4 ms·

What I fear will happen in several years is that local ISPs will also begin offering DoH by default (if you can't beat the competition, join them) and continue

What I fear will happen in several years is that local ISPs will also begin offering DoH by default (if you can't beat the competition, join them) and continue snooping on your traffic, just like Google or Cloudflare could do now technically, if they wanted to. Ultimately this boils down to which entity you trust more, your ISP or some other provider. Today Google/Cloudflare et al are by far the more trustworthy options for DNS at least. But this may not remain forever this way. The price for privacy/security is eternal vigilance, something end users don't (or can't) want to do.

kyrra 7y ago
As a reminder, here is Google's privacy FAQ for DNS. https://developers.google.com/speed/public-dns/faq#privacy https://developers.google.com/speed/public-dns/faq#privacy
topranks 7y ago
Why would you fear ISPs offering an encrypted service? It’s hardly a step backwards? DoT would be preferable to DoH (no additional metadata / cookies,) but either way ISPs should adopt encrypted DNS. You are correct it boils down to “who you trust.” In my country the ISP wins hands down over a foreign mega-corp so I end up making a different decision to you. The key thing is that is a choice for users, not something software just does without knowledge of what’s going on.
- pornel 7y ago
  Because DoH is supposed to hide the DNS traffic from ISPs (among others). Sending the DNS traffic straight to the ISP defeats the purpose of it. That's like MITM on the first hop.
  - doikor 7y ago
    But the default state is to use the dns provided by your isp so nothing really changes.
- jedimastert 7y ago
  > Why would you fear ISPs offering an encrypted service? encryption doesn't hide anything from whoever's on the other side, just the people in the middle. If the goal is to not let ISPs in on your DNS history, then DoH to the ISP won't do that.

kyrra 7y ago

As a reminder, here is Google's privacy FAQ for DNS. https://developers.google.com/speed/public-dns/faq#privacy https://developers.google.com/speed/public-dns/faq#privacy

topranks 7y ago

Why would you fear ISPs offering an encrypted service? It’s hardly a step backwards? DoT would be preferable to DoH (no additional metadata / cookies,) but either way ISPs should adopt encrypted DNS. You are correct it boils down to “who you trust.” In my country the ISP wins hands down over a foreign mega-corp so I end up making a different decision to you. The key thing is that is a choice for users, not something software just does without knowledge of what’s going on.

pornel 7y ago
Because DoH is supposed to hide the DNS traffic from ISPs (among others). Sending the DNS traffic straight to the ISP defeats the purpose of it. That's like MITM on the first hop.
- doikor 7y ago
  But the default state is to use the dns provided by your isp so nothing really changes.
jedimastert 7y ago
> Why would you fear ISPs offering an encrypted service? encryption doesn't hide anything from whoever's on the other side, just the people in the middle. If the goal is to not let ISPs in on your DNS history, then DoH to the ISP won't do that.