IETF Logo Mail Archive

[TLS] Firefox and DoH, was Re: Mohamed Boucadair's Discuss on draft-ietf-tls-svcb-ech-07: (with DISCUSS and COMMENT)

Paul Wouters <paul.wouters@aiven.io> Thu, 01 May 2025 11:55 UTC

Return-Path: <paul.wouters@aiven.io>
X-Original-To: tls@mail2.ietf.org
Delivered-To: tls@mail2.ietf.org
Received: from localhost (localhost [127.0.0.1]) by mail2.ietf.org (Postfix) with ESMTP id 9FECB23922C4 for <tls@mail2.ietf.org>; Thu, 1 May 2025 04:55:56 -0700 (PDT)
X-Virus-Scanned: amavisd-new at ietf.org
X-Spam-Flag: NO
X-Spam-Score: -2.099
X-Spam-Level:
X-Spam-Status: No, score=-2.099 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=unavailable autolearn_force=no
Authentication-Results: mail2.ietf.org (amavisd-new); dkim=pass (1024-bit key) header.d=aiven.io
Received: from mail2.ietf.org ([166.84.6.31]) by localhost (mail2.ietf.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id qglXyEON6AqO for <tls@mail2.ietf.org>; Thu, 1 May 2025 04:55:55 -0700 (PDT)
Received: from mail-ed1-x535.google.com (mail-ed1-x535.google.com [IPv6:2a00:1450:4864:20::535]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature ECDSA (P-256) server-digest SHA256) (No client certificate requested) by mail2.ietf.org (Postfix) with ESMTPS id 91DBB239229E for <tls@ietf.org>; Thu, 1 May 2025 04:55:55 -0700 (PDT)
Received: by mail-ed1-x535.google.com with SMTP id 4fb4d7f45d1cf-5edc07c777eso1167508a12.3 for <tls@ietf.org>; Thu, 01 May 2025 04:55:55 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=aiven.io; s=google; t=1746100554; x=1746705354; darn=ietf.org; h=cc:to:subject:message-id:date:from:in-reply-to:references :mime-version:from:to:cc:subject:date:message-id:reply-to; bh=KHEF8nzBmm+z/zoMCoP9OkU8kIdsyNUmqa49Wku949I=; b=VNRbNX0cosWWbmEKGFktTsmK/WLGASClexG3CT5o7x2ITFOUkE2Pup0LZ5pCqg802G wj6nBPP5VjYxgXwZc5ChP8H/VPACFHCJN5HfVcYV3Swm/UTbsfV9Wm02mkvfn4dFSzNw 6v/rV+nWN/ONtlpVwJgU03p6xwqd4oR30/pyQ=
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1746100554; x=1746705354; h=cc:to:subject:message-id:date:from:in-reply-to:references :mime-version:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=KHEF8nzBmm+z/zoMCoP9OkU8kIdsyNUmqa49Wku949I=; b=rOdOV1pn5iM4tr54VwOKy8o+4YEmBmyKQVfOoWKEpyeIjWq/iKfBpzY6uMhpw8Rd6f BHBjmO/GpwP6DGBYLxDxkzVkeAnHAB5wGmkMqsd2axhoi9CNRfks8PK7+0P+piEb9i5y 8AgPUyzruKByd/F/TPBlcIMF1ZCvIs8phFMokvykYNOxFn9m93eueLprVN7lGilzD7UG wWMHeqE29WatfcsZ8lkg0TJMDeadQdCgWXeqe8075p6gnBW7ByOm8DF0JtmPM7fruBBK bcM9a/9U8usCHrztO08519iC+z++RGDi9lIycMf82JpEz5pW7Gyl52VMe3Vpuy/Tyu6P f82w==
X-Forwarded-Encrypted: i=1; AJvYcCVua8EpkbfaA0izD61QW3OcLK07YB//FRjmp23K41ByVd3LFXVNRKUiQYgTjMCU8OSxyg4=@ietf.org
