{"id":37892,"date":"2019-10-31T22:20:24","date_gmt":"2019-10-31T19:20:24","guid":{"rendered":"https:\/\/prohoster.info\/blog\/mozilla-perehodit-k-vklyucheniyu-po-umolchaniyu-dns-over-https-v-firefox\/"},"modified":"2019-10-31T22:20:24","modified_gmt":"2019-10-31T19:20:24","slug":"mozilla-perehodit-k-vklyucheniyu-po-umolchaniyu-dns-over-https-v-firefox","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/news\/mozilla-perehodit-k-vklyucheniyu-po-umolchaniyu-dns-over-https-v-firefox","title":{"rendered":"Mozilla trece la activarea implicit\u0103 a DNS-over-HTTPS \u00een Firefox","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Dezvoltatorii Firefox au anun\u021bat<\/a><\/noindex> cu privire la finalizarea test\u0103rii suportului DNS asupra HTTPS (DoH, DNS over HTTPS) \u0219i inten\u021bia de a activa aceast\u0103 tehnologie \u00een mod implicit pentru utilizatorii din SUA la sf\u00e2r\u0219itul lunii septembrie. Activarea se va face treptat, ini\u021bial pentru un procent mic din utilizatori, iar \u00een lipsa problemelor, va fi extins\u0103 p\u00e2n\u0103 la 100%. Dup\u0103 ce se va atinge SUA, se va lua \u00een considerare activarea DoH \u0219i \u00een alte \u021b\u0103ri.<\/p>\n

Testele efectuate pe parcursul anului au demonstrat fiabilitatea \u0219i performan\u021ba bun\u0103 a serviciului, precum \u0219i au permis identificarea unor situa\u021bii \u00een care DoH poate cauza probleme \u0219i dezvoltarea unor solu\u021bii pentru a le evita (de exemplu, s-au analizat probleme<\/a><\/noindex> optimizarea traficului \u00een re\u021belele de livrare a con\u021binutului, controlul parental \u0219i zonele DNS interne ale companiilor). <\/p>\n

Importan\u021ba cript\u0103rii traficului DNS este evaluat\u0103 ca un factor esen\u021bial \u00een protec\u021bia utilizatorilor, de aceea s-a decis includerea DoH \u00een mod implicit, dar \u00een prima etap\u0103 doar pentru utilizatorii din SUA. Dup\u0103 activarea DoH, utilizatorului i se va afi\u0219a un avertisment, care \u00eei va permite, dac\u0103 dore\u0219te, s\u0103 renun\u021be la utilizarea serverelor DNS DoH centralizate \u0219i s\u0103 revin\u0103 la schema tradi\u021bional\u0103 de trimitere a cererilor necriptate c\u0103tre serverul DNS al providerului (\u00een loc de infrastructura distribuit\u0103 de rezolvare DNS, \u00een DoH se utilizeaz\u0103 asocierea cu un anumit serviciu DoH, care poate fi considerat un punct unic de e\u0219ec).<\/p>\n

Activarea DoH poate duce la probleme cu sistemele de control parental \u0219i re\u021belele corporative care utilizeaz\u0103 o structur\u0103 de nume DNS disponibil\u0103 doar pentru re\u021beaua intern\u0103 pentru a transforma adresele intranet \u0219i gazdele corporative. Pentru a rezolva problemele cu aceste sisteme, a fost ad\u0103ugat un sistem de verific\u0103ri care opre\u0219te automat DoH. Verific\u0103rile sunt efectuate la fiecare pornire a browserului sau la identificarea unei schimb\u0103ri a subre\u021belei.<\/p>\n

Restabilirea automat\u0103 a utiliz\u0103rii rezolvatorului standard al sistemului de operare este, de asemenea, prev\u0103zut\u0103 \u00een cazul \u00een care apar erori la rezolvarea prin DoH (de exemplu, \u00een caz de probleme de conectivitate cu furnizorul de DoH sau erori \u00een infrastructura acestuia). Utilitatea acestor verific\u0103ri este discutabil\u0103, deoarece nimic nu \u00eempiedic\u0103 atacatorii care controleaz\u0103 rezolvatorul sau care pot interfera cu traficul s\u0103 simuleze un astfel de comportament pentru a dezactiva criptarea traficului DNS. Problema este rezolvat\u0103 prin ad\u0103ugarea op\u021biunii «DoH always» \u00een set\u0103ri (care nu este activat\u0103 implicit), iar activarea acesteia face ca dezactivarea automat\u0103 s\u0103 nu se aplice, ceea ce reprezint\u0103 un compromis ra\u021bional.<\/p>\n

