27 ms·
Big ISPs aren’t happy about Google’s plans for encrypted DNS
- PaulHoule 7y agoFrom Google's perspective being able to block ads with your hosts file is a bug, not a feature.
- cameronbrown 7y agoPerhaps. I personally would still setup DoH at the router level. ISPs begone.
- aomix 7y agoWould a local DoH server making going between different networks a little clunky? I have unbound handling dns at home but the old way lets the network define where to get dns information and/or allow for multiple options. Seems like Firefox doesn't have that flexibility yet.
- judge2020 7y agoThis wouldn't make it into a large portion of consumer routers which are provided by the ISP.
- gtirloni 7y agoAds are a much smaller threat than unscrupulous ISPs. They have access to ALL your traffic.
- olliej 7y agoOnly the unencrypted traffic, which is increasingly becoming just DNS. But even if all DNS was encrypted, the default DNS servers you hit are those of your ISP so they’d still have access in the common/default case
- coderheed 7y agoSo don't use your ISP for DNS and use something encrypted like https://1.1.1.1/ https://1.1.1.1/ or others.
- jchw 7y agoFor what it’s worth, at least in Chromium’s implementation: - The hosts file should still take effect (Chromium can read the hosts file and parse it already.) - The DoH upgrading should not override your default resolver. It works by having a lookup table of providers that support DoH and using DoH if your provider supports it. The list can be seen here: https://cs.chromium.org/chromium/src/net/dns/dns_util.cc?q=Dohupgradelist&sq=package:chromium&g=0&l=142 https://cs.chromium.org/chromium/src/net/dns/dns_util.cc?q=D... (note: this URL may become stale over time; there’s ways to improve this but I am on mobile at the moment.)
- echelon 7y agoFor now. Google sneezes and this is gone. We didn't think they'd take away extensions' abilities to block ads, and yet here we are. We've seriously got to pursue breaking this company up. They're the absolute worst.
- tptacek 7y agoThat is a serious misrepresentation of what's happening with Manifest v3.
- echelon 7y ago> serious misrepresentation How is it a serious misrepresentation? Manifest v3 cripples the ability to block ads. Google is an ad company and has the largest browser market share by far. How is this not abuse? Google can claim that things like AMP are not intended to rope us into their walled garden, that it's all about improving performance. But at the end of the day, most of the moves they make further their goal of serving more ads. In twenty years I wouldn't be too terribly surprised if independent websites are largely gone. Disappeared like IRC, RSS, blogging on your own website, and the like. I'm sorry you disagree. I just don't like what I see happening.
- ehsankia 7y agoMy Chrome browser still perfectly blocks ads. The day it stops doing that, then you have a valid point. Until then, it's mostly fear mongering and misrepresenting the situation.
- JMTQp8lwXL 7y agoUsing Google's DNS, instead of your ISP's, won't your capability to block ads via your hosts file.
- move-on-by 7y agoI agree with this perspective, it doesn’t make any difference on computers, but embedded devices and applications now have the ability to bypass DNS restrictions such as the pihole. Personally, I would have liked to see strong privacy laws fill the gap, but it looks like DoH is here to stay now.
- xvector 7y agoDeath to big ISPs.
- tbyehl 7y agoDeath to PiHole and every other DNS-based ad block and security system. At least, by Mozilla's plan.
- munchbunny 7y agoIf I get the choice between finding a different way to do DNS based ad blocking and hiding my traffic from ISPs' advertising divisions, I will happily find a new PiHole alternative.
- wbl 7y agoDid you read their plan? Because you can block a certain domain to stop DoH resolution.
- xvector 7y agoWhat’s stopping your PiHole or DMS adblocker from functioning as a MITM proxy? You’d just terminate HTTPS at the PiHole and perform the filtering there, right? Regardless, it’s a tiny thing to give up for more privacy.
