{"id":71411,"date":"2020-02-26T03:10:13","date_gmt":"2020-02-26T00:10:13","guid":{"rendered":"https:\/\/prohoster.info\/blog\/dns-over-https-vklyuchyon-po-umolchaniyu-v-firefox-dlya-polzovatelej-iz-ssha"},"modified":"2020-03-03T16:10:46","modified_gmt":"2020-03-03T13:10:46","slug":"dns-over-https-vklyuchyon-po-umolchaniyu-v-firefox-dlya-polzovatelej-iz-ssha","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sk\/blog\/news\/dns-over-https-vklyuchyon-po-umolchaniyu-v-firefox-dlya-polzovatelej-iz-ssha","title":{"rendered":"DNS-over-HTTPS je v predvolenom nastaven\u00ed povolen\u00fd v prehliada\u010di Firefox pre pou\u017e\u00edvate\u013eov v USA.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

V\u00fdvoj\u00e1ri Firefox ozn\u00e1mili<\/a><\/noindex> o zapnut\u00ed predvolen\u00e9ho re\u017eimu DNS cez HTTPS (DoH, DNS over HTTPS) pre pou\u017e\u00edvate\u013eov v USA. \u0160ifrovanie DNS prev\u00e1dzky sa pova\u017euje za z\u00e1sadn\u00fd faktor ochrany pou\u017e\u00edvate\u013eov. Od dne\u0161n\u00e9ho d\u0148a je DoH vo v\u0161etk\u00fdch nov\u00fdch in\u0161tal\u00e1ci\u00e1ch, ktor\u00e9 uskuto\u010dnili pou\u017e\u00edvatelia z USA, predvolene aktivovan\u00e9. Existuj\u00facich pou\u017e\u00edvate\u013eov z USA pl\u00e1nujeme prepn\u00fa\u0165 na DoH po\u010das nasleduj\u00facich t\u00fd\u017ed\u0148ov. V Eur\u00f3pskej \u00fanii a in\u00fdch krajin\u00e1ch sa zatia\u013e DoH predvolene aktivova\u0165 nepl\u00e1nuje. nepl\u00e1nuj\u00fa<\/a><\/noindex>.<\/p>\n

Po aktiv\u00e1cii DoH sa pou\u017e\u00edvate\u013eovi zobrazuje upozornenie, ktor\u00e9 mu umo\u017e\u0148uje v pr\u00edpade potreby zru\u0161i\u0165 pr\u00edstup k centralizovan\u00fdm DNS DoH serverom a vr\u00e1ti\u0165 sa k tradi\u010dn\u00e9mu sp\u00f4sobu zasielania ne\u0161ifrovan\u00fdch po\u017eiadaviek na poskytovate\u013eov DNS. Namiesto distribuovanej infra\u0161trukt\u00fary DNS resolverov sa v DoH vyu\u017e\u00edva viazanie na konkr\u00e9tnu DoH slu\u017ebu, ktor\u00e1 m\u00f4\u017ee by\u0165 pova\u017eovan\u00e1 za jedin\u00fd bod zlyhania. V s\u00fa\u010dasnosti s\u00fa k dispoz\u00edcii slu\u017eby dvoch DNS poskytovate\u013eov \u2014 CloudFlare (predvolene) a NextDNS<\/a><\/noindex>. <\/p>\n