Pentru a identifica resolver-ele corporative, se efectueaz\u0103 verific\u0103ri ale domeniilor de nivel superior (TLD) atipice \u0219i se returneaz\u0103 adresele intranet de c\u0103tre resolver-ul sistemic. Pentru a verifica activarea controlului parental, se \u00eencearc\u0103 rezolvarea numelui exampleadultsite.com, iar dac\u0103 rezultatul nu coincide cu IP-ul efectiv, se consider\u0103 c\u0103 exist\u0103 o blocare a con\u021binutului pentru adul\u021bi la nivel DNS. De asemenea, se verific\u0103 IP-urile Google \u0219i YouTube pentru a vedea dac\u0103 acestea sunt \u00eenlocuite cu restrict.youtube.com, forcesafesearch.google.com \u0219i restrictmoderate.youtube.com. \u00cen plus, Mozilla ofer\u0103<\/a><\/noindex> implanteaz\u0103 un host de verificare unic use-application-dns.net<\/a><\/noindex>, pe care internet providerii \u0219i serviciile de control parental \u00eel pot utiliza ca etichet\u0103 pentru a dezactiva DoH (dac\u0103 hostul nu este definit, Firefox dezactiveaz\u0103 DoH).<\/p>\n

Folosirea unui serviciu DoH unic poate duce, de asemenea, la probleme de optimizare a traficului \u00een re\u021belele de livrare a con\u021binutului care efectueaz\u0103 echilibrarea traficului utiliz\u00e2nd DNS (serverul DNS al re\u021belei CDN formeaz\u0103 un r\u0103spuns pe baza adresei rezolutorului \u0219i furnizeaz\u0103 cel mai apropiat gazd\u0103 pentru a ob\u021bine con\u021binutul). Trimiterea unei soliciti DNS de la cel mai apropiat rezolutor de utilizator \u00een astfel de CDN-uri duce la returnarea adresei celui mai apropiat gazd\u0103 pentru utilizator, dar trimiterea unei solicit\u0103ri DNS de la un rezolutor centralizat va furniza adresa gazdei cea mai apropiat\u0103 de serverul DNS-over-HTTPS. Testarea \u00een practic\u0103 a ar\u0103tat c\u0103 utilizarea DNS-over-HTTP cu CDN-uri nu a dus practic la \u00eent\u00e2rzieri \u00eenainte de \u00eenceperea transferului de con\u021binut (pentru conexiuni rapide, \u00eent\u00e2rzierile nu au dep\u0103\u0219it 10 milisecunde, iar pe canalele de comunicare mai lente s-a observat chiar o accelerare a func\u021bion\u0103rii). Pentru a transmite informa\u021biile despre loca\u021bia clientului c\u0103tre rezolutorul CDN, s-a luat \u00een considerare utilizarea extensiei EDNS Client Subnet.<\/p>\n

Reamintim c\u0103 DoH poate fi util pentru a preveni scurgerile de informa\u021bii despre numele gazdelor solicitate prin serverele DNS ale furnizorilor, pentru a combate atacurile MITM \u0219i manipularea traficului DNS, pentru a contracara bloc\u0103rile la nivel DNS sau pentru a asigura func\u021bionarea \u00een cazul imposibilit\u0103\u021bii de a accesa direct serverele DNS (de exemplu, \u00een cazul utiliz\u0103rii unui proxy). \u00cen condi\u021bii normale, cererile DNS sunt trimise direct c\u0103tre serverele DNS specificate \u00een configura\u021bia sistemului, \u00eens\u0103 \u00een cazul DoH, cererea pentru determinarea adresei IP a gazdelor este \u00eencapsulat\u0103 \u00een traficul HTTPS \u0219i trimis\u0103 c\u0103tre un server HTTP, unde rezolvatorul proceseaz\u0103 cererile prin Web API. Standardul existent DNSSEC folose\u0219te criptarea doar pentru autentificarea clientului \u0219i serverului, dar nu protejeaz\u0103 traficul de interceptare \u0219i nu garanteaz\u0103 confiden\u021bialitatea cererilor. <\/p>\n

