3 ms·

It's not about selling the data for ISPs, never was, never will be. For ISPs almost all websites are uniquely identifiable by looking at clear text SNI and Host

It's not about selling the data for ISPs, never was, never will be. For ISPs almost all websites are uniquely identifiable by looking at clear text SNI and Host: headers. But it's much worse, 95% of top 1 million websites are uniquely identifiable just by looking at IP addresses during page load, basically netflow data that pretty much all ISPs store. And this data is more detailed, than DNS queries. There is a lot of detailed data to monetize, cheaply, with no ability to hide, besides Tor and VPN. ISPs couldn't care less about such silly attempts to limit spying that don't really work, what ISPs actually care about is control. They want to be the ones who decide which websites have which IP addresses, they want to be able to change them, block them, do address translations, maybe show you ads on nonexistent domains, etc. Mozilla, Google and Cloudflare are no better than ISPs here either. They don't want you to know all of the above. Mozilla wants money from Cloudflare, Cloudflare wants to control critical piece of infrastructure pretty much all competing CDNs rely on, Google probably doesn't need it, but just can't help itself to get its hands on that data.

JoBrad 7y ago
Collecting your days and _being able_ to sell it was at least important enough that ISPs convinced Congress to pass a law allowing them to do so. It would take quite a bit of evidence to convince me that they don’t currently do exactly that. https://www.consumerreports.org/consumerist/house-votes-to-allow-internet-service-providers-to-sell-share-your-personal-information/ https://www.consumerreports.org/consumerist/house-votes-to-a...
danShumway 7y ago
My original assumption was that IP addresses, headers, and request sizes were good enough to monitor users, and that ISPs wouldn't care about DoH because of that. But the amount of effort they're putting into blocking DoH makes me question my assumption. There is something about plain-text DNS that they value a lot. Bear in mind, I could always change my DNS server from my ISP's. They weren't going out of their way to stop me before. And if I'm already sending your DNS queries to Google, Cloudflare, or a local Raspberry Pi, I'm already robbing my ISP of the ability to redirect those queries or decide which websites have which IP addresses, or redirect them to pages with ads. So the control angle feels odd to me, because I don't see how DoH robs them of any more control than my Raspberry Pi already does. Of course, having DoH be the default might change things, maybe ISPs were just assuming people like me would be a minority. I dunno. But Google isn't even changing the default, it's just supporting DoH if it's available on the DNS server that clients already are connecting to. The only change right now for most people using Chrome will be that a few of them that set their DNS server to something other than the ISP default will have their queries encrypted. From the article: > Chrome will check if the user’s DNS provider is among a list of participating DoH-compatible providers and if so, it will enable DoH. If the DNS provider is not on the list, Chrome won’t enable DoH and will continue to operate as it does today. Maybe it's that ISPs see that this is going to get worse for them in the future, and eventually the default will change? I could buy that argument. Maybe they see this as an important moment to nip it in the bud before every browser is using a different DNS resolver than the router and they lose control that way. I've seen a few people propose that this could have implications for Net Neutrality, because ISPs won't be able to claim they do the same level of filtering. Regardless, the idea that this is a small change that doesn't matter for the Internet as a whole or that it won't change anything for ordinary users -- that idea does not match up with the reactions I'm seeing from the stakeholders who are affected by it. And since ISPs are primarily motivated by money, I don't think it's a crazy leap to assume there is something in non-encrypted DNS; whether it be data, or website access, or ad injections, that they are looking to monetize. > Mozilla, Google and Cloudflare are no better than ISPs here either. They don't want you to know all of the above. Mozilla wants money from Cloudflare, Cloudflare wants to control critical piece of infrastructure pretty much all competing CDNs rely on, Google probably doesn't need it, but just can't help itself to get its hands on that data. You kind of lost me here, this doesn't make sense to me. DoH is no more centralized than normal DNS, it's just a protocol. You can have whatever DoH resolver you want, you can even run your own on an internal network. What new data is Google getting from DoH that they weren't already getting from normal DNS? Cloudflare is already one the biggest DNS providers on the web. I agree that's worth being concerned about, but how does DoH cement their position?
- WarOnPrivacy 7y ago
  Do ISPs want to monitor and collect data? If so, plain text DNS queries/responses are rich in metadata but an ISP has to sniff their own pipe to glean it. DNS over HTTPS (& DNS over TLS) reduces the obviousness of that traffic. When encrypted DNS is used, an ISP (or any MitM) would have to resort to more invasive analysis (ie: Sandvine) - to gather similar (if somewhat less precise) metadata.
user64372 7y ago
Yes, control. Control and scale. ISPs can afford some nerds configuring their DNS to 1.1.1.1 or 8.8.8.8 but they can't afford browsers deciding for all users. If course Google will say that it won't force nothing and it's true today. But will it be true tomorrow? Ask uBO users about that
- jwilk 7y ago
  > Ask uBO users about that What do you mean?
  - zaarn 7y ago
    Recently Google blocked uBO Dev Builds on grounds of "including unrelated functionality", of course, it was all an accident made by some AI, so no actual human is responsible, and in now way, shape or form did google intend to kill of a project that harms it's profits.
comex 7y ago
> Mozilla wants money from Cloudflare, No, they don’t. > Is Mozilla getting paid to route DNS requests to Cloudflare? > No money is being exchanged to route DNS requests to Cloudflare. https://support.mozilla.org/en-US/kb/dns-over-https-doh-faqs#w_is-mozilla-getting-paid-to-route-dns-requests-to-cloudflare https://support.mozilla.org/en-US/kb/dns-over-https-doh-faqs...

