\u0410 | ProHoster","og:description":"\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 Firefox \u043e\u0431\u044a\u044f\u0432\u0438\u043b\u0438 \u043e \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0438 \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e.","og:url":"https:\/\/prohoster.info\/da\/blog\/news\/dns-over-https-vklyuchyon-po-umolchaniyu-v-firefox-dlya-polzovatelej-iz-ssha","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-02-26T00:10:13+00:00","article:modified_time":"2020-03-03T13:10:46+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"71411","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 19:02:24","updated":"2022-10-03 11:24:30","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/71411","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/comments?post=71411"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/71411\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/media\/71412"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/media?parent=71411"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/categories?post=71411"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/tags?post=71411"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}