6 ms·

> I'd rather trust unecncrypted plaintext DNS queries that go to my ISP and government! I trust my ISP and government more than a US company I have no formal c

by Aaargh20318 7y ago

> I'd rather trust unecncrypted plaintext DNS queries that go to my ISP and government! I trust my ISP and government more than a US company I have no formal contract with and the US government. Also, there's the whole 'applications should not override system level settings' thing. My DHCP pushes a local (caching) DNS server that also does name resolution for internal services. This change would break that for all Firefox users on my network.

roblabla 7y ago
> I trust my ISP and government more than a US company I have no formal contract with and the US government. And every single intermediary and whoever else might be listening in? This is an unencrypted plaintext connection. Which is the main point here. The whole "we trust ISP more" thing is completely beside the point. The point is DNS is horribly insecure nowadays, and it is about damn time we switch to something better. > Also, there's the whole 'applications should not override system level settings' thing. Hopefully, DoH will become a system level setting eventually.
- lima 7y ago
  There aren't many intermediaries if you use your ISP's internal resolvers.
  - vetinari 7y ago
    And there are intermediaries between Cloudflare/other DoH providers and the respective authoritative nameservers anyway.
    - m-p-3 7y ago
      But unless they have the private key for CloudFlare certs, they can't snoop in so it doesn't matter if there are intermediaries in between.
      - vetinari 7y ago
        The traffic between Clouflare and the authoritative nameservers will be good old 53/udp. The only thing the snooper won't be sure with is, which Cloudflare client asked for that record.
    - ti_ranger 7y ago
      My ISP is subject to specific regulations for licensed network providers, which Cloudflare isn't. Thus, Cloudflare is the problematic intermediary.
- seszett 7y ago
  If you use your ISP's DNS servers, there is no intermediary between you and them.
  - deleted 7y ago
    [deleted]
  - throw0101a 7y ago
    Unless your ISP is running Huawei equipment. ;)
  - unethical_ban 7y ago
    If you use wi-fi without a VPN, you have the coffee shop and the coffee shop's ISP. And anyone listening there. Of course there is cleartext SNI even for SSL connections... but alas.
    - Aaargh20318 7y ago
      What coffee shop ? I only connect to wifi at home and at the office.
      - unethical_ban 7y ago
        And you're the only person who uses mobile computing devices.
        Aaargh20318 7y ago
        Not sure what point you’re trying to make here.
dao- 7y ago
> I trust my ISP and government more than a US company I have no formal contract with and the US government. You're not affected then, because the DoH rollout w/ Cloudflare as the default is only planned for the US.
- vezycash 7y ago
  For now
- telmich 7y ago
  That is not an argument, it is clear that this is supposed to be deployed by default.
  - dao- 7y ago
    ... only for users in the US. Are you aware of other plans?
miohtama 7y ago
This is exactly why DoH is enabled by default in the US only.
m-p-3 7y ago
> applications should not override system level settings I wish Windows 10 and other operating systems natively supported DNS-over-HTTPS, but many don't. So they have to work around that lack of support.
akerro 7y ago
You can use different DoH server, you can setup your own, that's not a problem https://www.ghacks.net/2018/04/02/configure-dns-over-https-in-firefox/ https://www.ghacks.net/2018/04/02/configure-dns-over-https-i... I use https://odvr.nic.cz/doh https://odvr.nic.cz/doh
bzbarsky 7y ago
Do you ever use wifi in a coffeeshop or hotel? Because if you do, at that point they are your "ISP" for purposes of this discussion. Do you still trust them more than Cloudflare? (For a desktop machine, obviously this is not an issue, but for pretty much anyone with a laptop this is something that needs to be worried about.) As far as internal services, is this a split-horizon setup? As far as I understand, the plan is to detect those and fall back from DoH to normal DNS as needed.
kmlx 7y ago
> I trust my ISP and government more than a US company I have no formal contract with and the US government. I do not! I'd rather have that anon US co. than any government.

roblabla 7y ago

> I trust my ISP and government more than a US company I have no formal contract with and the US government. And every single intermediary and whoever else might be listening in? This is an unencrypted plaintext connection. Which is the main point here. The whole "we trust ISP more" thing is completely beside the point. The point is DNS is horribly insecure nowadays, and it is about damn time we switch to something better. > Also, there's the whole 'applications should not override system level settings' thing. Hopefully, DoH will become a system level setting eventually.

lima 7y ago
There aren't many intermediaries if you use your ISP's internal resolvers.
- vetinari 7y ago
  And there are intermediaries between Cloudflare/other DoH providers and the respective authoritative nameservers anyway.
  - m-p-3 7y ago
    But unless they have the private key for CloudFlare certs, they can't snoop in so it doesn't matter if there are intermediaries in between.
    - vetinari 7y ago
      The traffic between Clouflare and the authoritative nameservers will be good old 53/udp. The only thing the snooper won't be sure with is, which Cloudflare client asked for that record.
  - ti_ranger 7y ago
    My ISP is subject to specific regulations for licensed network providers, which Cloudflare isn't. Thus, Cloudflare is the problematic intermediary.
seszett 7y ago
If you use your ISP's DNS servers, there is no intermediary between you and them.
- deleted 7y ago
  [deleted]
- throw0101a 7y ago
  Unless your ISP is running Huawei equipment. ;)
- unethical_ban 7y ago
  If you use wi-fi without a VPN, you have the coffee shop and the coffee shop's ISP. And anyone listening there. Of course there is cleartext SNI even for SSL connections... but alas.
  - Aaargh20318 7y ago
    What coffee shop ? I only connect to wifi at home and at the office.
    - unethical_ban 7y ago
      And you're the only person who uses mobile computing devices.
      - Aaargh20318 7y ago
        Not sure what point you’re trying to make here.

dao- 7y ago

> I trust my ISP and government more than a US company I have no formal contract with and the US government. You're not affected then, because the DoH rollout w/ Cloudflare as the default is only planned for the US.

vezycash 7y ago
For now
telmich 7y ago
That is not an argument, it is clear that this is supposed to be deployed by default.
- dao- 7y ago
  ... only for users in the US. Are you aware of other plans?

miohtama 7y ago

This is exactly why DoH is enabled by default in the US only.

m-p-3 7y ago

> applications should not override system level settings I wish Windows 10 and other operating systems natively supported DNS-over-HTTPS, but many don't. So they have to work around that lack of support.

akerro 7y ago

You can use different DoH server, you can setup your own, that's not a problem https://www.ghacks.net/2018/04/02/configure-dns-over-https-in-firefox/ https://www.ghacks.net/2018/04/02/configure-dns-over-https-i... I use https://odvr.nic.cz/doh https://odvr.nic.cz/doh

bzbarsky 7y ago

Do you ever use wifi in a coffeeshop or hotel? Because if you do, at that point they are your "ISP" for purposes of this discussion. Do you still trust them more than Cloudflare? (For a desktop machine, obviously this is not an issue, but for pretty much anyone with a laptop this is something that needs to be worried about.) As far as internal services, is this a split-horizon setup? As far as I understand, the plan is to detect those and fall back from DoH to normal DNS as needed.

kmlx 7y ago

> I trust my ISP and government more than a US company I have no formal contract with and the US government. I do not! I'd rather have that anon US co. than any government.