- rodgerd 7y ago
- ggm 7y agoIn many economies, ISPs have legal immunity from acts done by users (customers) because of laws associated with 'common carrier' status. But that status is fragile. The ISP has to act like it knows its obligations in law, and there are things ISPs have been doing to work with LEA for a long long time, which they won't be able to do as simply, or as well, or in some cases at all. As a customer its easy to assume the only answer is "good" but in fact, its more complex. Society depends on law, and the application of law around what people do online is not trivial, and does not reduce down to 'all snooping is always bad all the time' -Warrants exist to do things, and warrant canaries are a reaction to them but not one which says warrants don't exist: they say silent warrants should not be obligated on the receiver of the interception: They're a position on secret law, not a position on law in itself. TL;DR DoH and DoT are challenging established law in telecoms and big ISPs who have common-carrier defence depend on interception in DNS and DPI and the like, to perform their role facing LEA demands from the state which in many cases are entirely normal and justified Not all DoH and DoT stories are good stories for society at large. Please don't reduce this to a libertarian vs everyone else debate, I would invite you to think about what an ISP is, and what we want from ISPs as a whole, not just as customers seeking pirate bay, but as a society investing in a telecommunications-rich future. The first casualty of war is the truth. The second (in WWI and WWII) was the deep sea telecommunications cables.
- zamadatix 7y agoDoH and DoT are just new delivery technologies. You've always been able to securely tunnel your traffic out of the country and you always will as it's trivial. DoT changing the resolver from one public company in the to another public company of the will not prevent the government from issuing warrants, particularly since they already issue warrants to these companies as it is. Common carrier defence is not going to be lost from encrypting URLs, the same FUD was spread about encrypted banking then the encryption of most websites. The only thing that has resulted from the increase in encryption is the decrease of ISP injected ads and the decrease of customer tracking information being sold.
- ggm 7y agoThere is a volume of ability north of 95% which could be lost, and the ISP has a mechanism to act (block DoT) but in DoH, its less simple. Hence, the liaison between Mozilla and Google, and state authorities. Why do you think Mozilla turns this on selectively?
- untog 7y agoI'm usually very skeptical of Google's plan for anything, but if it's pissing off big ISPs then sign me up.
- dodobirdlord 7y agoGoogle's plans usually have carefully laid out technical justifications, and are mostly kinda boringly/obviously good, like QUIC/HTTP3. That you're usually skeptical of any plan coming from Google suggests that your skepticism is miscalibrated.
- munk-a 7y agoI think you're being a bit over generous, the days of "Do no evil" have come and gone. Still, ISPs are definitely higher up on the evil-o-meter.
- dodobirdlord 7y agoI don't think I'm being generous. Google's large scale plans are mostly about making the internet and technology ecosystem faster, safer, and more widely available. Of course, this is because their revenue scales as a factor of the number of people using the internet, the number of pages each person using the internet browses, and the willingness of people to spend money on the internet. But don't let the motive distract from the plans. Consider the plans on their own merits.
- fouc 7y agoAll of Google's large scale plans have strong centralizing effects. The benefits are not worth it.
- dangero 7y agoGoogle makes the majority of its revenue by knowing things about their users and then allowing them to be targeted with ads. Google's plans being usually "obviously good" is a highly subjective opinion.
- deckarep 7y agoHaha Big ISPs...there’s absolutely no reason why regular HTTP requests/responses should be TLS encrypted while DNS queries should not...they go hand in hand for maintaining end-user privacy and YOUR integrity.
- GhettoMaestro 7y ago"Going blind" is a term I've heard recently when talking with operators. Where as "going dark" referred to the DOJ/FBI's term for ubiquitous encipherment of the content, "going blind" refers to the metadata (DNS in this case). My view is pretty basic: If I can see your DNS, I can pretty much guess on a very short list what kind of [browsing] behavior you are engaging in.
- joewee 7y agoYou don’t have to guess. You can actually see it. What you can infer is why and who. Which is the real danger. I would trust google to protect sensitive data like sexual preferences before I trust my ISP.
