5 ms·

> As long as they keep privacy a priority, This whole DNS over HTTP disaster makes it pretty clear to me as an end user that it's not though. I wouldn't trust

> As long as they keep privacy a priority, This whole DNS over HTTP disaster makes it pretty clear to me as an end user that it's not though. I wouldn't trust a free VPN further than I can throw it, no matter who offered.

ignoramous 7y ago
> This whole DNS over HTTP disaster makes it pretty clear to me as an end user that it's not though. True. We've got DoT, which is a very viable alternative. Supported at OS level by Android. And there's DnsCrypt with clients on all major platforms. > I wouldn't trust a free VPN further than I can throw it, no matter who offered. Valid point. Though, the present situation is that one pays the ISPs and yet they traffic shape, surveil, censor their users. I fear, after a point, VPNs might be the only way to access censor-free Internet across the globe.
- tastroder 7y ago
  While I personally trust my ISP more than some random US based entity, that's of course true. The thing with VPN alternatives for me is that the VPN landscape today is already weirdly organized, opaque and would have no real incentive for a free tier. Short of hosting their own, which consumers will not do, I don't see a scenario where VPN providers end up in a position that's more trustful than your average (Western world) ISP is today tbh.
  - incompatible 7y ago
    I don't think any ISP can really be trusted, in most countries, since they are subject to arbitrary government demands. In Australia, for example, that includes data retention, censorship, and assistance with any kind of spying that may be demanded.
    - tastroder 7y ago
      Sure, valid as well. If VPNs get relevant enough to matter to nation state actors none of that really exclusively applies to ISPs anymore though, I feel like we're in a cozy transitioning stage there. They'd either get blocked (see feeble attempts in China) or get the same treatment. Either through similar legislation or technology level interference as we've seen before with the Tor network. At that point it's a game of choosing the nation state control you're most comfortable with in terms of oversight, governmental interference, consumer protection, and business incentive. That'll likely still be my European based ISP over a US VPN to be quite honest, given (theoretically) better consumer protection legislation and generally less equipped/capable surveillance apparatus. Don't get me wrong, VPNs e.g. for access control or untrusted networks are great use cases in my book. I just don't like the snake-oil vibe surrounding VPNs that make it out to be a great way to secure everyday networking for consumers.
Quequau 7y ago
What about one which was run sorta like Tarsnap?
- tastroder 7y ago
  Honestly not really familiar with that but from overview graphics it looks like if you wanted to adapt that to live connections you'd end up with something similar to Tor, right? That is nice of course but comes with its own drawbacks (a few that spring to mind are performance, potentially malicious exit nodes, inconvenience).
  - Quequau 7y ago
    Sorry no. I should have been more clear. I'm suggesting that the way Tarsnap organises its billing might be a good way for customers who buy VPNs to be sure that their browsing info is not actually the product the company offering the VPN is selling.
    - dewey 7y ago
      Isn’t that just a normal business then? You pay something, you get something.
      - Quequau 7y ago
        One would wish but alas a common mode of business is that people who consider themselves users sign up to use some service which is presented to them as being free, when all the while that company's actual business model is monetising those users' info and habits in every conceivable way and the 'service' is just the bait to get people on the hook.
    - tastroder 7y ago
      I've looked at their website, thanks for the pointer, I think I'll have to give them a go for my personal backups now :) As for the application to VPN, I can't see much of a difference to other trustworthy businesses to be honest, I think I missed something there - are you referring to the prepaid aspect?
slips 7y ago
How is it a disaster? From what I've seen, a number of gripes are due to people not actually understanding how DoH works or expecting it to do something it isn't designed to do.
- tastroder 7y ago
  Disaster was maybe too strong a word there. I personally don't like some aspects to put it more mildly. To me, the Firefox move centralises critical infrastructure behind players like cloudflare, including their non-contractual(?, at least not with me as the end user) promises and potential US influence. Guess we'll have to hope for upcoming transparency reports there and hope we don't find this part of the infrastructure as a sidenode in some NSA leak a decade down the road. In my view, once the stack is widely adopted, users will by default either use whatever firefox gives them, or talk to a DoH instance their ISP pushes (I assume there's still a mechanism for that?), not really achieving that much in terms of potential privacy breaches if somebody on the other side decides to act maliciously. Please correct me if I'm wrong here, it looks like a weird approach to fix a protocol on a lower OSI level. Instead of fixing DNS&DNSSEC privacy a few key players bypass and replace it with their own solution, with Firefox pushing it onto users. My major gripes there are the added complexity and an aversion to wrap our whole networking stack into HTTPS instead of addressing the underlying problems. I realize that's more philosophical than technical grievances though, sorry for the wording.
  - tptacek 7y ago
    DNSSEC explicitly doesn't provide privacy --- in fact, it does the opposite --- so if you were waiting for DNSSEC to hide your queries from your ISP's adtech analytics, you'd have been waiting a very long time indeed. Firefox made the right call. DoH, by the way, is also an open standard.

