4

Mozilla Firefox has added the ability to use Trusted Recursive Resolver within Firefox. This means that it's now possible to route DNS queries over HTTPS without additional software. It was included in Firefox 62, which is what the most rent Tor Browser is based off of. A user only needs to configure the browser to use this resolver by changing 2 settings in about:config. I tested it, and it seems to work OK.

See: https://blog.nightly.mozilla.org/2018/06/01/improving-dns-privacy-in-firefox/

Cloudflare now offer a Tor hidden DNS resolver with the TRR capability. Users can configure it in the above Firefox TRR settings. In my testing it works faster than clearnet resolvers, most likely because the traffic doesn't leave the Tor Network.

See: https://blog.cloudflare.com/welcome-hidden-resolver/

This method would seem to offer some additional protections against rogue exit nodes in two ways, ie. encrypting DNS queries, and preventing them from going through an exit node, altogether.

See: https://wiki.mozilla.org/Trusted_Recursive_Resolver

Since it's using HTTPS, and gets routed through the Tor socks proxy, I don't see any reason why this shouldn't be enabled by default. Is there any reason why this hasn't been added to Tor Browser Bundle?

Improve this question
3
  • 1
    Your question should be aimed at Tor admins on the tor project channel on their website. Not relevant for stackexchange. Also, you don't care about using a third party like cloudflare to resolve all of your requests. Don't they knowingly cooperate and pass on this metadata to governments upon request? If anything you should run your own DNS over HTTPS server. Like dohproxy.com
    – james-see
    Oct 7, 2019 at 18:55
  • 1
    If one is accessing the DoH resolver over Tor (as Cloudflare's hidden resolver appears to allow one to do), what metadata does Cloudflare have that they could turn over to law enforcement?
    – womble
    Oct 8, 2019 at 1:28
  • Typo: "rent" -> "recent".
    – Flux
    Sep 12, 2021 at 18:38

1 Answer 1

Reset to default
1

Only the developers of TBB could answer your question with 100% accuracy. A couple of possible reasons include:

  • The TBB developers haven't gotten around to it yet -- either flipping the switch, or (probably more likely) doing an analysis of the privacy trade-offs that would result from enabling such a setting; or
  • The TBB developers are dead-set against sending a whole pile of potentially interesting traffic to a single, centralised, US-based service, just on general principle.
Improve this answer

You must log in to answer this question.