- GhettoMaestro 7y agoIt all depends how much is abstracted behind a common host (eg name based virtual hosting). I can see you are going to Google. But I don't know what within Google you are really accessing or using in most cases.
- kelnos 7y agoWhile I don't particularly trust Google all that much anymore, the fact that ISPs even have an opinion on this is a smoking gun that they're doing sketchy things with DNS data. There is no actual technical reason why they should care if you use their DNS servers or something else, even a private, encrypted DNS service.
- olliej 7y agoWe already know they do - they’ve injected ads + “suggestions” instead of dns failures in the past. They’ve also injected permanently unique cookies in http requests. ISPs can’t be trusted as dumb pipes, they’re closer to “clueless criminal” pipes. But I agree with you, I don’t particularly trust google either.
- tptacek 7y agoGoogle's design doesn't ask you to trust Google more than you already do if you use Chrome. It doesn't default you to Google's DNS servers, will honor your current nameservers, and will upgrade you to DoH at any of those servers who support it. I'm honestly not sure what more you could ask for from Google on this particular issue.
- judge2020 7y agoThe UI bug tracker is private so we don't know if there might also be a "select DNS resolver" option and/or a checkbox for "encrypt DNS" in Settings.
- colordrops 7y ago> Google's design doesn't ask you to trust Google more than you already do if you use Chrome. So in other words trust them with everything.
- LaGrange 7y ago> Google's design doesn't ask you to trust Google more than you already do if you use Chrome. ...well, I don't, so there. Also, this is true if I'd _only_ use Chrome, and never used other software for networking. Damn, I actually used to respect you. This is so disappointing.
- nimbius 7y agoStrange these isps seem to have entirely ignored pihole, which for me is blocking around 30% of my DNS queries and overrides ISP DNS servers entirely.
- tomjakubowski 7y agoYour ISP, by virtue of supplying the pipe to the internet, can (and very likely does) still snoop on any old-fashioned plaintext DNS requests you make across it, even when you're not using their servers.
- darklajid 7y agoI might have misread the GP, but I kinda felt that it also brought up the issue that a pihole (or similar solutions) might cease to work in a "DoH / I automatically pick the best resolver if I deem yours not good enough" world. DNS privacy is awesome. Filtering malicious and annoying (read: ads) content at the DNS level is mandatory for me..
- kccqzy 7y agoI don't think how that would cease to work. At least in the case of Mozilla they try to detect if you have a custom DNS server. When found, they won't use DoH for fear of breaking many intranets in enterprises.
- slig 7y agoThere are a small number of people running anything of that sort vs the billions running Chrome.
- daedalus_j 7y agoI'm fine with encrypted DNS as long as it's from my router to the (encrypted) DNS provider of MY choice. Interference from browsers with network level operations is my real worry. As far as I'm concerned, as long as the browser speaks HTTPS to my router, and my router speaks HTTPS to the servers, no problem. I'm worried about the "to protect the users we've hijacked their DNS directly via the browser" possibility though. I know it used to be that using ISP DNS servers gave you access to some of their local caching and such. I don't hear that talked about much in these discussions. Is that no longer a thing, and thus we truly don't need ISP DNS?
- shakna 7y agoChrome's design attempts to use your current DNS settings to access a DoH resolver and fallsback to the current behaviour if it fails. The browser isn't interfering in any of your network operations.
- daedalus_j 7y agoSo, assuming my local LAN DNS resolver, which serves my own custom DNS information to LAN clients, doesn't support DoH itself, but uses DoH to reach out to the authoritative servers, chrome will bypass this my local resolver? Sounds like interfering with the way my intranet operates to me.
- Spivak 7y agoChrome doesn’t know that your local intranet is trusted or that the local resolver is trustworthy. You need to tell Chrome this by flipping a switch to either change your DoH provider or disable it all together. This change is explicitly protecting users from malicious network operators. Since you control the endpoints it should be no big deal, you apply GPO, run Puppet, whatever and everybody is talking to your local DNS again but it is absolutely right to not trust local unencrypted DNS by default for every network you connect to.