Pentru a activa DoH, \u00een about:config trebuie s\u0103 schimbi valoarea variabilei network.trr.mode, care este suportat\u0103 \u00eencep\u00e2nd cu Firefox 60. Valoarea 0 dezactiveaz\u0103 complet DoH; 1 — se folose\u0219te DNS sau DoH, \u00een func\u021bie de ce este mai rapid; 2 — se folose\u0219te DoH implicit, iar DNS ca variant\u0103 de rezerv\u0103; 3 — se folose\u0219te doar DoH; 4 — modul de mirroring, \u00een care DoH \u0219i DNS sunt folosite simultan. Implicit, se folose\u0219te serverul DNS CloudFlare, dar acesta poate fi schimbat prin parametrul network.trr.uri, de exemplu, se poate seta «https:\/\/dns.google.com\/experimental» sau «https:\/\/9.9.9.9\/dns-query».<\/p>\n

<\/a><\/noindex><\/p>\n

Sursa: opennet.ro<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 Firefox \u043e\u0431\u044a\u044f\u0432\u0438\u043b\u0438 \u043e \u0437\u0430\u0432\u0435\u0440\u0448\u0435\u043d\u0438\u0438 \u0442\u0435\u0441\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0438 DNS \u043f\u043e\u0432\u0435\u0440\u0445 HTTPS (DoH, DNS over HTTPS) \u0438 \u043d\u0430\u043c\u0435\u0440\u0435\u043d\u0438\u0438 \u0432 \u043a\u043e\u043d\u0446\u0435 \u0441\u0435\u043d\u0442\u044f\u0431\u0440\u044f \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u044c \u0434\u0430\u043d\u043d\u0443\u044e \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u044e \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e \u0434\u043b\u044f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u0421\u0428\u0410. \u0412\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u0431\u0443\u0434\u0435\u0442 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u044c\u0441\u044f \u043f\u043e\u0441\u0442\u0443\u043f\u0430\u0442\u0435\u043b\u044c\u043d\u043e, \u0432\u043d\u0430\u0447\u0430\u043b\u0435 \u0434\u043b\u044f \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u0438\u0445 \u043f\u0440\u043e\u0446\u0435\u043d\u0442\u043e\u0432 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439, \u0430 \u0432 \u0441\u043b\u0443\u0447\u0430\u0435 \u043e\u0442\u0441\u0443\u0442\u0441\u0442\u0432\u0438\u044f \u043f\u0440\u043e\u0431\u043b\u0435\u043c \u043f\u043e\u0441\u0442\u0435\u043f\u0435\u043d\u043d\u043e \u0434\u043e\u0432\u043e\u0434\u044f \u0434\u043e 100%. \u041f\u043e\u0441\u043b\u0435 \u043e\u0445\u0432\u0430\u0442\u0430 \u0421\u0428\u0410 \u0431\u0443\u0434\u0435\u0442 \u0440\u0430\u0441\u0441\u043c\u043e\u0442\u0440\u0435\u043d\u0430 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f DoH \u0438 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-37892","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Mozilla trece la activarea implicit\u0103 a DNS-over-HTTPS \u00een Firefox | ProHoster","description":"Dezvoltatorii Firefox au anun\u021bat finalizarea test\u0103rii suportului.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/mozilla-perehodit-k-vklyucheniyu-po-umolchaniyu-dns-over-https-v-firefox","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47Mozilla \u043f\u0435\u0440\u0435\u0445\u043e\u0434\u0438\u0442 \u043a \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044e \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e DNS-over-HTTPS \u0432 Firefox | ProHoster","og:description":"\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 Firefox \u043e\u0431\u044a\u044f\u0432\u0438\u043b\u0438 \u043e \u0437\u0430\u0432\u0435\u0440\u0448\u0435\u043d\u0438\u0438 \u0442\u0435\u0441\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0438.","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/mozilla-perehodit-k-vklyucheniyu-po-umolchaniyu-dns-over-https-v-firefox","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:20:24+00:00","article:modified_time":"2019-10-31T19:20:24+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"37892","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 19:39:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 18:39:22","updated":"2026-01-23 19:39:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/37892","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=37892"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/37892\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=37892"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=37892"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=37892"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}