ESNI configuration option not working
Categories
(Core :: Networking, enhancement)
Tracking
()
People
(Reporter: maxh, Unassigned)
Details
User Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/77.0.3817.0 Safari/537.36
Steps to reproduce:
With network.security.esni.enabled set to true, I used Cloudflare's ESNI check service.
Actual results:
The service reports that Firefox did not encrypt the SNI.
Expected results:
Firefox should encrypt the SNI.
Try setting network.trr.mode to 2 or 3.
source:
https://blog.mozilla.org/security/2018/10/18/encrypted-sni-comes-to-firefox-nightly/
https://blog.nightly.mozilla.org/2018/06/01/improving-dns-privacy-in-firefox/
|
Reporter | |
Comment 2•5 years ago
|
||
That does work. I would argue, though, that it should not be required. My computer is already set up to use DNS over TLS directly — why do I need to add an HTTP layer to DNS requests to be able to encrypt the SNI?
|
||
Comment 3•5 years ago
|
||
Valentin, can you please elaborate what is expected here?
|
||
Comment 4•5 years ago
|
||
(In reply to Max Harmony from comment #2)
That does work. I would argue, though, that it should not be required. My computer is already set up to use DNS over TLS directly — why do I need to add an HTTP layer to DNS requests to be able to encrypt the SNI?
See bug 1542754 comment 3
At the moment Firefox can only resolve TXT records using TRR (DoH), so that is required in order for ESNI to work.
Description
•