- daedalus_j 7y ago
- btgeekboy 7y agoSomething I’ve wondered: It isn’t quite clear from the various articles how they’re doing this monitoring. I can totally see how they could monitor their own caching resolvers. They might even passively monitor popular internet resolvers (1.1.1.1, 8.8.8.8). But if I run my own caching resolver at home, is that data being mined? I am aware it’s unencrypted and possible to do so, but is it actually happening? DoH sounds nice, but it brings me back to using a shared caching resolver which I’m not a huge fan of.
- jnwatson 7y agoYour resolver still makes DNS requests that the ISPs snoop. Unless that connection is encrypted, they have the same info as if you used the ISP’s servers.
- mrtweetyhack 7y agoAll they have to do is pay the Google tax
- deleted 7y ago[deleted]
- salmaanp 7y agoI see news about DNS every single day now!
- profmonocle 7y ago> the company has no plans to switch Chrome users to its own DNS servers. Meanwhile, the Chromecast inexplicably ignores DHCP/NDP-provided DNS servers and uses 8.8.8.8 for all queries.
- the_pwner224 7y agoEven worse - it will disable itself if it cannot connect to 8.8.8.8. https://news.ycombinator.com/item?id=19170671 https://news.ycombinator.com/item?id=19170671
- onlingyding 7y agoI don't think that's true anymore. I've blocked my Chromecasts accessing Google's DNS servers and then just fall back to the ones from DHCP.
- remus 7y agoWhen this came up on hn before someone from Google said it was because they'd had problems with malformed responses from other DNS providers.
- andrewla 7y agoIt's pretty clear that the ISPs drafted their letter before Google made it clear that they would not be forcing the transition to their own DNS servers. The complaints are entirely about centralization. Google has attempted to allay some of these concerns, but their initial blog post [1] makes it lear that only certain whitelisted DNS providers would be permitted to participate. That does imply a degree of centralization regardless of Google's assurances to the contrary. [1] https://blog.chromium.org/2019/09/experimenting-with-same-provider-dns.html https://blog.chromium.org/2019/09/experimenting-with-same-pr...
- chvid 7y agoGoogle wants the whole internet to go through them. Starting with the bloody DNS ... nice plan ... probably needs quite a bit lobbying and bad-mouthing other actors to succeed though ... Absolutely. You can find a dishonest ISP. The difference is that there are thousands of them. And not just one big opaque entity.
- freyr 7y agoThey're not moving anybody to Google's own DNS servers. If your current DNS provider offers encrypted service, they'll begin using that. Starting with version 78, Chrome will begin experimenting with the new DoH feature. Under the experiment, Chrome will "check if the user's current DNS provider is among a list of DoH-compatible providers, and upgrade to the equivalent DoH service from the same provider," Google wrote. "If the DNS provider isn't in the list, Chrome will continue to operate as it does today."
- Andrex 7y agoISPs are de facto more opaque than Google, and I'm not sure having a thousand of them is better than having only one. A single company is easily legislatable, auditable, fineable, and chargeable if offenses are found. A thousand individual bad actors? The odds decrease.
- myrandomcomment 7y agoI am a bit stuck here. I know it is a bit insane, but I run a simple system at home because I think, so if I drop dead tomorrow how is my wife going to sort this. If I am dead, internet still needs to work so my kid can do her home work. So despite my geek love, I do not run my own DNS, etc. the other part is I use unblock-us so iPlayer (BBC) works here in the US. I would love to set everything up so everything is encrypted but ... yah. Sorry depressive.
- zupa-hu 7y agoThat sounds backwards. You sure that will be their biggest concern if you drop dead? They can always throw out your weird techy stuff and buy some cheap commodity solution and get them installed. Your reasoning sounds like, I'm not going to do breakfast for my family, because, ya know, if I drop dead, they will miss the breakfasts.
