4 ms·
As a European, I also find it very weird to enable this globally by default. I really don't want to send my traffic to a third party on some other continent tha
by lucb1e 7y ago
As a European, I also find it very weird to enable this globally by default. I really don't want to send my traffic to a third party on some other continent that gives me a service for free. I pay my ISP good money to do this for me.
No idea how common this is in other countries, but my ISP doesn't sniff or sell my traffic. I've only ever heard about that on HN or Reddit, which are USA-centric. I guess it also happens in other countries, but in the EU such a thing would have to be made known to the user because it processes personal data.
Somehow, adding a Pocket button is bad but sending all visited websites to Cloudflare is good. The top two comments (and many others) on the thread about Pocket can be applied here as well if you just replace the name "Pocket" with "Cloudflare": https://news.ycombinator.com/item?id=9667809 https://news.ycombinator.com/item?id=9667809
- Santosh83 7y agoIndian here. My ISP does inject ads into plain HTTP traffic, so based on that user-hostile behaviour I assume that they also record my DNS queries and/or sell them. Also whether or not they do that, they are mandated by govt to keep DNS query records for at least 18 months (last I looked) and then anonymise them. Under the current authoritarian leaning govt, I wouldn't be surprised if rules have been revised mandating indefinite recording.
- lucb1e 7y agoInteresting, thanks for adding that data point. I'm wondering if there is a list of this somewhere, it seems like the kind of thing we'd want to track (similar to e.g. the press freedom map https://rsf.org/en/ranking https://rsf.org/en/ranking )
- mtsr 7y agoBut the proper solution for that is DNS-over-TLS and picking or running your own recursive DNS resolver.
- CogitoCogito 7y agoIs it not possible to have a recursive DNS resolver with DNS over HTTPS? I.e. are their more differences between DoH and DNS over TLS than just the port number?
- mercora 7y agoi think DoH is DNS wireformat via http over TLS whereas DNS over TLS is the plain wireformat over TLS. EDIT: so for DoH you would need to speak HTTP but for DNS over TLS you only need to wrap TLS around for example by using stunnel or something.
- CogitoCogito 7y agoSorry if I'm dense, but that would mean that the two protocols _are_ the same except for port number for practical purposes right? I mean there's no reason why the same actions could be taken when running straight wireformat vs over http right? edit: In response to your edit :) So is the main objection to this that it breaks traditional layering then? E.g. here's a post in a thread that I found a bit helpful: https://old.reddit.com/r/privacy/comments/89pr15/dnsoverhttps_vs_dns_overtls_vs_dnscrypt/dwzk7g3/ https://old.reddit.com/r/privacy/comments/89pr15/dnsoverhttp... (The rest of the thread is interesting as well.) I guess one downside with DoH is that now there's a larger incentive to break through your https in general?
- mercora 7y agoi was only responding to your question whether there is any difference between the two beside the port number used which there is, in a significant way. You can not point a DoH client to a DNS over TLS server or vice versa. That said there is no reason a DoH server could not be recursive or consult a traditional (probably recursive) resolver for its response. I think the only benefit of DoH is that is unlikely to be blocked. Otherwise it feels more like a hack and at least i am not concerned about OSI models ;) Actually, i tried to setup a DNS over TLS server some weeks ago but while it worked like intended i had a hard time to get reasonable response times even after somewhat serious fine tuning for the session setup (i used haproxy at server side). But this was mainly caused by the fact that systemd-resolved established a new connection for each and every request and i did not find a stub resolver that did not either.
- pitaj 7y agoThere's a huge difference though. Regardless of what you choose, your DNS requests have to go somewhere. The alternative to sending everything encrypted to Cloudflare is sending everything in plain text to your ISP and anyone else who wants to snoop on your DNS.
- lucb1e 7y agoYou're going to have to explain that last bit: "and everyone else who wants to snoop"? Are you talking about someone who MITMs the connection between every subscriber and the ISP's DNS servers, e.g. intelligence agencies? Or like evil employees at the ISP? In either case, sending it plaintext to a benevolent foreign entity doesn't make it any better (Cloudflare still has employees that can be evil, and I'd rather the AIVD snoops on me than the NSA), so I guess there is some other risk you're talking about?
- jrwr 7y agoFlat out here in the USA, My ISP Sells my DNS Traffic to third parties for money, On top of charging me for shitty internet. It happens more often then not since its easy to do and no one will notice that you are doing it.
- deleted 7y ago[deleted]
- zzzcpan 7y ago> The alternative to sending everything encrypted to Cloudflare is sending everything in plain text to your ISP and anyone else who wants to snoop on your DNS. It's not the alternative. With DoH you are sending DNS queries, IP addresses, OS information and possibly even tracking cookies to Cloudflare over an encrypted channel, but Cloudflare still makes plain text queries to authoritative DNS servers from there. While your ISP's network is actually private, sometimes even encrypted, and sending plain text queries over it to its DNS servers is almost the same as having an encrypted channel. On top of that whether you use DoH to Cloudflare or not, your ISP sitll has the ability to spy on what websites you are visiting and in fact is what an ISP typically would use for that purpose anyway, not DNS data.
- m-p-3 7y agoAt least Pocket belongs to Mozilla. https://en.wikipedia.org/wiki/Pocket_%28service%29 https://en.wikipedia.org/wiki/Pocket_%28service%29
- lucb1e 7y agoI thought so too but it turns out they are only owned by Mozilla as of 2017. The Pocket integration launched in 2015.
- bscphil 7y ago> Somehow, adding a Pocket button is bad but sending all visited websites to Cloudflare is good. I think this is an interesting point. Given that quite a few people here on HN have problems with both of these "features", should OpenBSD be disabling them both on their builds?
- AstralStorm 7y agoPocket is opt-in. You can remove or ignore the button and it will not be used.
- bscphil 7y ago"Pocket" as a product now also includes advertising shown by default on the new tab page, so I'm referring to that too.
- wbl 7y agoFirefox is only making this change in the US.
- lucb1e 7y agoAre they? I've not seen that mentioned anywhere.
- bjoli 7y agoISPs in Sweden have been working hard at "dis-earning" my trust. Telia shared user data to torrening blackmail companies and some other ISP apparently had many of their clients get blackmails concerning their porn surfing. Cloudflare discloses what data it logs and with whom they share it (APNIC gets properly anonymised data that can only be used for limited purposes iirc). My ISP has a blanket "we share your data with selected partners as a way to better provide you with our services" (as has all my previous ISPs). When I have time I am hitting them and my bank with GDPR requests.
- lucb1e 7y agoGDPR requests shouldn't be a lot of work, most data protection agencies provide example letters. I usually customize them a little, but it's mostly copy-paste. I guess the most laborious part is censoring and watermarking a picture/scan of your ID/passport.