3 ms·

Google or Mozilla picking DoH server for you is somehow good for privacy, instead of using one configured by you and outside of their control. Sounds ridiculous

Google or Mozilla picking DoH server for you is somehow good for privacy, instead of using one configured by you and outside of their control. Sounds ridiculous, doesn't it? If not a deliberate attempt to make it harder for users to get any privacy by tracking them across changing ISPs and VPNs.

Spivak 8y ago
And you think you'll have better privacy sending queries to whatever server DHCP hands out? If you're configuring your own DNS server you're waaaay out of scope for the problems this is trying to address.
- zzzcpan 8y ago
  > And you think you'll have better privacy sending queries to whatever server DHCP hands out? Yes, because you have to trust one less third party if you use whatever internet connection DHCP provides you. ISPs can see IP addresses you connect to anyway and can figure out what domains and services they belong to. If you don't trust that DHCP, you have to use at least a trustworthy VPN to have some privacy improvement, DoH to a third party will only make it worse.
- LinuxBender 8y ago
  At work, yes. DoH will leak corporate internal DNS and lead to the public resolvers getting null routed. At home, I block all the public resolvers on my router and intercept DNS, tunnel it through a vpn mesh. For most people at public open WiFi spots, DoH could certainly help.
- josteink 8y ago
  > And you think you'll have better privacy sending queries to whatever server DHCP hands out? Yes. Because that's my network, my DHCP and something I have 100% control over. There's literally nothing in the universe which better protects my privacy.
  - da_chicken 8y ago
    I think the criticism there is guest WiFi, but you can always configure your system to use a specific DNS server if you wish.
xg15 8y ago
To be honest, I find the privacy thing is a red herring here. Yes, your browsing habits can be tracked, but there are already dozens easier ways to do that. What I see as more concerning is that this could hugely shift how the whole system of domains runs. In the worst case, if a single (or a small group of) DoH services turn out to be dominating, they will effectively have full control over all domains - even local ones. If you want to make a domain inaccessible, no need to bother with the registrar, simply stop serving it. Want to add a new top-level domain without handing the IANA billions of dollars? No problem, just start to serve it tomorrow - "technically", it won't be a valid domain, but who cares if all browsers resolve it? Think another domain is rightfully yours? You can file a dispute with the registrar and "proactively" redirect it to your own servers while the dispute is processed.
- belorn 8y ago
  Maybe this is posted somewhere else, but where does it say that the browser will run towards a specific recursive resolver rather than simply do the job of the recursive resolving itself? I know that both Cloudflare and Google are attempting become the central recursive resolver for everyone, but it seems to me that if we are abandoning the current system of having the ISP as your automatic recursive resolver, then the step to just do it yourself has gotten very small. The only argument I have heard against it is that users will rebel from the extra milliseconds from not getting a cached response from a local cache, compared to the anycast response that most large site has for DNS (which given the practical nature of anycast, will be more or less the same local provider).
  - zzzcpan 8y ago
    Anycast and servers all over the globe don't help with latency. You also need to keep refreshing DNS records in background and have massive cache. But the memory is limited and you can't refresh everything for everyone. So only a percentage of queries can get responses from cache. If your own resolver could refresh records in background, you would get more responses from cache than sharing it with everyone. You also won't be affected by things like server load and connectivity issues, so you'll get overall better latency with queries mostly served from own cache matching your personal profile.

Spivak 8y ago

And you think you'll have better privacy sending queries to whatever server DHCP hands out? If you're configuring your own DNS server you're waaaay out of scope for the problems this is trying to address.

zzzcpan 8y ago
> And you think you'll have better privacy sending queries to whatever server DHCP hands out? Yes, because you have to trust one less third party if you use whatever internet connection DHCP provides you. ISPs can see IP addresses you connect to anyway and can figure out what domains and services they belong to. If you don't trust that DHCP, you have to use at least a trustworthy VPN to have some privacy improvement, DoH to a third party will only make it worse.
LinuxBender 8y ago
At work, yes. DoH will leak corporate internal DNS and lead to the public resolvers getting null routed. At home, I block all the public resolvers on my router and intercept DNS, tunnel it through a vpn mesh. For most people at public open WiFi spots, DoH could certainly help.
josteink 8y ago
> And you think you'll have better privacy sending queries to whatever server DHCP hands out? Yes. Because that's my network, my DHCP and something I have 100% control over. There's literally nothing in the universe which better protects my privacy.
- da_chicken 8y ago
  I think the criticism there is guest WiFi, but you can always configure your system to use a specific DNS server if you wish.

xg15 8y ago

To be honest, I find the privacy thing is a red herring here. Yes, your browsing habits can be tracked, but there are already dozens easier ways to do that. What I see as more concerning is that this could hugely shift how the whole system of domains runs. In the worst case, if a single (or a small group of) DoH services turn out to be dominating, they will effectively have full control over all domains - even local ones. If you want to make a domain inaccessible, no need to bother with the registrar, simply stop serving it. Want to add a new top-level domain without handing the IANA billions of dollars? No problem, just start to serve it tomorrow - "technically", it won't be a valid domain, but who cares if all browsers resolve it? Think another domain is rightfully yours? You can file a dispute with the registrar and "proactively" redirect it to your own servers while the dispute is processed.

belorn 8y ago
Maybe this is posted somewhere else, but where does it say that the browser will run towards a specific recursive resolver rather than simply do the job of the recursive resolving itself? I know that both Cloudflare and Google are attempting become the central recursive resolver for everyone, but it seems to me that if we are abandoning the current system of having the ISP as your automatic recursive resolver, then the step to just do it yourself has gotten very small. The only argument I have heard against it is that users will rebel from the extra milliseconds from not getting a cached response from a local cache, compared to the anycast response that most large site has for DNS (which given the practical nature of anycast, will be more or less the same local provider).
- zzzcpan 8y ago
  Anycast and servers all over the globe don't help with latency. You also need to keep refreshing DNS records in background and have massive cache. But the memory is limited and you can't refresh everything for everyone. So only a percentage of queries can get responses from cache. If your own resolver could refresh records in background, you would get more responses from cache than sharing it with everyone. You also won't be affected by things like server load and connectivity issues, so you'll get overall better latency with queries mostly served from own cache matching your personal profile.