- dragonwriter 7y ago> You sure that will be their biggest concern if you drop dead? That it's not their biggest concern doesn't mean that it won't be a concern, nor did it mean that it's not something he can avoid becoming a concern.
- myrandomcomment 7y agoCorrect. We have life insurance. We have a trust. All the normal stuff you do. What I am looking at is what are the things that I do / maintain for the family and how will that be handled if something happens? Having an overly complex technical setup is one of the areas on that list. My death would of course have the normal emotional impact it would have for any family. I am trying to make sure that everything else around it that I can sort, I do. My daughter works hard everyday at her schooling because she is determined to be a doctor. My job as a parent is to give her everything I can to make sure she is happy and successfully in her life for as long as I can. The is the promise I made when we had her. Some of the comments here are taking the piss...let see how you feel when you hold your baby for the first time. Btw, for context, in the last 3 years I have had perfectly heathy friend that was in perfect shape drop dead from unexpected heart issues at 38. He had 3 kids. Another friend with 2 kids was killing in a car wreak at 44. Looking at the things their family’s have had to deal with is the reason why I am thinking about this.
- sys_64738 7y ago> DNS over HTTPS means ISPs can’t spy on their users The ISP can still do a reverse look up of the IP address to see where the traffic is going.
- nimbius 7y agoreverse lookups for things like AWS hosted or cloudflare hosted sites would be a miserably futile effort.
- Havoc 7y ago>Big ISPs aren’t happy As my mom said - if you cry enough to fill a tank I'll buy you a goldfish.
- Havoc 7y ago>Firefox[...]whether or not their existing DNS provider supports it. Wait what? Hows that gonna play with my existing pihole setup?
- judge2020 7y agoAs I understand it, you'll have to manually opt-out in firefox
- Crazyontap 7y agoI may not have the technical expertise to understand this fully but right now I'm doing adblocking by using adguard's DNS IPs in my router (1). It kinda works everywhere but for some apps like Chromecast I have to null route two IP addresses (8.8.8.8 and 8.8.4.4) otherwise it doesn't work. Those are both Google's IPs afaik. So my question is: will I be able to keep doing it after this? I am asking because I am extremely suspicious of Google these days and wondering if they have an ulterior motive to prevent users from doing such host based adblocking in future? (1) https://adguard.com/en/adguard-dns/overview.html https://adguard.com/en/adguard-dns/overview.html
- ekimekim 7y agoYes, 8.8.8.8 and 8.8.4.4 are Google DNS resolvers. Sounds like your Chromecast has them hard-coded instead of respecting your locally configured DNS. In comparison to your current position, where you're black-holing the hard-coded addresses and the app is falling back to your configured DNS: yes you will be able to continue doing that, assuming the Chromecast will maintain the same fallback behaviour. The exact addresses you need to block and the protocol/ports you need to block may change (eg. to port 443 tcp instead of port 53 udp). The big thing that DoH will prevent is something that you aren't currently doing, which is: instead of null-routing 8.8.8.8, you could be intercepting DNS requests to 8.8.8.8 and responding to them yourself. You would need to do this if the chromecast didn't fall back to using your proper DNS server. DoH will prevent this kind of interception, so your only choices are to allow it through or block it. And if the Chromecast then refuses to fall back, then blocking it will make the device not work, with no viable workaround short of replacing the firmware. The goal of DoH is ultimately to prevent your ISP doing the exact same thing to you, ie. intercepting (or just listening in on) your DNS requests even when you want them to go elsewhere. Unfortunately, there's no way to prevent the same protections from extending to a malicious local device trying to circumvent you on your local network.
- judge2020 7y agoThe reason for 8^4 being used for "can I connect to the internet" is valid since the DHCP DNS might be an internal router that's up even when the internet is unreachable; why it's being used for all DNS queries is less defensible. How long till it uses DoH to https://dns.google https://dns.google ?