ignoramous 7y ago

> This whole DNS over HTTP disaster makes it pretty clear to me as an end user that it's not though. True. We've got DoT, which is a very viable alternative. Supported at OS level by Android. And there's DnsCrypt with clients on all major platforms. > I wouldn't trust a free VPN further than I can throw it, no matter who offered. Valid point. Though, the present situation is that one pays the ISPs and yet they traffic shape, surveil, censor their users. I fear, after a point, VPNs might be the only way to access censor-free Internet across the globe.

tastroder 7y ago
While I personally trust my ISP more than some random US based entity, that's of course true. The thing with VPN alternatives for me is that the VPN landscape today is already weirdly organized, opaque and would have no real incentive for a free tier. Short of hosting their own, which consumers will not do, I don't see a scenario where VPN providers end up in a position that's more trustful than your average (Western world) ISP is today tbh.
- incompatible 7y ago
  I don't think any ISP can really be trusted, in most countries, since they are subject to arbitrary government demands. In Australia, for example, that includes data retention, censorship, and assistance with any kind of spying that may be demanded.
  - tastroder 7y ago
    Sure, valid as well. If VPNs get relevant enough to matter to nation state actors none of that really exclusively applies to ISPs anymore though, I feel like we're in a cozy transitioning stage there. They'd either get blocked (see feeble attempts in China) or get the same treatment. Either through similar legislation or technology level interference as we've seen before with the Tor network. At that point it's a game of choosing the nation state control you're most comfortable with in terms of oversight, governmental interference, consumer protection, and business incentive. That'll likely still be my European based ISP over a US VPN to be quite honest, given (theoretically) better consumer protection legislation and generally less equipped/capable surveillance apparatus. Don't get me wrong, VPNs e.g. for access control or untrusted networks are great use cases in my book. I just don't like the snake-oil vibe surrounding VPNs that make it out to be a great way to secure everyday networking for consumers.

Quequau 7y ago

What about one which was run sorta like Tarsnap?

tastroder 7y ago
Honestly not really familiar with that but from overview graphics it looks like if you wanted to adapt that to live connections you'd end up with something similar to Tor, right? That is nice of course but comes with its own drawbacks (a few that spring to mind are performance, potentially malicious exit nodes, inconvenience).
- Quequau 7y ago
  Sorry no. I should have been more clear. I'm suggesting that the way Tarsnap organises its billing might be a good way for customers who buy VPNs to be sure that their browsing info is not actually the product the company offering the VPN is selling.
  - dewey 7y ago
    Isn’t that just a normal business then? You pay something, you get something.
    - Quequau 7y ago
      One would wish but alas a common mode of business is that people who consider themselves users sign up to use some service which is presented to them as being free, when all the while that company's actual business model is monetising those users' info and habits in every conceivable way and the 'service' is just the bait to get people on the hook.
  - tastroder 7y ago
    I've looked at their website, thanks for the pointer, I think I'll have to give them a go for my personal backups now :) As for the application to VPN, I can't see much of a difference to other trustworthy businesses to be honest, I think I missed something there - are you referring to the prepaid aspect?

slips 7y ago

How is it a disaster? From what I've seen, a number of gripes are due to people not actually understanding how DoH works or expecting it to do something it isn't designed to do.

tastroder 7y ago
Disaster was maybe too strong a word there. I personally don't like some aspects to put it more mildly. To me, the Firefox move centralises critical infrastructure behind players like cloudflare, including their non-contractual(?, at least not with me as the end user) promises and potential US influence. Guess we'll have to hope for upcoming transparency reports there and hope we don't find this part of the infrastructure as a sidenode in some NSA leak a decade down the road. In my view, once the stack is widely adopted, users will by default either use whatever firefox gives them, or talk to a DoH instance their ISP pushes (I assume there's still a mechanism for that?), not really achieving that much in terms of potential privacy breaches if somebody on the other side decides to act maliciously. Please correct me if I'm wrong here, it looks like a weird approach to fix a protocol on a lower OSI level. Instead of fixing DNS&DNSSEC privacy a few key players bypass and replace it with their own solution, with Firefox pushing it onto users. My major gripes there are the added complexity and an aversion to wrap our whole networking stack into HTTPS instead of addressing the underlying problems. I realize that's more philosophical than technical grievances though, sorry for the wording.
- tptacek 7y ago
  DNSSEC explicitly doesn't provide privacy --- in fact, it does the opposite --- so if you were waiting for DNSSEC to hide your queries from your ISP's adtech analytics, you'd have been waiting a very long time indeed. Firefox made the right call. DoH, by the way, is also an open standard.