{"id":71411,"date":"2020-02-26T03:10:13","date_gmt":"2020-02-26T00:10:13","guid":{"rendered":"https:\/\/prohoster.info\/blog\/dns-over-https-vklyuchyon-po-umolchaniyu-v-firefox-dlya-polzovatelej-iz-ssha"},"modified":"2020-03-03T16:10:46","modified_gmt":"2020-03-03T13:10:46","slug":"dns-over-https-vklyuchyon-po-umolchaniyu-v-firefox-dlya-polzovatelej-iz-ssha","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/news\/dns-over-https-vklyuchyon-po-umolchaniyu-v-firefox-dlya-polzovatelej-iz-ssha","title":{"rendered":"DNS-over-HTTPS activat implicit \u00een Firefox pentru utilizatorii din SUA","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Dezvoltatorii Firefox au anun\u021bat<\/a><\/noindex> despre activarea implicit\u0103 a modului DNS peste HTTPS (DoH, DNS over HTTPS) pentru utilizatorii din SUA. Criptarea traficului DNS este considerat\u0103 un factor esen\u021bial pentru protec\u021bia utilizatorilor. \u00cencep\u00e2nd de ast\u0103zi, \u00een toate noile instal\u0103ri realizate de utilizatorii din SUA, DoH este activat implicit. Utilizatorii existen\u021bi din SUA vor fi trecu\u021bi la DoH \u00een urm\u0103toarele c\u00e2teva s\u0103pt\u0103m\u00e2ni. \u00cen Uniunea European\u0103 \u0219i \u00een alte \u021b\u0103ri, activarea implicit\u0103 a DoH nu este planificat\u0103 deocamdat\u0103. nu se planific\u0103<\/a><\/noindex>.<\/p>\n

Dup\u0103 activarea DoH, utilizatorului i se afi\u0219eaz\u0103 o notificare care \u00eei permite s\u0103 renun\u021be la apelurile c\u0103tre serverele DNS centralizate DoH \u0219i s\u0103 revin\u0103 la schema tradi\u021bional\u0103 de trimitere a cererilor necriptate c\u0103tre serverul DNS al furnizorului. \u00cen loc de infrastructura distribuit\u0103 a rezolvatorilor DNS, DoH utilizeaz\u0103 o leg\u0103tur\u0103 cu un anumit serviciu DoH, care poate fi considerat un punct unic de e\u015fec. \u00cen prezent, se ofer\u0103 op\u021biunea de a lucra prin doi furnizori DNS \u2014 CloudFlare (implicit) \u0219i NextDNS<\/a><\/noindex>. <\/p>\n

\"DNS-over-HTTPS<\/a><\/noindex><\/center><\/p>\n

Schimb\u0103 furnizorul sau dezactiveaz\u0103 DoH poate<\/a><\/noindex> \u00een set\u0103rile conexiunii de re\u021bea. De exemplu, se poate specifica un server alternativ DoH \u201ehttps:\/\/dns.google\/dns-query\u201d pentru a apela la serverele Google, \u201ehttps:\/\/dns.quad9.net\/dns-query\u201d \u2014 Quad9 \u0219i \u201ehttps:\/\/doh.opendns.com\/dns-query\u201d \u2014 OpenDNS. \u00cen about:config exist\u0103, de asemenea, o setare pentru network.trr.mode, prin care se poate modifica modul de func\u021bionare al DoH: valoarea 0 dezactiveaz\u0103 complet DoH; 1 \u2014 se utilizeaz\u0103 DNS sau DoH, \u00een func\u021bie de care este mai rapid; 2 \u2014 DoH este utilizat implicit, iar DNS ca op\u021biune de rezerv\u0103; 3 \u2014 se folose\u0219te doar DoH; 4 \u2014 modul de oglindire \u00een care DoH \u0219i DNS sunt active \u00een paralel. <\/p>\n

