3 ms·

> First, I don't think this is actually a "safer infrastructure" compared with other DNS encryption schemes, because it opens a new hole. Browsers are complete

> First, I don't think this is actually a "safer infrastructure" compared with other DNS encryption schemes, because it opens a new hole. Browsers are completely correct to treat the network as hostile in their default configurations, unless explicitly configured to trust something. More prevalent end-to-end encryption is a good thing. And DoH makes it easier to get encrypted DNS requests through without having them blocked by hostile networks who want to intercept those DNS requests. If an encrypted DNS scheme is blockable by you, it's blockable by an ISP. There will not be an uproar about it, any more than there's currently an uproar about ISP's selling DNS-based browsing information about their users. It will simply fail.

JohnFen 7y ago
> More prevalent end-to-end encryption is a good thing. I agree -- I am not arguing against more prevalent e2e crypto at all. > If an encrypted DNS scheme is blockable by you, it's blockable by an ISP. Perhaps, but it's also possible (unless you're using DoH) to evade those blocks without a great deal of difficulty. I'm not arguing with anything you've said here, really. I'm just pointing out that the way that DoH works means that there is a security hole that makes it very easy for marketers and other spies to evade your protections against them. So yes, DoH brings some security gains. But at the same time, it also brings some security losses. Whether that tradeoff is good for you should be a decision you can make -- but again, due to the way DoH works, you no longer have that choice available to you without going to extreme measures like I have.