5 ms·

> Your ISP is literally selling this information right now No, mine is not. > Use google if you don't like CF Google is no better. > or just disable it! It

> Your ISP is literally selling this information right now No, mine is not. > Use google if you don't like CF Google is no better. > or just disable it! It is never okay to hijack my DNS lookups. Posting a note someplace about how it can be restored does not change the fact that you hijacked it, and does not make it okay. > This is not adding a new party that can surveil you Given that the DoH provider is a new party with which most of my requests had no contact before, that is an absurd claim. > this is reducing risk by separating who can see your DNS from who can see your traffic. No, it is not. My ISP can still see the domain names of sites I visit, via both SNI and OCSP. They can also deduce the same information in most cases, via address correlation. (Thankfully, I chose an ISP that respects privacy.) This change quietly hands my lookups over to another party as well. If I hadn't noticed the announcement, or didn't have enough technical knowledge to fully understand and revert the change before it went live, my lookups would be pwned. > The idea is to have eSNI ubiquity to where TLS traffic will conceal the sites you visit I don't care what your idea is for the future. It doesn't exist today, so is not relevant to what you have done today. (And even if it did, it would not excuse hijacking my DNS lookups.)

growse 7y ago
They're not doing it in secret. Use a different browser if you don't like it, or fork it. Mozilla have made a value judgement that DoH is more useful to end users than the supposed privacy loss. You're free to disagree, but neither of you is objectively correct.
- zzzcpan 7y ago
  > or fork it Seems like this is where things are going. None of the main browsers respect users enough today to the point that they might not even stay usable without forking.
- coribuci 7y ago
  > They're not doing it in secret. Use a different browser if you don't like it, or fork it. They are not doing it in plain sight either. > Mozilla have made a value judgement that DoH is more useful to end users than the supposed privacy loss. You're free to disagree, but neither of you is objectively correct. Mozilla made a lot of "value judgement" lately just like Chrome. That's why i try to switch to seamonkey.
- teknopaul 7y ago
  IMHO Mozilla have made a bad call justified by misguided security. People _are_ using a different browser. People _have_ forked, (mostly webkit based) When everyone has stopped using FireFox, will Mozilla conclude that the Internet is finally secure? If we see an uptick in Firefox usage we can presume Mozilla's value judgement was correct.
nwallin 7y ago
> My ISP can still see the domain names of sites I visit, via both SNI and OCSP. Encrypted SNI and OCSP stapling solve those problems.
- badrabbit 7y ago
  They see the SNI but not the host. eSNI would help but so do CDNs (even with ocsp/crl since hundreds of sites use a single cert. Domain fronting is getting more common too

growse 7y ago

They're not doing it in secret. Use a different browser if you don't like it, or fork it. Mozilla have made a value judgement that DoH is more useful to end users than the supposed privacy loss. You're free to disagree, but neither of you is objectively correct.

zzzcpan 7y ago
> or fork it Seems like this is where things are going. None of the main browsers respect users enough today to the point that they might not even stay usable without forking.
coribuci 7y ago
> They're not doing it in secret. Use a different browser if you don't like it, or fork it. They are not doing it in plain sight either. > Mozilla have made a value judgement that DoH is more useful to end users than the supposed privacy loss. You're free to disagree, but neither of you is objectively correct. Mozilla made a lot of "value judgement" lately just like Chrome. That's why i try to switch to seamonkey.
teknopaul 7y ago
IMHO Mozilla have made a bad call justified by misguided security. People _are_ using a different browser. People _have_ forked, (mostly webkit based) When everyone has stopped using FireFox, will Mozilla conclude that the Internet is finally secure? If we see an uptick in Firefox usage we can presume Mozilla's value judgement was correct.

nwallin 7y ago

> My ISP can still see the domain names of sites I visit, via both SNI and OCSP. Encrypted SNI and OCSP stapling solve those problems.

badrabbit 7y ago
They see the SNI but not the host. eSNI would help but so do CDNs (even with ocsp/crl since hundreds of sites use a single cert. Domain fronting is getting more common too