3 ms·

This would only be true if your ISP couldn't otherwise violate your privacy. Which they can. That they don't see your DNS requests is an extremely low barrier.

This would only be true if your ISP couldn't otherwise violate your privacy. Which they can. That they don't see your DNS requests is an extremely low barrier. They see all the subsequent traffic. Using DoH increases your privacy attack surface, not reduces it.

eloff 7y ago
No, I don't see that. Either way your subsequent unencrypted requests are visible. Your encrypted requests are not. DoH is strictly better.
- jiveturkey 7y ago
  I think you misunderstand. I'm not talking about the contents of the packets. I'm talking about the IP address destinations. You know -- the part that DNS tells you. The ISP has that info anyway as they transit the traffic for you. DoH is strictly worse.
  - eloff 7y ago
    > I'm talking about the IP address destinations That's true, that will leak either way. > DoH is strictly worse. Still waiting for your argument for how it's worse. The way I see it it's at the very least no worse, but in practice much better for most people. I have an open-mind on the subject, convince me.
    - jiveturkey 7y ago
      I'm confused, because I've already presented my argument. Here it is again: Hiding your DNS requests from the ISP is pointless. The ISP sees where your traffic is going. This the result of those DNS requests. It doesn't matter that they didn't see the actual DNS request; they see what the answer was. They know what sites (DNS addresses) you are visiting. So sending your DNS requests to a 3rd party (multiple ones in the recent RR version proposed!) simply spreads wider the folks that can profile your traffic. As unrelated 3rd parties, those people would otherwise have had no idea where you, private citizen, were sending traffic. Now you have explicitly told them. You have given up privacy, not enhanced it. Please keep in mind, I'm not arguing against DoH wholesale. Just that it is worse for privacy. The primary consensus argument in favor of DoH is about privacy, which is flat out wrong.
      - SAI_Peregrinus 7y ago
        > They know what sites (DNS addresses) you are visiting. This is false if you have ESNI enabled. They see what IP addresses, not what web sites you are visiting. ESNI isn't on by default yet, but it will be.
        gog 7y ago
        They see the destination IP you are connecting to, usually behind one IP is only one web site. ESNI doesn't matter unless you are connecting to a site on a shared host.
        pixl97 7y ago
        Usually one site behind ip since when?
        yc12340 7y ago
        ESNI does not provide much real security, only obfuscation. Besides, it is not going to make it (South Korea already blocks it and others will follow).

eloff 7y ago

No, I don't see that. Either way your subsequent unencrypted requests are visible. Your encrypted requests are not. DoH is strictly better.

jiveturkey 7y ago
I think you misunderstand. I'm not talking about the contents of the packets. I'm talking about the IP address destinations. You know -- the part that DNS tells you. The ISP has that info anyway as they transit the traffic for you. DoH is strictly worse.
- eloff 7y ago
  > I'm talking about the IP address destinations That's true, that will leak either way. > DoH is strictly worse. Still waiting for your argument for how it's worse. The way I see it it's at the very least no worse, but in practice much better for most people. I have an open-mind on the subject, convince me.
  - jiveturkey 7y ago
    I'm confused, because I've already presented my argument. Here it is again: Hiding your DNS requests from the ISP is pointless. The ISP sees where your traffic is going. This the result of those DNS requests. It doesn't matter that they didn't see the actual DNS request; they see what the answer was. They know what sites (DNS addresses) you are visiting. So sending your DNS requests to a 3rd party (multiple ones in the recent RR version proposed!) simply spreads wider the folks that can profile your traffic. As unrelated 3rd parties, those people would otherwise have had no idea where you, private citizen, were sending traffic. Now you have explicitly told them. You have given up privacy, not enhanced it. Please keep in mind, I'm not arguing against DoH wholesale. Just that it is worse for privacy. The primary consensus argument in favor of DoH is about privacy, which is flat out wrong.
    - SAI_Peregrinus 7y ago
      > They know what sites (DNS addresses) you are visiting. This is false if you have ESNI enabled. They see what IP addresses, not what web sites you are visiting. ESNI isn't on by default yet, but it will be.
      - gog 7y ago
        They see the destination IP you are connecting to, usually behind one IP is only one web site. ESNI doesn't matter unless you are connecting to a site on a shared host.
        pixl97 7y ago
        Usually one site behind ip since when?
      - yc12340 7y ago
        ESNI does not provide much real security, only obfuscation. Besides, it is not going to make it (South Korea already blocks it and others will follow).