5 ms·
I could never think of why Mozilla and friends are so aggressively pushing DoH, but I think you nailed it when you pointed out they can tie a specific device's
by Eiriksmal 7y ago
I could never think of why Mozilla and friends are so aggressively pushing DoH, but I think you nailed it when you pointed out they can tie a specific device's DNS requests to its other data.
I run Unbound and Pi-Hole to do my own recursive resolving. Like a normal wireless router doing all the DNS lookups for its DHCP clients, Mozilla has no idea which particular device on my network is accessing duckduckgo.com. Once each browser happily sends requests to Mozilla, then on to NextDNS, there's a whole lot more data suddenly available to commingle in a data lake... The efficacy of browser fingerprinting means they won't even need cookies to distinguish between devices in those HTTP headers.
As far as I know, good ol' Insight Communications (then Time Warner, now Spectrum) made money from selling me access to its high-speed internet service, and running ads on failed-to-find-your-website DNS hijacks. Heck, most of its money probably came from upselling people to buy bundled VoIP landlines and premium cable packages--whatever tiny slice of revenue came from those lookups surely pales in comparison to tens of thousands of unused phone subscriptions.
For all the commenters here who think that Google and the other major tech companies are somehow more trustworthy than your ISP? Yeah, I just can't agree with those opinions.
Edit: Less trustworthy should have been more trustworthy.
- stock_toaster 7y ago> For all the commenters here who think that Google and the other major tech companies are somehow less trustworthy than your ISP? Yeah, I just can't agree with those opinions. Additionally, at least my ISP is doing business in my state/country, so there may be _some_ legal recourse if they screw me too hard.
- kick 7y agoDoH is only available in the U.S. for Firefox users as far as I'm aware, so all of the people who might be "screwed too hard" have legal recourse.
- hu3 7y agoFor now.
- chrysoprace 7y agoIt's available everywhere; it's just only enabled by default in the U.S.
- tialaramex 7y agoNo it's available everywhere. It's a pref. The default if you haven't set the pref differs in the US.
- incompatible 7y agoYour country can also put other obligations on your ISP, such as censorship and data logging.
- vetinari 7y agoMy country, as most democracies, do that because we the people want them to do it. Otherwise, you have much bigger problems than DNS.
- asveikau 7y ago> I run Unbound and Pi-Hole to do my own recursive resolving. As documented by Mozilla, I made my network's DNS have use-application-dns.net return NXDOMAIN to opt out. https://support.mozilla.org/en-US/kb/canary-domain-use-application-dnsnet https://support.mozilla.org/en-US/kb/canary-domain-use-appli... My unbound config line is: local-zone: "use-application-dns.net." static
- nerdponx 7y agoIf Mozilla were actually serious about giving users control, they'd make this easier to configure.
- asveikau 7y agoI think this is pretty easy and appropriate for what it does. (Since my home DNS server is offered via DHCP to the LAN, it disables for the entire network without having to configure each client.) Disabling on a per-client basis probably has an about:config setting, and I just checked and saw a UI setting under Preferences -> Connection Settings -> Enable DNS over HTTPS.