3 ms·

> It sends all the users DNS queries to Cloudflare I wonder how much Cloudflare paid for this 'privilege' of being the default DNS provider.

by Jerry2 7y ago

nullc 7y ago
Mozilla claims that Cloudflare is not paying them, and claims that they have a contract with cloudflare which prohibits them from selling the data. I don't think that this improves the situation substantially. The history of internet privacy failures is full of empty and unrealized promises, and no amount of contracts or promises can trump a court order or a NSL. "Has no ability to collect" is the gold standard, and the only level of protection that guards against compromise and blanket state surveillance activities. AFAIK they also have never published the contract itself, though doing so wouldn't address the above points. Edit: After carefully reading the cloudflare privacy statement ( https://developers.cloudflare.com/1.1.1.1/commitment-to-privacy/privacy-policy/firefox/ https://developers.cloudflare.com/1.1.1.1/commitment-to-priv... ) I believe it unambiguously states they will collect "aggregate data" such as how much traffic each specific domain is receiving and use it for their own 'development' purposes. To me this seems extraordinarily valuable by itself, quite a windfall.
- Karunamon 7y ago
  Agreed. Unless that contract includes heavy penalties for selling and/or losing that data, its toothless nonsense. The fact that the contract hasn't been published is also problematic. If everything is above board, why hide?
  - nullc 7y ago
    To be fair, publishing contracts like that isn't a standard practice. That alone is a sufficient explanation. It still would be better if it were.
    - Karunamon 7y ago
      Mozilla isn't a standard company and this isn't a standard situation.
- JoshTriplett 7y ago
  ISPs can and do sell your information, and can also be served a warrant or NSL. Cloudflare, by contract, is prohibited from doing the former, which is a net improvement even if they're still subject to the latter. It's an incremental improvement, but a positive one. I would certainly love to see an even better protocol for Internet name resolution that prevents anyone from having name-lookup information, but in the meantime, DoH seems like a huge step forward in ensuring that no unencrypted traffic is visible to the ISP or local network.
  - nullc 7y ago
    Your ISP, however, is not prevented from collecting and selling your data by DoH. So the addition of default DoH in cloudflare adds an extra party that can intercept your traffic but does not remove any. > DoH seems like a huge step forward in ensuring that no unencrypted traffic is visible to the ISP or local network It does not do this.
    - growse 7y ago
      DNS traffic is a much richer and more valuable resource than a simple list of IP sessions. Yes, of course your ISP can see who you're connecting to and sell that, but denying them (and anyone else) the ability to collect all DNS traffic is better than not denying that.
      - nullc 7y ago
        DoH is significantly richer than DNS itself because of session reuse. DNS is cached, other than potential ambiguity related to shared hosts (which can be resolved by looking at SNI)-- I'm failing to see how DNS is richer than the traffic itself. Less costly to monitor? Sure.
  - rtsil 7y ago
    > ISPs can and do sell your information Not in my country, they'll be massively fined if they're caught doing that.
- gsich 7y ago
  >Mozilla claims that Cloudflare is not paying them, and claims that they have a contract with cloudflare which prohibits them from selling the data. As you said, this does not improve the situation. Mozilla can't even verify it. Also it could be a reverse data selling situation like with Google: They don't sell the data, companies pay money to Google to display ads to the users. Since they have so much data, they can target specific groups more easily. Data doesn't even need to leave Google for that to work.

> It sends all the users DNS queries to Cloudflare I wonder how much Cloudflare paid for this 'privilege' of being the default DNS provider.

by Jerry2 7y ago

> It sends all the users DNS queries to Cloudflare I wonder how much Cloudflare paid for this 'privilege' of being the default DNS provider.

nullc 7y ago

Mozilla claims that Cloudflare is not paying them, and claims that they have a contract with cloudflare which prohibits them from selling the data. I don't think that this improves the situation substantially. The history of internet privacy failures is full of empty and unrealized promises, and no amount of contracts or promises can trump a court order or a NSL. "Has no ability to collect" is the gold standard, and the only level of protection that guards against compromise and blanket state surveillance activities. AFAIK they also have never published the contract itself, though doing so wouldn't address the above points. Edit: After carefully reading the cloudflare privacy statement ( https://developers.cloudflare.com/1.1.1.1/commitment-to-privacy/privacy-policy/firefox/ https://developers.cloudflare.com/1.1.1.1/commitment-to-priv... ) I believe it unambiguously states they will collect "aggregate data" such as how much traffic each specific domain is receiving and use it for their own 'development' purposes. To me this seems extraordinarily valuable by itself, quite a windfall.

Karunamon 7y ago
Agreed. Unless that contract includes heavy penalties for selling and/or losing that data, its toothless nonsense. The fact that the contract hasn't been published is also problematic. If everything is above board, why hide?
- nullc 7y ago
  To be fair, publishing contracts like that isn't a standard practice. That alone is a sufficient explanation. It still would be better if it were.
  - Karunamon 7y ago
    Mozilla isn't a standard company and this isn't a standard situation.
JoshTriplett 7y ago
ISPs can and do sell your information, and can also be served a warrant or NSL. Cloudflare, by contract, is prohibited from doing the former, which is a net improvement even if they're still subject to the latter. It's an incremental improvement, but a positive one. I would certainly love to see an even better protocol for Internet name resolution that prevents anyone from having name-lookup information, but in the meantime, DoH seems like a huge step forward in ensuring that no unencrypted traffic is visible to the ISP or local network.
- nullc 7y ago
  Your ISP, however, is not prevented from collecting and selling your data by DoH. So the addition of default DoH in cloudflare adds an extra party that can intercept your traffic but does not remove any. > DoH seems like a huge step forward in ensuring that no unencrypted traffic is visible to the ISP or local network It does not do this.
  - growse 7y ago
    DNS traffic is a much richer and more valuable resource than a simple list of IP sessions. Yes, of course your ISP can see who you're connecting to and sell that, but denying them (and anyone else) the ability to collect all DNS traffic is better than not denying that.
    - nullc 7y ago
      DoH is significantly richer than DNS itself because of session reuse. DNS is cached, other than potential ambiguity related to shared hosts (which can be resolved by looking at SNI)-- I'm failing to see how DNS is richer than the traffic itself. Less costly to monitor? Sure.
- rtsil 7y ago
  > ISPs can and do sell your information Not in my country, they'll be massively fined if they're caught doing that.
gsich 7y ago
>Mozilla claims that Cloudflare is not paying them, and claims that they have a contract with cloudflare which prohibits them from selling the data. As you said, this does not improve the situation. Mozilla can't even verify it. Also it could be a reverse data selling situation like with Google: They don't sell the data, companies pay money to Google to display ads to the users. Since they have so much data, they can target specific groups more easily. Data doesn't even need to leave Google for that to work.