3 ms·

Oh, get the heck out of here with "Secure DNS". Allowing Google to snoop on all DNS is the opposite of safer and more private.

jefftk 6y ago
Chrome maintains a list of DNS providers known to support DNS-over-HTTPS. