3 ms·

> DNS requests are routinely intercepted and monitored by ISPs in many countries, with the information available to the security services Not true. ISPs typica

> DNS requests are routinely intercepted and monitored by ISPs in many countries, with the information available to the security services Not true. ISPs typically record and store netflow-like data, very rarely DNS-data (I'd say storing DNS data is even unusual). If ISPs are in a position to get more detailed than netflow data on you they resort to things like deep packet inspection (DPI), which doesn't rely on DNS, pretty much all mobile/cellular ISPs do that today. > DoH is vital to protect users around the world from censorship and worse. Not true either. DoH can't do anything against censorship and if enabled by default in all browsers can actually give worldwide censorship powers to a single US entity that already has something akin "we will block anything we don't like and do anything our government wants" in their ToS.

jamespo 7y ago
you too have ignored "it's trivial to change your DoH provider"
- stakhanov 7y ago
  It's actually not, or am I somehow missing that this is a feature that Mozilla has announced as part of this move? Users who are not technical powerusers will not understand the real security implications of "Enable DNS over HTTPS", and right now I can't find a setting to change the provider anywhere in the settings dialogue, and about:config and enterprise policies are not something that regular users mess with.
  - DHPersonal 7y ago
    It's in Options/Preferences > Network Settings > Settings, scroll to the bottom and select Custom from the Use Provider dropdown. I added AdGuard's DNS over HTTPS address. https://dns.adguard.com/dns-query https://dns.adguard.com/dns-query
    - stakhanov 7y ago
      Haha. Okay: Actually didn't see it because that one line landed below the fold on my resolution (960px height, fixed taskbar on Windows). Rookie mistake. But also bad UI design if this is actually something that's important and that users should pay attention to. But. (1) There is no informed consent happening here, highlighting to a user, say in Europe, that this would lead to a U.S.-regulated entity knowing a lot about their browsing history. Regular users can't be expected to understand that that is what this setting implies but will think of "DNS over HTTPS" as technical mumbo jumbo that they don't need to pay attention to and that they should keep at default. (2) The dropdown doesn't have any options besides Cloudflare. In order to use the "Other" option, the user would have to research URLs of providers on the Web, which seems like so much friction that few people will do this.
      - tialaramex 7y ago
        The dropdown in (2) doesn't have any other options because of the thing you're worried about in (1). Mozilla seeks specifically to contract with DoH operators to secure the operator's consent to protect their users and never do most of the things you're worried they might do. They do NOT want the list to go: Cloudflare Sketchy Valley Company with six months runway and no clear plan how to make a profit The Actual Mob, really Google Great Britain's Ministry of Truth Russian Media Company owned by Vladimir Putin And then have news sites going "Why are all these obviously untrustworthy folks listed?" when the answer would be "Oh we heard that people didn't like the short list of actually trustworthy providers so we added all the other ones that we don't trust too!"
        stakhanov 7y ago
        In a very long-winded and theatrical way you are making the point that you believe that there are no credible alternatives out there. I believe there are. I believe that, as soon as any company puts their HQ and their servers in Europe they have a credibility-advantage over cloudflare right there on the legal front and on regulatory oversight. I also don't believe that Mozilla has the ability to greatly influence the way Cloudflare would run their service, given that they're probably not paying a lot (or anything at all; don't know the particulars), and are unlikely to be a major component of Cloudflare's revenue. Cloudflare has much more to lose by picking a fight with the U.S. government (think government surveillance) or by pissing off major advertising networks and media corporations (think surveillance capitalism) who make up the lion's share of their revenue on Cloudflare's core webcaching business.
  - cassianoleal 7y ago
    Open settings and search for DNS. There will be a single button for you to click and "Enable DNS over HTTPS" is at the bottom.
  - m-p-3 7y ago
    But it is actually easy to change. https://i.imgur.com/GuP5a8F.png https://i.imgur.com/GuP5a8F.png
- simias 7y ago
  The average internet user probably has no idea what DNS or HTTPS are, let alone DoH (which even I as a technical user had forgotten existed before I read this post). Defaults matter a whole lot. I haven't formed a definitive opinion on DoH but either way saying "you can configure it so it doesn't matter" is not reasonable in my opinion.
  - avmich 7y ago
    It's interesting that when Russia started blocking access to some popular websites a few years ago, the instructions for installation of VPN were found in all places. The case - then, for example, attempts to block Telegram servers lead to unexpected unblocking some forbidden sites, like kasparov.ru - shows how some networking skills can be grown en masse in a short period of time. So, yes, average Internet user isn't very familiar with DNS. Maybe privacy wars will lead to growing awareness in this area though.
fulafel 7y ago
You might look into "passive DNS" services that collect and provide servies based on DNS data collected by ISPs and carriers. It's often more or less anonymized, and often used for good things too - but not wholly harmless.