Reamintim c\u0103 DoH poate fi util pentru a preveni scurgerile de informa\u021bii despre numele de gazde solicitate prin serverele DNS ale providerilor, combaterea atacurilor MITM \u0219i a \u00eenlocuirii traficului DNS (de exemplu, atunci c\u00e2nd te conectezi la Wi-Fi public), contracararea blocajelor la nivel DNS (DoH nu poate \u00eenlocui un VPN \u00een privin\u021ba ocolirii blocajelor implementate la nivel DPI) sau pentru organizarea lucrului \u00een caz de imposibilitate de a accesa direct serverele DNS (de exemplu, atunci c\u00e2nd lucrezi prin proxy). Dac\u0103 \u00een mod obi\u0219nuit, cererile DNS sunt trimise direct c\u0103tre serverele DNS specificate \u00een configura\u021bia sistemului, \u00een cazul DoH, cererea pentru determinarea adresei IP a gazdei este \u00eencastrat\u0103 \u00een traficul HTTPS \u0219i trimis\u0103 c\u0103tre un server HTTP, unde rezolvatorul proceseaz\u0103 cererile prin Web API. Standardul existent DNSSEC folose\u0219te criptarea doar pentru autentificarea clientului \u0219i a serverului, dar nu protejeaz\u0103 traficul de interceptare \u0219i nu garanteaz\u0103 confiden\u021bialitatea cererilor. <\/p>\n

Pentru selec\u021bia providerilor DoH disponibile \u00een Firefox, au fost formulate cerin\u021be<\/a><\/noindex> pentru rezolvatori DNS de \u00eencredere, conform c\u0103rora operatorul DNS poate folosi datele ob\u021binute pentru rezolvare doar pentru a asigura func\u021bionarea serviciului, nu trebuie s\u0103 stocheze jurnale mai mult de 24 de ore, nu poate transmite datele c\u0103tre ter\u021bi \u0219i este obligat s\u0103 dezv\u0103luie informa\u021bii despre metodele de procesare a datelor. Serviciul trebuie, de asemenea, s\u0103 se angajeze s\u0103 nu cenzureze, s\u0103 nu filtreze, s\u0103 nu intervin\u0103 \u0219i s\u0103 nu blocheze traficul DNS, cu excep\u021bia situa\u021biilor prev\u0103zute de legisla\u021bie. <\/p>\n

Utilizarea DoH trebuie f\u0103cut\u0103 cu pruden\u021b\u0103. De exemplu, \u00een RF, adresele IP 104.16.248.249 \u0219i 104.16.249.249, asociate cu serverul DoH mozilla.cloudflare-dns.com propus \u00een mod implicit \u00een Firefox, sunt incluse<\/a><\/noindex> \u00een listele<\/a><\/noindex> blocaje<\/a><\/noindex> Roskomnadzor<\/a><\/noindex> la cererea instan\u021bei din Stavropol din 10.06.2013.<\/p>\n

Utilizarea DoH poate duce, de asemenea, la probleme \u00een domenii precum sistemele de control parental, accesul la spa\u021biile interne de nume \u00een sistemele corporative, alegerea rutelor \u00een sistemele de optimizare a livr\u0103rii con\u021binutului \u0219i \u00eendeplinirea ordinelor judec\u0103tore\u0219ti \u00een domeniul combaterii r\u0103sp\u00e2ndirii de con\u021binut ilegal \u0219i exploat\u0103rii minorilor. Pentru a ocoli astfel de probleme, a fost implementat \u0219i testat un sistem de verific\u0103ri, care dezactiveaz\u0103 automat DoH \u00een anumite condi\u021bii. <\/p>\n

Pentru determinarea resolverelor corporative se efectueaz\u0103 verific\u0103ri ale domeniilor neobi\u0219nuite de nivel superior (TLD) \u0219i returnarea adreselor intranet de c\u0103tre un resolver sistemic. Pentru a stabili includerea controlului parental se realizeaz\u0103 o tentativ\u0103 de rezolvare a numelui exampleadultsite.com, iar dac\u0103 rezultatul nu corespunde cu IP-ul real, se consider\u0103 c\u0103 blocarea con\u021binutului pentru adul\u021bi este activ\u0103 la nivel DNS. De asemenea, se verific\u0103 adresele IP Google \u0219i YouTube pentru a detecta \u00eenlocuirea acestora cu restrict.youtube.com, forcesafesearch.google.com \u0219i restrictmoderate.youtube.com. Aceste verific\u0103ri permit atacatorilor care controleaz\u0103 rezolvatorul sau care pot interveni \u00een traficul de date s\u0103 simuleze un astfel de comportament pentru a dezactiva criptarea traficului DNS.<\/p>\n

