5 ms·

Of course, I'd rather trust unecncrypted plaintext DNS queries that go to my ISP and government! If you don't like CF just switch to different provider https:/

by akerro 7y ago

Of course, I'd rather trust unecncrypted plaintext DNS queries that go to my ISP and government! If you don't like CF just switch to different provider https://github.com/curl/curl/wiki/DNS-over-HTTPS https://github.com/curl/curl/wiki/DNS-over-HTTPS

ndidi 7y ago
I do trust my ISP and my government more than I trust CloudFlare.
- dao- 7y ago
  Is your ISP in the US and your government the US government? The DoH rollout w/ Cloudflare is only planned for the US.
  - vetinari 7y ago
    > The DoH rollout w/ Cloudflare is only planned for the US. For now.
- seszett 7y ago
  It seems very American to me to trust a private actor such as CouldFlare more than your own government. I feel like at least in Europe, a large majority of people would trust their government and local ISP much more than some company halfway over the world with basically no accountancy in your own country, especially an American one since it means your data is basically at the mercy of the US government.
  - buildzr 7y ago
    Aren't there a bunch of European ISPs applying government enforced DNS blocking? Seems like this is a very good move for them.
    - q3k 7y ago
      The ISP I run is applying [1] such blocks on our DNS recursors (blocking illegal online gambling domains, as per legal requirements [2]). I still trust my DNS servers (or those of most ISPs, for that matter) more than I trust Cloudflare. I'd rather have intelligence services go through the effort of infiltrating every single ISP separately to get any useful dragnet intelligence, instead of just one large entity that can illegally collect all traffic from all users of a web browser. [1] - https://github.com/q3k/rsh-unbound https://github.com/q3k/rsh-unbound [2] - https://hazard.mf.gov.pl/Ustawa https://hazard.mf.gov.pl/Ustawa
  - yuft 7y ago
    Cloudflare has a better track record than most ISPs and governments.
- stakhanov 7y ago
  Couldn't agree more. And I very much hope they aren't contemplating rolling this out in Europe. Having worked for a major European telco, I get the impression that the amount of regulation they face around data protection and privacy is tremendous and my experience has been that this stuff is by no means taken lightly either. It would never in a million years occur to me to route my traffic in such a way as to circumvent the legal protections it enjoys as long as it stays within a European ISP's network and instead encrypt it and send it off to a nearly unregulated entity in a foreign country.
- diffeomorphism 7y ago
  I trust Mozilla and the contract they have with CloudFlare (not just CloudFlare by itself) more than my ISP. > https://support.mozilla.org/en-US/kb/firefox-dns-over-https https://support.mozilla.org/en-US/kb/firefox-dns-over-https Mozilla has a strong Trusted Recursive Resolver (TRR) policy in place that forbids CloudFlare or any other DoH partner from collecting personal identifying information. To mitigate this risk, our partners are contractually bound to adhere to this policy. These are much stronger guarantees than my ISP's.
Aaargh20318 7y ago
> I'd rather trust unecncrypted plaintext DNS queries that go to my ISP and government! I trust my ISP and government more than a US company I have no formal contract with and the US government. Also, there's the whole 'applications should not override system level settings' thing. My DHCP pushes a local (caching) DNS server that also does name resolution for internal services. This change would break that for all Firefox users on my network.
- roblabla 7y ago
  > I trust my ISP and government more than a US company I have no formal contract with and the US government. And every single intermediary and whoever else might be listening in? This is an unencrypted plaintext connection. Which is the main point here. The whole "we trust ISP more" thing is completely beside the point. The point is DNS is horribly insecure nowadays, and it is about damn time we switch to something better. > Also, there's the whole 'applications should not override system level settings' thing. Hopefully, DoH will become a system level setting eventually.
  - lima 7y ago
    There aren't many intermediaries if you use your ISP's internal resolvers.
    - vetinari 7y ago
      And there are intermediaries between Cloudflare/other DoH providers and the respective authoritative nameservers anyway.
      - m-p-3 7y ago
        But unless they have the private key for CloudFlare certs, they can't snoop in so it doesn't matter if there are intermediaries in between.
        vetinari 7y ago
lima 7y ago
I live in Europe and I do trust my ISP (and government, which has a decent track record at enforcing GDPR). Even with DoH, my ISP already sees all of my network traffic. My DNS queries will effectively be anonymized by their recursive name servers.
- dao- 7y ago
  > I live in Europe and I do trust my ISP (and government, which has a decent track record at enforcing GDPR). I believe the GP comment was referring to government surveillance. This is a thing in Europe and GDPR won't protect you from it. Also, good news for you: Since you live in Europe, the announced switch to DoH with Cloudflare as the default for Firefox users in the US won't affect you.
w8rbt 7y ago
Absolutely. This warning seems disingenuous and will confuse many normal people. DNS over HTTPs and DNS over TLS are good things and increase our privacy. People should switch to them.
zzzcpan 7y ago
> I'd rather trust unecncrypted plaintext DNS queries that go to my ISP and government! Your ISP has access to more detailed data on you than DNS queries. Also CF servers are typically located in the same jurisdiction as your government and send unencrypted DNS queries from there. Now instead of dealing with every ISP your government has to deal with just one company in one location, no need to even ask that company anything, just come in and setup mirroring point, very convenient for the government, not very good for you.
- comex 7y ago
  They can log unencrypted DNS queries coming from Cloudflare, yes. But they can't correlate those with the incoming encrypted queries, not when the amount of traffic coming in is as vast as it will be. It doesn't help much to know "some Firefox user somewhere tried to resolve such-and-such domain".
krzyk 7y ago
Are there any GDPR compliant entities there? Preferably some company/organization from Europe?