JoBrad 7y ago

Collecting your days and _being able_ to sell it was at least important enough that ISPs convinced Congress to pass a law allowing them to do so. It would take quite a bit of evidence to convince me that they don’t currently do exactly that. https://www.consumerreports.org/consumerist/house-votes-to-allow-internet-service-providers-to-sell-share-your-personal-information/ https://www.consumerreports.org/consumerist/house-votes-to-a...

danShumway 7y ago

My original assumption was that IP addresses, headers, and request sizes were good enough to monitor users, and that ISPs wouldn't care about DoH because of that. But the amount of effort they're putting into blocking DoH makes me question my assumption. There is something about plain-text DNS that they value a lot. Bear in mind, I could always change my DNS server from my ISP's. They weren't going out of their way to stop me before. And if I'm already sending your DNS queries to Google, Cloudflare, or a local Raspberry Pi, I'm already robbing my ISP of the ability to redirect those queries or decide which websites have which IP addresses, or redirect them to pages with ads. So the control angle feels odd to me, because I don't see how DoH robs them of any more control than my Raspberry Pi already does. Of course, having DoH be the default might change things, maybe ISPs were just assuming people like me would be a minority. I dunno. But Google isn't even changing the default, it's just supporting DoH if it's available on the DNS server that clients already are connecting to. The only change right now for most people using Chrome will be that a few of them that set their DNS server to something other than the ISP default will have their queries encrypted. From the article: > Chrome will check if the user’s DNS provider is among a list of participating DoH-compatible providers and if so, it will enable DoH. If the DNS provider is not on the list, Chrome won’t enable DoH and will continue to operate as it does today. Maybe it's that ISPs see that this is going to get worse for them in the future, and eventually the default will change? I could buy that argument. Maybe they see this as an important moment to nip it in the bud before every browser is using a different DNS resolver than the router and they lose control that way. I've seen a few people propose that this could have implications for Net Neutrality, because ISPs won't be able to claim they do the same level of filtering. Regardless, the idea that this is a small change that doesn't matter for the Internet as a whole or that it won't change anything for ordinary users -- that idea does not match up with the reactions I'm seeing from the stakeholders who are affected by it. And since ISPs are primarily motivated by money, I don't think it's a crazy leap to assume there is something in non-encrypted DNS; whether it be data, or website access, or ad injections, that they are looking to monetize. > Mozilla, Google and Cloudflare are no better than ISPs here either. They don't want you to know all of the above. Mozilla wants money from Cloudflare, Cloudflare wants to control critical piece of infrastructure pretty much all competing CDNs rely on, Google probably doesn't need it, but just can't help itself to get its hands on that data. You kind of lost me here, this doesn't make sense to me. DoH is no more centralized than normal DNS, it's just a protocol. You can have whatever DoH resolver you want, you can even run your own on an internal network. What new data is Google getting from DoH that they weren't already getting from normal DNS? Cloudflare is already one the biggest DNS providers on the web. I agree that's worth being concerned about, but how does DoH cement their position?

WarOnPrivacy 7y ago
Do ISPs want to monitor and collect data? If so, plain text DNS queries/responses are rich in metadata but an ISP has to sniff their own pipe to glean it. DNS over HTTPS (& DNS over TLS) reduces the obviousness of that traffic. When encrypted DNS is used, an ISP (or any MitM) would have to resort to more invasive analysis (ie: Sandvine) - to gather similar (if somewhat less precise) metadata.

user64372 7y ago

Yes, control. Control and scale. ISPs can afford some nerds configuring their DNS to 1.1.1.1 or 8.8.8.8 but they can't afford browsers deciding for all users. If course Google will say that it won't force nothing and it's true today. But will it be true tomorrow? Ask uBO users about that

jwilk 7y ago
> Ask uBO users about that What do you mean?
- zaarn 7y ago
  Recently Google blocked uBO Dev Builds on grounds of "including unrelated functionality", of course, it was all an accident made by some AI, so no actual human is responsible, and in now way, shape or form did google intend to kill of a project that harms it's profits.

comex 7y ago

> Mozilla wants money from Cloudflare, No, they don’t. > Is Mozilla getting paid to route DNS requests to Cloudflare? > No money is being exchanged to route DNS requests to Cloudflare. https://support.mozilla.org/en-US/kb/dns-over-https-doh-faqs#w_is-mozilla-getting-paid-to-route-dns-requests-to-cloudflare https://support.mozilla.org/en-US/kb/dns-over-https-doh-faqs...