- deleted 7y ago[deleted]
- l0b0 7y agoIs there a way to set up a big list of round-robin DNS servers in Linux, to at least minimize the amount of navigation history any one DNS provider knows about you?
- tyingq 7y agoUnbound can be configured as a local caching forwarder that round-robins to your list of resolvers. https://gist.github.com/MatthewVance/5051bf45cfed6e4a2a2ed9bb014bcd72 https://gist.github.com/MatthewVance/5051bf45cfed6e4a2a2ed9b...
- deleted 7y ago[deleted]
- foobiekr 7y agoIf ISPs are against it I am for it. I’ve worked in the SP market for 15 of the last 20 years.
- Unklejoe 7y agoI guess this means no more DNS based ad blocking for devices like the Chromecast which ignore the DNS info provided by DHCP and are instead hard coded to use Google’s server?
- Santosh83 7y agoWhat I fear will happen in several years is that local ISPs will also begin offering DoH by default (if you can't beat the competition, join them) and continue snooping on your traffic, just like Google or Cloudflare could do now technically, if they wanted to. Ultimately this boils down to which entity you trust more, your ISP or some other provider. Today Google/Cloudflare et al are by far the more trustworthy options for DNS at least. But this may not remain forever this way. The price for privacy/security is eternal vigilance, something end users don't (or can't) want to do.
- kyrra 7y agoAs a reminder, here is Google's privacy FAQ for DNS. https://developers.google.com/speed/public-dns/faq#privacy https://developers.google.com/speed/public-dns/faq#privacy
- topranks 7y agoWhy would you fear ISPs offering an encrypted service? It’s hardly a step backwards? DoT would be preferable to DoH (no additional metadata / cookies,) but either way ISPs should adopt encrypted DNS. You are correct it boils down to “who you trust.” In my country the ISP wins hands down over a foreign mega-corp so I end up making a different decision to you. The key thing is that is a choice for users, not something software just does without knowledge of what’s going on.
- pornel 7y agoBecause DoH is supposed to hide the DNS traffic from ISPs (among others). Sending the DNS traffic straight to the ISP defeats the purpose of it. That's like MITM on the first hop.
- doikor 7y agoBut the default state is to use the dns provided by your isp so nothing really changes.
- jedimastert 7y ago
- isaikumar 7y agoThis is a boon for Indians.
- gigatexal 7y agoIf this prevents ISPs from making even a penny on data mined from DNS queries of their users, even in an aggregated and anonymized manner then so be it because ISPs are supposed to be dumb pipes. And there is nothing creepier than someone mining what I search for. Just fulfill the contract of giving me the internet for my 75USD a month.
- Schnitz 7y agoAll we ever wanted was a dumb fat pipe. All we ever got was triple play. No pity.
- knorker 7y agoFrankly the ISPs can go fuck themselves. They're a bit too comfortable in the role of bullying gatekeeper to the Internet.
- gudok 7y agoHow exactly encrypted DNS will reduce spying? ISPs will still be able to observe IP addresses users connect to and even particular host names in SSL handshakes.
- Katzenjammer 7y ago“ISPs are evil and spying on you!” - One of the largest commercial companies acting evil and spying on you.
- decksta19 7y agoAt the request from some less technical friends I cooked up a solution for using encrypted DNS and Pi-hole together nicely wrapped in a docker-compose config that supports both x86_64 and ARM (RaspberryPi) deployments. https://github.com/benke/docker-dnscyrpt-pihole https://github.com/benke/docker-dnscyrpt-pihole
- scoutt 7y agoDoes this mean that ad-blocking HW/SW that uses DNS to filter remote sites (Pi-Hole?) will stop working? That's the only reason I see Google will try a move like that.
- throwaway242625 7y agoI work for a large retailer ecommerce office and over the years found the business purchase huge lists of subscriber names plus domains from ISP customer browsing. Att and Verizon selling that I know about, maybe more that I dont know. With the amount of money involved that Im sure they aren't happy.