\"DNS-over-HTTPS<\/a><\/noindex><\/center><\/p>\n

Zmeni\u0165 poskytovate\u013ea alebo vypn\u00fa\u0165 DoH mo\u017en\u00e9<\/a><\/noindex> v nastaveniach sie\u0165ov\u00e9ho pripojenia. Napr\u00edklad, m\u00f4\u017eete zada\u0165 alternat\u00edvny DoH server \u201ehttps:\/\/dns.google\/dns-query\u201c pre pr\u00edstup k serverom Google, \u201ehttps:\/\/dns.quad9.net\/dns-query\u201c \u2014 Quad9 a \u201ehttps:\/\/doh.opendns.com\/dns-query\u201c \u2014 OpenDNS. V about:config je tie\u017e poskytnut\u00e9 nastavenie network.trr.mode, prostredn\u00edctvom ktor\u00e9ho m\u00f4\u017eete zmeni\u0165 re\u017eim fungovania DoH: hodnota 0 \u00faplne vyp\u00edna DoH; 1 \u2014 vyu\u017e\u00edva DNS alebo DoH v z\u00e1vislosti od toho, \u010do je r\u00fdchlej\u0161ie; 2 \u2014 vyu\u017e\u00edva DoH ako predvolen\u00fa mo\u017enos\u0165, zatia\u013e \u010do DNS ako z\u00e1lo\u017en\u00fa; 3 \u2014 pou\u017e\u00edva iba DoH; 4 \u2014 re\u017eim zrkadlenia, v ktorom s\u00fa DoH a DNS zapojen\u00e9 paralelne. <\/p>\n

Pripom\u00edname, \u017ee DoH m\u00f4\u017ee by\u0165 u\u017eito\u010dn\u00e9 na elimin\u00e1ciu \u00fanikov inform\u00e1ci\u00ed o po\u017eadovan\u00fdch n\u00e1zvoch hostite\u013eov cez DNS servery poskytovate\u013eov, na boj proti MITM \u00fatokom a podvodom s DNS prev\u00e1dzky (napr\u00edklad pri pripojen\u00ed k verejn\u00fdm Wi-Fi), na odpor vo\u010di blok\u00e1ci\u00e1m na \u00farovni DNS (DoH nem\u00f4\u017ee nahradi\u0165 VPN v oblasti obch\u00e1dzania blok\u00e1d implementovan\u00fdch na \u00farovni DPI) alebo na organiz\u00e1ciu pr\u00e1ce v pr\u00edpade nemo\u017enosti priamych pr\u00edstupov k DNS serverom (napr\u00edklad pri pr\u00e1ci cez proxy). V norm\u00e1lnych situ\u00e1ci\u00e1ch s\u00fa DNS po\u017eiadavky priamo odosielan\u00e9 na ur\u010dit\u00e9 DNS servery definovan\u00e9 v konfigur\u00e1cii syst\u00e9mu, zatia\u013e \u010do v pr\u00edpade DoH sa po\u017eiadavka na ur\u010denie IP adresy hostite\u013ea inkapsuluje do HTTPS prev\u00e1dzky a odosiela na HTTP server, na ktorom resolver spracov\u00e1va po\u017eiadavky cez Web API. Existuj\u00faci \u0161tandard DNSSEC pou\u017e\u00edva \u0161ifrovanie len na autentifik\u00e1ciu klienta a servera, ale neochr\u00e1ni prev\u00e1dzku pred zachyten\u00edm a nezaru\u010duje d\u00f4vernos\u0165 po\u017eiadaviek. <\/p>\n

Na v\u00fdber poskytovate\u013eov DoH, pon\u00fakan\u00fdch vo Firefoxe, s\u00fa stanoven\u00e9 po\u017eiadavky<\/a><\/noindex> na d\u00f4veryhodn\u00e9 DNS resolvery, pod\u013ea ktor\u00fdch m\u00f4\u017ee DNS oper\u00e1tor pou\u017e\u00edva\u0165 z\u00edskan\u00e9 \u00fadaje na rozl\u00ed\u0161enie len na zabezpe\u010denie fungovania slu\u017eby, nemal by uchov\u00e1va\u0165 logy dlh\u0161ie ako 24 hod\u00edn, nem\u00f4\u017ee pren\u00e1\u0161a\u0165 \u00fadaje tret\u00edm stran\u00e1m a je povinn\u00fd odhali\u0165 inform\u00e1cie o met\u00f3dach spracovania \u00fadajov. Slu\u017eba by mala tie\u017e urobi\u0165 z\u00e1v\u00e4zky, \u017ee nebude cenzurova\u0165, filtrova\u0165, zasahova\u0165 a blokova\u0165 DNS prev\u00e1dzku, okrem situ\u00e1ci\u00ed predp\u00edsan\u00fdch z\u00e1konom. <\/p>\n