X-Gm-Message-State: AOJu0YyYJylJS7MdZxJMIjR8i3SKB2eTo3IgLCefIF5lIB0nUktrraYN DNX3rb5axcnBFOBwYfraA2q43/KqQttcEaEJzlczC1sNw8N+gHjsUOD8HAUBlsyb0GqqL6BdWnq lY/LlSLE91FwXax+e5/vE5p2gPNxVdiUJC8sY+A==
X-Gm-Gg: ASbGncsJ2eTL7jtvj5tJFVojiMWTGK/zvZz8+ruaceprhn73Hc6YveKs4LO2O6V5JcH Sveyk71ggPTA2MOlqaVtiSzGYs0cVnYa4ntlKxQ+rFEuJABfjYUUkxJ/0oJX/JY4uQ8XQTs4TTv 95xW7wj6Q8yJjTjm4T49eH
X-Google-Smtp-Source: AGHT+IFpNRmSj4jq5Ws7dvq9qkxULEGi3VSi5NhvwhH6ppGwdICOCLY5rqIf8yRlYNjQ9NowsL7Wq72rYxxPF/fGAJc=
X-Received: by 2002:a05:6402:2808:b0:5e5:edf8:88f2 with SMTP id 4fb4d7f45d1cf-5f89bf165cfmr5515592a12.23.1746100554443; Thu, 01 May 2025 04:55:54 -0700 (PDT)
MIME-Version: 1.0
References: <174602502787.209839.15198947055297433739@dt-datatracker-9c7687889-5mqnr> <CABcZeBOUYt40teFTcrqY5+1CfuGs_YGtg-683+eoqZmuEygwsQ@mail.gmail.com>
In-Reply-To: <CABcZeBOUYt40teFTcrqY5+1CfuGs_YGtg-683+eoqZmuEygwsQ@mail.gmail.com>
From: Paul Wouters <paul.wouters@aiven.io>
Date: Thu, 01 May 2025 07:55:43 -0400
X-Gm-Features: ATxdqUEjUZj-NWdwNTSktbtd-DucDNh4O-DWwWVYhGcWNpYw1K_oF3-CmoRSoz0
Message-ID: <CAGL5yWZxZFJst29Gm9zQwJLXBdEjxVqS+yQZRig4Gfc18mwx-A@mail.gmail.com>
To: Eric Rescorla <ekr@rtfm.com>
Content-Type: multipart/alternative; boundary="0000000000004a8b3e063411b792"
Message-ID-Hash: AULUEFE24KG66PQFHJIUFHAWLJ3TCJ7A
X-Message-ID-Hash: AULUEFE24KG66PQFHJIUFHAWLJ3TCJ7A
X-MailFrom: paul.wouters@aiven.io
X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; header-match-tls.ietf.org-0; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header
CC: Mohamed Boucadair <mohamed.boucadair@orange.com>, The IESG <iesg@ietf.org>, draft-ietf-tls-svcb-ech@ietf.org, TLS Chairs <tls-chairs@ietf.org>, "<tls@ietf.org>" <tls@ietf.org>
X-Mailman-Version: 3.3.9rc6
Precedence: list
Subject: [TLS] Firefox and DoH, was Re: Mohamed Boucadair's Discuss on draft-ietf-tls-svcb-ech-07: (with DISCUSS and COMMENT)
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
Archived-At: <https://mailarchive.ietf.org/arch/msg/tls/dvKPaikq9v5DmnTYa7and3-qBCI>
List-Archive: <https://mailarchive.ietf.org/arch/browse/tls>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Owner: <mailto:tls-owner@ietf.org>
List-Post: <mailto:tls@ietf.org>
List-Subscribe: <mailto:tls-join@ietf.org>
List-Unsubscribe: <mailto:tls-leave@ietf.org>

On Wed, Apr 30, 2025 at 12:32 PM Eric Rescorla <ekr@rtfm.com> wrote:


> However, I believe that the
> existing client-side implementations implement their own resolvers; at
> least chrome and Firefox do so (Firefox, just for DoH, which is the
> only time it enables ECH).
>

Weird. My home network which is fully encrypted and trusted, and I don't
need local DoH. And now Firefox decides to not use
ECH to connections outside my home network? That seems pretty broken.

Paul

v2.46.0 | Report a Bug | By Email | System Status