- jedisct1 7y agoYandex Browser has been supporting encrypted DNS since 2016....
- pulse7 7y agoWith the statement "could interfere on a mass scale with critical Internet functions, as well as raise data-competition issues" they are actually lying and misrepresenting the issue. In reality there is not much "to interfere" - especially not so much, that you would need to contact the Congress...
- zecg 7y agoGoogle probably isn't happy I won't be using their encrypted DNS, either.
- kmlx 7y agono, but the ISPs and your government are very happy about your decision.
- KaiserPro 7y agoIn the land where GDPR exists, I can see why ISPs are a little annoyed. Directing users to local CDN instances has now got harder, which means its going to cost more for things like netflix In the US, yes, that means that ISP can't mine youre data, however, you are handing more information to google.
- alex_duf 7y agoIt sounds a lot like a non issue. If providers want to keep vacuuming personal data they can provide DNS over HTTPS and they'll capture the same amount of data.
- danmg 7y agoThere have been several articles in the past few days whinging about both mozilla and chrome incorporating DNS over TLS. Someone seems to be REALLY unhappy about this and those people seem to be trying to use the press as a microphone. It seems like it's touching a nerve and advertisers and governments are really sweating losing their ability do low effort snooping.
- Tepix 7y agoI guess everyone who cares about privacy should run his own DNS server/cache somewhere on the internet. Same as mail, really.
- Wheaties466 7y agoHow does that help at all? You're upstream DNS requests would still be unencrypted when they are forwarded to the root servers.
- Tepix 7y agoThe upstream DNS requests to the authorative DNS servers are unavoidable at the moment so you achieve a minimum of privacy invasion.
- ivl 7y agoThankfully, ISPs being upset about it is a really good way to determine if it's a good thing.
- techslave 7y ago“data competition”. lol. the ISPs are literally complaining that google will now have the DNS data, and they won’t.
- hobbes78 7y ago> google will now have the DNS data It wont necessarily be Google... From what I understood from the article, if you're currently using OpenDNS, Cloudflare DNS, etc., after the change you'll still continue to use them, only the protocol used to access them will change...
- deleted 7y ago[deleted]
- Ilovepoetry 7y agoOnce upon a time privacy was a good thing. Now, wiretapping has become the norm, and privacy means nothing. So disapointed.
- aschatten 7y agoGoogle defaulting to ignore system settings and use Google DNS server is an issue. But it's cute how ISPs are trying to mash deploying of DoH support and default to Google server into one issue. The last paragraph absolutely seems like fearmongering: Moreover, the centralized control of encrypted DNS threatens to harm consumers by interfering with a wide range of services provided by ISPs (both enterprise and public-facing) and others. Over the last several decades, DNS has been used to build other critical internet features and functionality including: (a) the provision of parental controls and IoT management for end users; (b) connecting end users to the nearest content delivery networks, thus ensuring the delivery of content in the fastest, cheapest, and most reliable manner; and (c) assisting rights holders’ and law enforcement’s efforts in enforcing judicial orders in combatting online piracy, as well as law enforcement’s efforts in enforcing judicial orders in combatting the exploitation of minors. Google’s centralization of DNS would bypass these critical features, undermining important consumer services and protections, and likely resulting in confusion because consumers will not understand why these features are no longer working. This centralization also raises serious cybersecurity risks and creates a single point of failure for global Internet services that is fundamentally at odds with the decentralized architecture of the internet. By limiting the ability to spot network threat indicators, it would also undermine federal government and private sector efforts to use DNS information to mitigate cybersecurity risks. I don't see how IoT management is going to be affected by DNS resolution made by a browser. CDN's DNS server in any case sits upstream and should be able to perform needed optimization. Google's or any other US DNS provider is not exempt from complying with the US law and court orders.
- musicale 7y agoAlthough it's going to spark an ISP anti-privacy arms race, this demonstrates why encrypted DNS is necessary.