Folosirea unui serviciu DoH unic poate duce, de asemenea, la probleme de optimizare a traficului \u00een re\u021belele de livrare a con\u021binutului care efectueaz\u0103 echilibrarea traficului utiliz\u00e2nd DNS (serverul DNS al re\u021belei CDN formeaz\u0103 un r\u0103spuns pe baza adresei rezolutorului \u0219i furnizeaz\u0103 cel mai apropiat gazd\u0103 pentru a ob\u021bine con\u021binutul). Trimiterea unei soliciti DNS de la cel mai apropiat rezolutor de utilizator \u00een astfel de CDN-uri duce la returnarea adresei celui mai apropiat gazd\u0103 pentru utilizator, dar trimiterea unei solicit\u0103ri DNS de la un rezolutor centralizat va furniza adresa gazdei cea mai apropiat\u0103 de serverul DNS-over-HTTPS. Testarea \u00een practic\u0103 a ar\u0103tat c\u0103 utilizarea DNS-over-HTTP cu CDN-uri nu a dus practic la \u00eent\u00e2rzieri \u00eenainte de \u00eenceperea transferului de con\u021binut (pentru conexiuni rapide, \u00eent\u00e2rzierile nu au dep\u0103\u0219it 10 milisecunde, iar pe canalele de comunicare mai lente s-a observat chiar o accelerare a func\u021bion\u0103rii). Pentru a transmite informa\u021biile despre loca\u021bia clientului c\u0103tre rezolutorul CDN, s-a luat \u00een considerare utilizarea extensiei EDNS Client Subnet.<\/p>\n

<\/a><\/noindex><\/p>\n

Sursa: opennet.ro<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 Firefox \u043e\u0431\u044a\u044f\u0432\u0438\u043b\u0438 \u043e \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0438 \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e \u0440\u0435\u0436\u0438\u043c\u0430 DNS \u043f\u043e\u0432\u0435\u0440\u0445 HTTPS (DoH, DNS over HTTPS) \u0434\u043b\u044f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u0421\u0428\u0410. \u0428\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u0435 DNS-\u0442\u0440\u0430\u0444\u0438\u043a\u0430 \u0440\u0430\u0441\u0441\u043c\u0430\u0442\u0440\u0438\u0432\u0430\u0435\u0442\u0441\u044f \u043a\u0430\u043a \u043f\u0440\u0438\u043d\u0446\u0438\u043f\u0438\u0430\u043b\u044c\u043d\u043e \u0432\u0430\u0436\u043d\u044b\u0439 \u0444\u0430\u043a\u0442\u043e\u0440 \u0437\u0430\u0449\u0438\u0442\u044b \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439. \u041d\u0430\u0447\u0438\u043d\u0430\u044f \u0441 \u0441\u0435\u0433\u043e\u0434\u043d\u044f\u0448\u043d\u0435\u0433\u043e \u0434\u043d\u044f \u0432\u043e \u0432\u0441\u0435\u0445 \u043d\u043e\u0432\u044b\u0445 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0430\u0445, \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u043d\u044b\u0445 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c\u0438 \u0438\u0437 \u0421\u0428\u0410, DoH \u0430\u043a\u0442\u0438\u0432\u0438\u0440\u043e\u0432\u0430\u043d \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e. \u0421\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0445 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u0421\u0428\u0410 \u043f\u043b\u0430\u043d\u0438\u0440\u0443\u0435\u0442\u0441\u044f \u043f\u0435\u0440\u0435\u043a\u043b\u044e\u0447\u0438\u0442\u044c \u043d\u0430 DoH \u0432 \u0442\u0435\u0447\u0435\u043d\u0438\u0435 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u0438\u0445 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":71412,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-71411","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47DNS-over-HTTPS este activat implicit \u00een Firefox pentru utilizatorii din Statele Unite | ProHoster","description":"Dezvoltatorii Firefox au anun\u021bat activarea implicit\u0103.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/dns-over-https-vklyuchyon-po-umolchaniyu-v-firefox-dlya-polzovatelej-iz-ssha","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47DNS-over-HTTPS \u0432\u043a\u043b\u044e\u0447\u0451\u043d \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e \u0432 Firefox \u0434\u043b\u044f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u0421\u0428\u0410 | ProHoster","og:description":"\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 Firefox \u043e\u0431\u044a\u044f\u0432\u0438\u043b\u0438 \u043e \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0438 \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e.","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/dns-over-https-vklyuchyon-po-umolchaniyu-v-firefox-dlya-polzovatelej-iz-ssha","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-02-26T00:10:13+00:00","article:modified_time":"2020-03-03T13:10:46+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"71411","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 19:02:24","updated":"2022-10-03 11:24:30","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/71411","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=71411"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/71411\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media\/71412"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=71411"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=71411"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=71411"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}