Pou\u017e\u00edva\u0165 DoH by sa malo opatrne. Napr\u00edklad v RF s\u00fa IP adresy 104.16.248.249 a 104.16.249.249, spojen\u00e9 s predvolene pon\u00fakan\u00fdm DoH serverom mozilla.cloudflare-dns.com, zaraden\u00e9<\/a><\/noindex> v zoznamy<\/a><\/noindex> z\u00e1mky<\/a><\/noindex> Roskomnadzoru<\/a><\/noindex> na po\u017eiadanie s\u00fadu v Stavropole zo 10.06.2013.<\/p>\n

Pou\u017eitie DoH m\u00f4\u017ee tie\u017e vies\u0165 k probl\u00e9mom v oblastiach, ako s\u00fa syst\u00e9my rodi\u010dovskej kontroly, pr\u00edstup do vn\u00fatorn\u00fdch n\u00e1zvov\u00fdch priestorov v podnikov\u00fdch syst\u00e9moch, v\u00fdber tr\u00e1s v syst\u00e9moch optimaliz\u00e1cie dod\u00e1vok obsahu a vykon\u00e1vanie s\u00fadnych pr\u00edkazov v oblasti boja proti \u0161\u00edreniu neleg\u00e1lneho obsahu a zneu\u017e\u00edvaniu nezletil\u00fdch. Na ob\u00eddenie tak\u00fdchto probl\u00e9mov bola implementovan\u00e1 a otestovan\u00e1 syst\u00e9m kontrol, ktor\u00fd automaticky vypne DoH za ur\u010dit\u00fdch podmienok. <\/p>\n

Na ur\u010denie firemn\u00fdch resolverov sa vykon\u00e1vaj\u00fa kontroly netypick\u00fdch dom\u00e9n prvej \u00farovne (TLD) a vr\u00e1tenie intranetov\u00fdch adries syst\u00e9mov\u00fdm resolverom. Na ur\u010denie zapojenia rodi\u010dovskej kontroly sa sk\u00fa\u0161a rezolvovanie mena exampleadultsite.com, a ak sa v\u00fdsledok nezhoduje s aktu\u00e1lnou IP, pova\u017euje sa to za akt\u00edvnu blok\u00e1ciu obsahu pre dospel\u00fdch na \u00farovni DNS. Ako znaky sa tie\u017e kontroluj\u00fa IP adresy Google a YouTube na ich nahradenie na restrict.youtube.com, forcesafesearch.google.com a restrictmoderate.youtube.com. Tieto kontroly umo\u017e\u0148uj\u00fa \u00fato\u010dn\u00edkom, ktor\u00ed ovl\u00e1daj\u00fa pr\u00e1cu resolvera alebo m\u00f4\u017eu zasahova\u0165 do prev\u00e1dzky, simulova\u0165 tak\u00e9to spr\u00e1vanie na odhl\u00e1senie \u0161ifrovania DNS prev\u00e1dzky.<\/p>\n

Pr\u00e1ca prostredn\u00edctvom jednotn\u00e9ho DoH servisu m\u00f4\u017ee potenci\u00e1lne sp\u00f4sobi\u0165 probl\u00e9my s optimaliz\u00e1ciou prev\u00e1dzky v sie\u0165ach doru\u010dovania obsahu, ktor\u00e9 vykon\u00e1vaj\u00fa vyv\u00e1\u017eenie prev\u00e1dzky pomocou DNS (DNS server CDN siete generuje odpove\u010f, ber\u00fac do \u00favahy adresu rezolv\u00e9ra a poskytuje najbli\u017e\u0161\u00ed hostite\u013e na z\u00edskanie obsahu). Odoslanie DNS po\u017eiadavky z najbli\u017e\u0161ieho rezolv\u00e9ra k pou\u017e\u00edvate\u013eovi v tak\u00fdch CDN vedie k vr\u00e1teniu adresy najbli\u017e\u0161ieho hostite\u013ea k pou\u017e\u00edvate\u013eovi, ale pri odosielan\u00ed DNS po\u017eiadavky z centralizovan\u00e9ho rezolv\u00e9ra bude vydan\u00e1 adresa hostite\u013ea, najbli\u017e\u0161ieho k serveru DNS-over-HTTPS. Testovanie v praxi uk\u00e1zalo, \u017ee pou\u017eitie DNS-over-HTTP pri pou\u017e\u00edvan\u00ed CDN prakticky nesp\u00f4sobilo oneskorenia pred za\u010diatkom prenosu obsahu (pre r\u00fdchle pripojenia oneskorenia neprekro\u010dili 10 milisek\u00fand a na pomal\u0161\u00edch pripojeniach sa dokonca sledovalo zr\u00fdchlenie). Pre prenos inform\u00e1ci\u00ed o lokaliz\u00e1cii klienta do rezolv\u00e9ra CDN sa tie\u017e zva\u017eovalo vyu\u017eitie roz\u0161\u00edrenia EDNS Client Subnet.<\/p>\n