jamespo 7y ago

you too have ignored "it's trivial to change your DoH provider"

stakhanov 7y ago
It's actually not, or am I somehow missing that this is a feature that Mozilla has announced as part of this move? Users who are not technical powerusers will not understand the real security implications of "Enable DNS over HTTPS", and right now I can't find a setting to change the provider anywhere in the settings dialogue, and about:config and enterprise policies are not something that regular users mess with.
- DHPersonal 7y ago
  It's in Options/Preferences > Network Settings > Settings, scroll to the bottom and select Custom from the Use Provider dropdown. I added AdGuard's DNS over HTTPS address. https://dns.adguard.com/dns-query https://dns.adguard.com/dns-query
  - stakhanov 7y ago
    Haha. Okay: Actually didn't see it because that one line landed below the fold on my resolution (960px height, fixed taskbar on Windows). Rookie mistake. But also bad UI design if this is actually something that's important and that users should pay attention to. But. (1) There is no informed consent happening here, highlighting to a user, say in Europe, that this would lead to a U.S.-regulated entity knowing a lot about their browsing history. Regular users can't be expected to understand that that is what this setting implies but will think of "DNS over HTTPS" as technical mumbo jumbo that they don't need to pay attention to and that they should keep at default. (2) The dropdown doesn't have any options besides Cloudflare. In order to use the "Other" option, the user would have to research URLs of providers on the Web, which seems like so much friction that few people will do this.
    - tialaramex 7y ago
      The dropdown in (2) doesn't have any other options because of the thing you're worried about in (1). Mozilla seeks specifically to contract with DoH operators to secure the operator's consent to protect their users and never do most of the things you're worried they might do. They do NOT want the list to go: Cloudflare Sketchy Valley Company with six months runway and no clear plan how to make a profit The Actual Mob, really Google Great Britain's Ministry of Truth Russian Media Company owned by Vladimir Putin And then have news sites going "Why are all these obviously untrustworthy folks listed?" when the answer would be "Oh we heard that people didn't like the short list of actually trustworthy providers so we added all the other ones that we don't trust too!"
      - stakhanov 7y ago
        In a very long-winded and theatrical way you are making the point that you believe that there are no credible alternatives out there. I believe there are. I believe that, as soon as any company puts their HQ and their servers in Europe they have a credibility-advantage over cloudflare right there on the legal front and on regulatory oversight. I also don't believe that Mozilla has the ability to greatly influence the way Cloudflare would run their service, given that they're probably not paying a lot (or anything at all; don't know the particulars), and are unlikely to be a major component of Cloudflare's revenue. Cloudflare has much more to lose by picking a fight with the U.S. government (think government surveillance) or by pissing off major advertising networks and media corporations (think surveillance capitalism) who make up the lion's share of their revenue on Cloudflare's core webcaching business.
- cassianoleal 7y ago
  Open settings and search for DNS. There will be a single button for you to click and "Enable DNS over HTTPS" is at the bottom.
- m-p-3 7y ago
  But it is actually easy to change. https://i.imgur.com/GuP5a8F.png https://i.imgur.com/GuP5a8F.png
simias 7y ago
The average internet user probably has no idea what DNS or HTTPS are, let alone DoH (which even I as a technical user had forgotten existed before I read this post). Defaults matter a whole lot. I haven't formed a definitive opinion on DoH but either way saying "you can configure it so it doesn't matter" is not reasonable in my opinion.
- avmich 7y ago
  It's interesting that when Russia started blocking access to some popular websites a few years ago, the instructions for installation of VPN were found in all places. The case - then, for example, attempts to block Telegram servers lead to unexpected unblocking some forbidden sites, like kasparov.ru - shows how some networking skills can be grown en masse in a short period of time. So, yes, average Internet user isn't very familiar with DNS. Maybe privacy wars will lead to growing awareness in this area though.

fulafel 7y ago

You might look into "passive DNS" services that collect and provide servies based on DNS data collected by ISPs and carriers. It's often more or less anonymized, and often used for good things too - but not wholly harmless.