From 7077f4caa5e8d31296201de3c32196d6beecdd6f Mon Sep 17 00:00:00 2001 From: Mikaela Suomalainen Date: Sun, 25 Aug 2019 13:38:12 +0300 Subject: [PATCH 1/5] dns: document enabling Firefox TRR --- _includes/sections/dns.html | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/_includes/sections/dns.html b/_includes/sections/dns.html index 219f170c..b5d6061f 100644 --- a/_includes/sections/dns.html +++ b/_includes/sections/dns.html @@ -307,6 +307,10 @@ github="https://github.com/jedisct1/dnscrypt-proxy"
  • Encrypted DNS clients for desktop:
  • Encrypted DNS clients for mobile: @@ -330,6 +334,13 @@ github="https://github.com/jedisct1/dnscrypt-proxy"
  • Further reading: -- 2.47.2 From 23f63299f4edffc690cfbee1f2e5c15dd2013baa Mon Sep 17 00:00:00 2001 From: Mikaela Suomalainen Date: Sun, 25 Aug 2019 13:48:18 +0300 Subject: [PATCH 2/5] browser-tweaks: rm/note that TRR/DoH/ESNI have moved --- _includes/sections/browser-tweaks.html | 19 ++----------------- 1 file changed, 2 insertions(+), 17 deletions(-) diff --git a/_includes/sections/browser-tweaks.html b/_includes/sections/browser-tweaks.html index 277bbd57..b523deb4 100644 --- a/_includes/sections/browser-tweaks.html +++ b/_includes/sections/browser-tweaks.html @@ -118,23 +118,8 @@ -
    network.trr.mode = 2
    -
    - Use Trusted Recursive Resolver (DNS-over-HTTPS) first and if it fails, use the system resolver Source -
      -
    • 0 = disabled by default, may change in the future
      • -
    • 1 = use the faster resolver
      • -
    • 2 = use DoH first, fallback to system resolver
      • -
    • 3 = only use DoH. This may require network.trr.bootstrapAddress or using an IP address in network.trr.uri.
      • -
    • 5 = explicitly disable DoH
      • -
    -
    - -
    network.trr.uri = CHANGEME
    -
    The address of your DNS-over-HTTPS provider, if you don't have one, check our encrypted DNS recommendations. It can also be changed in Settings, Network Settings, Enable DNS over HTTPS, Use Provider, Custom.
    - -
    network.security.esni.enabled = true
    -
    Hide the address which you are requesting SSL certificate for if the server supports it. This requires DoH/TRR to be enabled even on Android 9+ when Private DNS is enabled.
    +
    Looking for TRR, DoH or ESNI?
    +
    They have moved to our DNS page.
    webgl.disabled = true
    WebGL is a potential security risk. Source
    -- 2.47.2 From e0dfed8f5648cda0812c6d6133a74b4fadfa81c2 Mon Sep 17 00:00:00 2001 From: Mikaela Suomalainen Date: Sun, 25 Aug 2019 13:50:38 +0300 Subject: [PATCH 3/5] dns: fix formatting --- _includes/sections/dns.html | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/_includes/sections/dns.html b/_includes/sections/dns.html index b5d6061f..1191fef0 100644 --- a/_includes/sections/dns.html +++ b/_includes/sections/dns.html @@ -309,7 +309,7 @@ github="https://github.com/jedisct1/dnscrypt-proxy"
  • Firefox comes with built-in DoH support with Cloudflare set as the default resolver, but can be configured to use any DoH resolver. Currently Mozilla is conducting studies before enabling DoH by default for all US-based Firefox users.
    • -- 2.47.2 From 0022e09d9615acdd35d945eda458cfc8562edb7c Mon Sep 17 00:00:00 2001 From: Mikaela Suomalainen Date: Sun, 25 Aug 2019 13:55:47 +0300 Subject: [PATCH 4/5] browser-tweaks: fix embarassing typo --- _includes/sections/browser-tweaks.html | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/_includes/sections/browser-tweaks.html b/_includes/sections/browser-tweaks.html index b523deb4..a6cbb25b 100644 --- a/_includes/sections/browser-tweaks.html +++ b/_includes/sections/browser-tweaks.html @@ -119,7 +119,7 @@
    Looking for TRR, DoH or ESNI?
    -
    They have moved to our DNS page.
    +
    They have moved to our DNS page.
    webgl.disabled = true
    WebGL is a potential security risk. Source
    -- 2.47.2 From a663ab57b76f8251b5ce221777048e8372a56e26 Mon Sep 17 00:00:00 2001 From: Mikaela Suomalainen Date: Mon, 26 Aug 2019 00:11:35 +0300 Subject: [PATCH 5/5] browser-tweaks & dns: apply @nitrohorse's suggestions (and fix link) --- _includes/sections/browser-tweaks.html | 2 +- _includes/sections/dns.html | 6 +++--- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/_includes/sections/browser-tweaks.html b/_includes/sections/browser-tweaks.html index a6cbb25b..e12400be 100644 --- a/_includes/sections/browser-tweaks.html +++ b/_includes/sections/browser-tweaks.html @@ -119,7 +119,7 @@
    Looking for TRR, DoH or ESNI?
    -
    They have moved to our DNS page.
    +
    They have moved to our DNS page.
    webgl.disabled = true
    WebGL is a potential security risk. Source
    diff --git a/_includes/sections/dns.html b/_includes/sections/dns.html index 1191fef0..19c3e777 100644 --- a/_includes/sections/dns.html +++ b/_includes/sections/dns.html @@ -308,7 +308,7 @@ github="https://github.com/jedisct1/dnscrypt-proxy"
    • Firefox comes with built-in DoH support with Cloudflare set as the default resolver, but can be configured to use any DoH resolver. Currently Mozilla is conducting studies before enabling DoH by default for all US-based Firefox users.
        • -
      • DNS-over-HTTPS can be enabled in Menu -> Settings -> Network Settings -> Settings -> [x] enable DNS over HTTPS, use provider: custom, and enter the address you find from the documentation of your DoH provider.
        • +
      • DNS over HTTPS can be enabled in Menu -> Preferences (about:preferences) -> Network Settings -> Enable DNS over HTTPS. Set "Use Provider" to "Custom," and enter your DoH provider's address.
      • Advanced users may enable it in about:config by setting network.trr.custom_uri and network.trr.uri as the address you find from the documentation of your DoH provider and network.trr.mode as 2. It may also be desirable to set network.esni.enabled to True in order to enable encrypted SNI and make sites supporting ESNI a bit more difficult to track.
    @@ -338,8 +338,8 @@ github="https://github.com/jedisct1/dnscrypt-proxy"
  • QNAME Minimization and Your Privacy by the Internet Systems Consortium (ISC)
  • DNSSEC and BIND 9 by the ISC
    • -- 2.47.2