<\/a><\/noindex><\/p>\n

Zdroj: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 Firefox \u043e\u0431\u044a\u044f\u0432\u0438\u043b\u0438 \u043e \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0438 \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e \u0440\u0435\u0436\u0438\u043c\u0430 DNS \u043f\u043e\u0432\u0435\u0440\u0445 HTTPS (DoH, DNS over HTTPS) \u0434\u043b\u044f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u0421\u0428\u0410. \u0428\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u0435 DNS-\u0442\u0440\u0430\u0444\u0438\u043a\u0430 \u0440\u0430\u0441\u0441\u043c\u0430\u0442\u0440\u0438\u0432\u0430\u0435\u0442\u0441\u044f \u043a\u0430\u043a \u043f\u0440\u0438\u043d\u0446\u0438\u043f\u0438\u0430\u043b\u044c\u043d\u043e \u0432\u0430\u0436\u043d\u044b\u0439 \u0444\u0430\u043a\u0442\u043e\u0440 \u0437\u0430\u0449\u0438\u0442\u044b \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439. \u041d\u0430\u0447\u0438\u043d\u0430\u044f \u0441 \u0441\u0435\u0433\u043e\u0434\u043d\u044f\u0448\u043d\u0435\u0433\u043e \u0434\u043d\u044f \u0432\u043e \u0432\u0441\u0435\u0445 \u043d\u043e\u0432\u044b\u0445 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0430\u0445, \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u043d\u044b\u0445 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c\u0438 \u0438\u0437 \u0421\u0428\u0410, DoH \u0430\u043a\u0442\u0438\u0432\u0438\u0440\u043e\u0432\u0430\u043d \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e. \u0421\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0445 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u0421\u0428\u0410 \u043f\u043b\u0430\u043d\u0438\u0440\u0443\u0435\u0442\u0441\u044f \u043f\u0435\u0440\u0435\u043a\u043b\u044e\u0447\u0438\u0442\u044c \u043d\u0430 DoH \u0432 \u0442\u0435\u0447\u0435\u043d\u0438\u0435 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u0438\u0445 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":71412,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-71411","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47DNS-over-HTTPS je predvolene zapnut\u00e9 vo Firefox pre pou\u017e\u00edvate\u013eov v USA | ProHoster","description":"V\u00fdvoj\u00e1ri Firefoxu ozn\u00e1mili, \u017ee je zapnut\u00fd predvolene.","canonical_url":"https:\/\/prohoster.info\/sk\/blog\/news\/dns-over-https-vklyuchyon-po-umolchaniyu-v-firefox-dlya-polzovatelej-iz-ssha","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sk_SK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47DNS-over-HTTPS \u0432\u043a\u043b\u044e\u0447\u0451\u043d \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e \u0432 Firefox \u0434\u043b\u044f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u0421\u0428\u0410 | ProHoster","og:description":"\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 Firefox \u043e\u0431\u044a\u044f\u0432\u0438\u043b\u0438 \u043e \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0438 \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e.","og:url":"https:\/\/prohoster.info\/sk\/blog\/news\/dns-over-https-vklyuchyon-po-umolchaniyu-v-firefox-dlya-polzovatelej-iz-ssha","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-02-26T00:10:13+00:00","article:modified_time":"2020-03-03T13:10:46+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"71411","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 19:02:24","updated":"2022-10-03 11:24:30","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/71411","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/comments?post=71411"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/71411\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media\/71412"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media?parent=71411"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/categories?post=71411"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/tags?post=71411"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}