3 ms·

There's a huge difference though. Regardless of what you choose, your DNS requests have to go somewhere. The alternative to sending everything encrypted to Clou

by pitaj 7y ago

There's a huge difference though. Regardless of what you choose, your DNS requests have to go somewhere. The alternative to sending everything encrypted to Cloudflare is sending everything in plain text to your ISP and anyone else who wants to snoop on your DNS.

lucb1e 7y ago
You're going to have to explain that last bit: "and everyone else who wants to snoop"? Are you talking about someone who MITMs the connection between every subscriber and the ISP's DNS servers, e.g. intelligence agencies? Or like evil employees at the ISP? In either case, sending it plaintext to a benevolent foreign entity doesn't make it any better (Cloudflare still has employees that can be evil, and I'd rather the AIVD snoops on me than the NSA), so I guess there is some other risk you're talking about?
- jrwr 7y ago
  Flat out here in the USA, My ISP Sells my DNS Traffic to third parties for money, On top of charging me for shitty internet. It happens more often then not since its easy to do and no one will notice that you are doing it.
  - deleted 7y ago
    [deleted]
zzzcpan 7y ago
> The alternative to sending everything encrypted to Cloudflare is sending everything in plain text to your ISP and anyone else who wants to snoop on your DNS. It's not the alternative. With DoH you are sending DNS queries, IP addresses, OS information and possibly even tracking cookies to Cloudflare over an encrypted channel, but Cloudflare still makes plain text queries to authoritative DNS servers from there. While your ISP's network is actually private, sometimes even encrypted, and sending plain text queries over it to its DNS servers is almost the same as having an encrypted channel. On top of that whether you use DoH to Cloudflare or not, your ISP sitll has the ability to spy on what websites you are visiting and in fact is what an ISP typically would use for that purpose anyway, not DNS data.
- goalieca 7y ago
  That’s right. It knows what IPs you connect to and can do a reverse lookup

by pitaj 7y ago

lucb1e 7y ago

You're going to have to explain that last bit: "and everyone else who wants to snoop"? Are you talking about someone who MITMs the connection between every subscriber and the ISP's DNS servers, e.g. intelligence agencies? Or like evil employees at the ISP? In either case, sending it plaintext to a benevolent foreign entity doesn't make it any better (Cloudflare still has employees that can be evil, and I'd rather the AIVD snoops on me than the NSA), so I guess there is some other risk you're talking about?

jrwr 7y ago
Flat out here in the USA, My ISP Sells my DNS Traffic to third parties for money, On top of charging me for shitty internet. It happens more often then not since its easy to do and no one will notice that you are doing it.
- deleted 7y ago
  [deleted]

zzzcpan 7y ago

> The alternative to sending everything encrypted to Cloudflare is sending everything in plain text to your ISP and anyone else who wants to snoop on your DNS. It's not the alternative. With DoH you are sending DNS queries, IP addresses, OS information and possibly even tracking cookies to Cloudflare over an encrypted channel, but Cloudflare still makes plain text queries to authoritative DNS servers from there. While your ISP's network is actually private, sometimes even encrypted, and sending plain text queries over it to its DNS servers is almost the same as having an encrypted channel. On top of that whether you use DoH to Cloudflare or not, your ISP sitll has the ability to spy on what websites you are visiting and in fact is what an ISP typically would use for that purpose anyway, not DNS data.

goalieca 7y ago
That’s right. It knows what IPs you connect to and can do a reverse lookup