by akerro 7y ago

ndidi 7y ago

I do trust my ISP and my government more than I trust CloudFlare.

dao- 7y ago
Is your ISP in the US and your government the US government? The DoH rollout w/ Cloudflare is only planned for the US.
- vetinari 7y ago
  > The DoH rollout w/ Cloudflare is only planned for the US. For now.
seszett 7y ago
It seems very American to me to trust a private actor such as CouldFlare more than your own government. I feel like at least in Europe, a large majority of people would trust their government and local ISP much more than some company halfway over the world with basically no accountancy in your own country, especially an American one since it means your data is basically at the mercy of the US government.
- buildzr 7y ago
  Aren't there a bunch of European ISPs applying government enforced DNS blocking? Seems like this is a very good move for them.
  - q3k 7y ago
    The ISP I run is applying [1] such blocks on our DNS recursors (blocking illegal online gambling domains, as per legal requirements [2]). I still trust my DNS servers (or those of most ISPs, for that matter) more than I trust Cloudflare. I'd rather have intelligence services go through the effort of infiltrating every single ISP separately to get any useful dragnet intelligence, instead of just one large entity that can illegally collect all traffic from all users of a web browser. [1] - https://github.com/q3k/rsh-unbound https://github.com/q3k/rsh-unbound [2] - https://hazard.mf.gov.pl/Ustawa https://hazard.mf.gov.pl/Ustawa
- yuft 7y ago
  Cloudflare has a better track record than most ISPs and governments.
stakhanov 7y ago
Couldn't agree more. And I very much hope they aren't contemplating rolling this out in Europe. Having worked for a major European telco, I get the impression that the amount of regulation they face around data protection and privacy is tremendous and my experience has been that this stuff is by no means taken lightly either. It would never in a million years occur to me to route my traffic in such a way as to circumvent the legal protections it enjoys as long as it stays within a European ISP's network and instead encrypt it and send it off to a nearly unregulated entity in a foreign country.
diffeomorphism 7y ago
I trust Mozilla and the contract they have with CloudFlare (not just CloudFlare by itself) more than my ISP. > https://support.mozilla.org/en-US/kb/firefox-dns-over-https https://support.mozilla.org/en-US/kb/firefox-dns-over-https Mozilla has a strong Trusted Recursive Resolver (TRR) policy in place that forbids CloudFlare or any other DoH partner from collecting personal identifying information. To mitigate this risk, our partners are contractually bound to adhere to this policy. These are much stronger guarantees than my ISP's.

Aaargh20318 7y ago

> I'd rather trust unecncrypted plaintext DNS queries that go to my ISP and government! I trust my ISP and government more than a US company I have no formal contract with and the US government. Also, there's the whole 'applications should not override system level settings' thing. My DHCP pushes a local (caching) DNS server that also does name resolution for internal services. This change would break that for all Firefox users on my network.

roblabla 7y ago
> I trust my ISP and government more than a US company I have no formal contract with and the US government. And every single intermediary and whoever else might be listening in? This is an unencrypted plaintext connection. Which is the main point here. The whole "we trust ISP more" thing is completely beside the point. The point is DNS is horribly insecure nowadays, and it is about damn time we switch to something better. > Also, there's the whole 'applications should not override system level settings' thing. Hopefully, DoH will become a system level setting eventually.
- lima 7y ago
  There aren't many intermediaries if you use your ISP's internal resolvers.
  - vetinari 7y ago
    And there are intermediaries between Cloudflare/other DoH providers and the respective authoritative nameservers anyway.
    - m-p-3 7y ago
      But unless they have the private key for CloudFlare certs, they can't snoop in so it doesn't matter if there are intermediaries in between.
      - vetinari 7y ago

lima 7y ago

I live in Europe and I do trust my ISP (and government, which has a decent track record at enforcing GDPR). Even with DoH, my ISP already sees all of my network traffic. My DNS queries will effectively be anonymized by their recursive name servers.

dao- 7y ago
> I live in Europe and I do trust my ISP (and government, which has a decent track record at enforcing GDPR). I believe the GP comment was referring to government surveillance. This is a thing in Europe and GDPR won't protect you from it. Also, good news for you: Since you live in Europe, the announced switch to DoH with Cloudflare as the default for Firefox users in the US won't affect you.

w8rbt 7y ago

Absolutely. This warning seems disingenuous and will confuse many normal people. DNS over HTTPs and DNS over TLS are good things and increase our privacy. People should switch to them.

zzzcpan 7y ago

> I'd rather trust unecncrypted plaintext DNS queries that go to my ISP and government! Your ISP has access to more detailed data on you than DNS queries. Also CF servers are typically located in the same jurisdiction as your government and send unencrypted DNS queries from there. Now instead of dealing with every ISP your government has to deal with just one company in one location, no need to even ask that company anything, just come in and setup mirroring point, very convenient for the government, not very good for you.

comex 7y ago
They can log unencrypted DNS queries coming from Cloudflare, yes. But they can't correlate those with the incoming encrypted queries, not when the amount of traffic coming in is as vast as it will be. It doesn't help much to know "some Firefox user somewhere tried to resolve such-and-such domain".

krzyk 7y ago

Are there any GDPR compliant entities there? Preferably some company/organization from Europe?