8 ms·

And? Those same people are likely using their ISP or Google for DNS right now. How is this worse?

telmich 7y ago
It's worse, because the local ISP is more trustworthy and additionally you enable cloudflare for large scale profiling. And don't claim they won't do it, it's just a matter of time
- magashna 7y ago
  I scoff at the idea that Comcast is more trustworthy than Cloudflare.
  - bjoli 7y ago
    Telia in Sweden has shared data with "selected partners" in a way that led to customers being extorted because of, among other things, porn surfing history and torrent downloading. Trusting your ISP, even in a country with data protection laws like Sweden, is naive. I'd much rather trust a company that tells me "this is the data we store. This is the data we share with APNIC and no-one else".
- darkhorn 7y ago
  Are you kidding? My ISP is blocking wikipedia.org, i.imgur.com, imbd.com, torproject.org, and many other.
- bjoli 7y ago
  I live in Sweden and I would never trust any ISP. There are too many cases of data shared with "business partners" that led to things like tries to extort torrent users or porn surfers (even reputable ISPs). This should be, if not illegal at least highly problematic in the eyes of the law. At best the ISPs got a "better behave, because next time ...". All ISPs have data sharing with "selected partners to ensure service quality" which, at least until GDPR, meant basically that they could sell data. Whereas cloudflare states that the 1.1.1.1 data will only ever be shared with APNIC in anonymised form (which they define). Cloudflare defines what data they share for 1.1.1.1 users, which my ISP does not. I trust cloudflare, at least right now. If they were to change their retention policies and agreement I would maybe reconsider.
bennyp101 7y ago
Well, if the user has configured their router to use their preferered DNS provider, and this is enabled, and they don't realise, then as far they are concerned all their requests are going via that provider, when in fact they are going out somewhere else. That seems pretty shady to me
cesarb 7y ago
The default (which the majority of people will be using) is not Google, it's their ISP. And in the vast majority of cases, their ISP is under the jurisdiction of their country, while Google and Cloudflare have to obey the laws of a foreign country. Said foreign country might one day decide that for instance Google and Cloudflare now have to log the IP address of everyone who does a DNS lookup for news.ycombinator.com, even if the laws in the user's country forbid it.
- magashna 7y ago
  Mozilla is only applying this in the US.
  - bennyp101 7y ago
    To start with
    - southerntofu 7y ago
      According to a CCC talk about DNS security, Mozilla is going to enable providers on a regional-basis by partnering with privacy-friendly non-profits. DigitalCourage was one of the names mentioned as a potential EU-based DoH provider.
- darkhorn 7y ago
  This! This is very bad for Erdoğan. They won't be able to block DNS over HTTPS. Thus teir classic DNS blocks will be useless. Last time I've checked there was over 300K blocked domains via DNS. Even 8.8.8.8 doesn't work.
  - okasaki 7y ago
    Why can't they block 1.1.1.1?
    - darkhorn 7y ago
      They can block but you can make any https page into DoH. What they are going to do? Block every web site?
simias 7y ago
I'm fairly sure that most, even non-technical users understand fairly well that their ISP can snoop on their internet connection. On the other hand I doubt that my mom expects that when she connects to https://www.impots.gouv.fr/ https://www.impots.gouv.fr/ her browser pings an american-owned server to get access.
- m-p-3 7y ago
  If she does it from a Chromebook/Chromebox, then all the requests are likely routed through Google DNS.
- xref 7y ago
  Tracetouting that address could reveal a lot more foreign-owned (and built) servers in the path, so I’m not sure what your litmus test is.
buildzr 7y ago
It's significantly better actually - gets around DNS blocking put in place by malicious ISPs and governments.
unionpivo 7y ago
Well there is whole article linked explaining just that. But basically, i know my ISP, and they don't log dns queries. Most ISP's (the ones i have worked with) don't save DNS requests. They usually save netflow. I also use vpn (my own), with its own dns resolver, for when i don't trust middle man.

It's worse, because the local ISP is more trustworthy and additionally you enable cloudflare for large scale profiling. And don't claim they won't do it, it's just a matter of time

magashna 7y ago
I scoff at the idea that Comcast is more trustworthy than Cloudflare.
- bjoli 7y ago
  Telia in Sweden has shared data with "selected partners" in a way that led to customers being extorted because of, among other things, porn surfing history and torrent downloading. Trusting your ISP, even in a country with data protection laws like Sweden, is naive. I'd much rather trust a company that tells me "this is the data we store. This is the data we share with APNIC and no-one else".
darkhorn 7y ago
Are you kidding? My ISP is blocking wikipedia.org, i.imgur.com, imbd.com, torproject.org, and many other.
bjoli 7y ago
I live in Sweden and I would never trust any ISP. There are too many cases of data shared with "business partners" that led to things like tries to extort torrent users or porn surfers (even reputable ISPs). This should be, if not illegal at least highly problematic in the eyes of the law. At best the ISPs got a "better behave, because next time ...". All ISPs have data sharing with "selected partners to ensure service quality" which, at least until GDPR, meant basically that they could sell data. Whereas cloudflare states that the 1.1.1.1 data will only ever be shared with APNIC in anonymised form (which they define). Cloudflare defines what data they share for 1.1.1.1 users, which my ISP does not. I trust cloudflare, at least right now. If they were to change their retention policies and agreement I would maybe reconsider.

bennyp101 7y ago

Well, if the user has configured their router to use their preferered DNS provider, and this is enabled, and they don't realise, then as far they are concerned all their requests are going via that provider, when in fact they are going out somewhere else. That seems pretty shady to me

cesarb 7y ago

The default (which the majority of people will be using) is not Google, it's their ISP. And in the vast majority of cases, their ISP is under the jurisdiction of their country, while Google and Cloudflare have to obey the laws of a foreign country. Said foreign country might one day decide that for instance Google and Cloudflare now have to log the IP address of everyone who does a DNS lookup for news.ycombinator.com, even if the laws in the user's country forbid it.

magashna 7y ago
Mozilla is only applying this in the US.
- bennyp101 7y ago
  To start with
  - southerntofu 7y ago
    According to a CCC talk about DNS security, Mozilla is going to enable providers on a regional-basis by partnering with privacy-friendly non-profits. DigitalCourage was one of the names mentioned as a potential EU-based DoH provider.
darkhorn 7y ago
This! This is very bad for Erdoğan. They won't be able to block DNS over HTTPS. Thus teir classic DNS blocks will be useless. Last time I've checked there was over 300K blocked domains via DNS. Even 8.8.8.8 doesn't work.
- okasaki 7y ago
  Why can't they block 1.1.1.1?
  - darkhorn 7y ago
    They can block but you can make any https page into DoH. What they are going to do? Block every web site?

simias 7y ago

I'm fairly sure that most, even non-technical users understand fairly well that their ISP can snoop on their internet connection. On the other hand I doubt that my mom expects that when she connects to https://www.impots.gouv.fr/ https://www.impots.gouv.fr/ her browser pings an american-owned server to get access.

m-p-3 7y ago
If she does it from a Chromebook/Chromebox, then all the requests are likely routed through Google DNS.
xref 7y ago
Tracetouting that address could reveal a lot more foreign-owned (and built) servers in the path, so I’m not sure what your litmus test is.

buildzr 7y ago

It's significantly better actually - gets around DNS blocking put in place by malicious ISPs and governments.

unionpivo 7y ago

Well there is whole article linked explaining just that. But basically, i know my ISP, and they don't log dns queries. Most ISP's (the ones i have worked with) don't save DNS requests. They usually save netflow. I also use vpn (my own), with its own dns resolver, for when i don't trust middle man.