5 ms·

I'm curious at how the article implies that DoH is going do anything. I'd imagine CloudFlare, etc. would comply with FBI requests just as much as your local ISP

I'm curious at how the article implies that DoH is going do anything. I'd imagine CloudFlare, etc. would comply with FBI requests just as much as your local ISP. Factor in co-operation from CDN's and really that covers a vast array of data that the US Government could access.

tialaramex 6y ago
The main practical problem is that the NSA and similar agencies currently collect absolutely everything. Regardless of warrants, constitutional amendments, or senators banging their fists on the table, these agencies operate with impunity and they know it. DoH pragmatically reduces their ability to conduct such global surveillance. "Pervasive Monitoring is An Attack". We speak of man's laws and nature's as though they were the same kind of thing but they really, really aren't. I can no more magically replay the session keys from last week's Wikipedia visit in response to a court order, a warrant or the US Constitution itself than I could dance on the surface of the sun if they required that. The idea here isn't that Public Enemy Number One today is protected from surveillance, but instead that you today are protected from the hypothetical surveillance of your past that might be authorised if some day you become Public Enemy Number One.
quit32 6y ago
For one cloudflare is a lot more reputable than most US ISPs. Cloudflare explicitly says "We committed to never writing the querying IP addresses to disk and wiping all logs within 24 hours." https://blog.cloudflare.com/announcing-1111/ https://blog.cloudflare.com/announcing-1111/ If gov tried to force CF to change that they would likely put up a huge public legal fight to prevent it whereas ATT / Verizon and Comcast would bend over backwards to secretly comply while also simultaneously seeing if they could inject some ads into the pages you visited.
- billme 6y ago
  Cloudflare is neither magically protected from secret US court orders, nor is there any reason to believe that data is not saved by the US.
- lonelappde 6y ago
  Does CloudFlare have multiple external auditors verifying their claims?
  - jgrahamc 6y ago
    https://blog.cloudflare.com/announcing-the-results-of-the-1-1-1-1-public-dns-resolver-privacy-examination/ https://blog.cloudflare.com/announcing-the-results-of-the-1-...
  - quit32 6y ago
    Literally the next para in that blog - "we committed to retaining KPMG, the well-respected auditing firm, to audit our practices annually and publish a public report confirming we're doing what we said we would." In addition Mozilla put them through a rigorous process when selecting them as their default DoH provider which included them contractually agreeing to adhere to their stated policy. https://wiki.mozilla.org/Security/DOH-resolver-policy https://wiki.mozilla.org/Security/DOH-resolver-policy
- quit32 6y ago
  Also worth noting that cloud flare is a large driving force behind encrypted SNI which is the last nail in the coffin for putting ISPs in the dark when your average consumer is browsing the net. https://blog.cloudflare.com/encrypted-sni/ https://blog.cloudflare.com/encrypted-sni/ Basically when you connect over https using TLS 1.2 to a site that is hosted on a shared server or behind a load balancer, your browser must tell it in clear text which host name it is trying to connect to. Encrypted SNI in TLS 1.3 also encrypts this info such that if you are also using DoH or DNS over TLS to encrypt DNS query then the ISP can only see the IP of server you connect to which is often going to be a huge cloud provider's load balancer that might serve hundreds or more different sites throughout the day / at the same time.

tialaramex 6y ago

The main practical problem is that the NSA and similar agencies currently collect absolutely everything. Regardless of warrants, constitutional amendments, or senators banging their fists on the table, these agencies operate with impunity and they know it. DoH pragmatically reduces their ability to conduct such global surveillance. "Pervasive Monitoring is An Attack". We speak of man's laws and nature's as though they were the same kind of thing but they really, really aren't. I can no more magically replay the session keys from last week's Wikipedia visit in response to a court order, a warrant or the US Constitution itself than I could dance on the surface of the sun if they required that. The idea here isn't that Public Enemy Number One today is protected from surveillance, but instead that you today are protected from the hypothetical surveillance of your past that might be authorised if some day you become Public Enemy Number One.

quit32 6y ago

For one cloudflare is a lot more reputable than most US ISPs. Cloudflare explicitly says "We committed to never writing the querying IP addresses to disk and wiping all logs within 24 hours." https://blog.cloudflare.com/announcing-1111/ https://blog.cloudflare.com/announcing-1111/ If gov tried to force CF to change that they would likely put up a huge public legal fight to prevent it whereas ATT / Verizon and Comcast would bend over backwards to secretly comply while also simultaneously seeing if they could inject some ads into the pages you visited.

billme 6y ago
Cloudflare is neither magically protected from secret US court orders, nor is there any reason to believe that data is not saved by the US.
lonelappde 6y ago
Does CloudFlare have multiple external auditors verifying their claims?
- jgrahamc 6y ago
  https://blog.cloudflare.com/announcing-the-results-of-the-1-1-1-1-public-dns-resolver-privacy-examination/ https://blog.cloudflare.com/announcing-the-results-of-the-1-...
- quit32 6y ago
  Literally the next para in that blog - "we committed to retaining KPMG, the well-respected auditing firm, to audit our practices annually and publish a public report confirming we're doing what we said we would." In addition Mozilla put them through a rigorous process when selecting them as their default DoH provider which included them contractually agreeing to adhere to their stated policy. https://wiki.mozilla.org/Security/DOH-resolver-policy https://wiki.mozilla.org/Security/DOH-resolver-policy
quit32 6y ago
Also worth noting that cloud flare is a large driving force behind encrypted SNI which is the last nail in the coffin for putting ISPs in the dark when your average consumer is browsing the net. https://blog.cloudflare.com/encrypted-sni/ https://blog.cloudflare.com/encrypted-sni/ Basically when you connect over https using TLS 1.2 to a site that is hosted on a shared server or behind a load balancer, your browser must tell it in clear text which host name it is trying to connect to. Encrypted SNI in TLS 1.3 also encrypts this info such that if you are also using DoH or DNS over TLS to encrypt DNS query then the ISP can only see the IP of server you connect to which is often going to be a huge cloud provider's load balancer that might serve hundreds or more different sites throughout the day / at the same time.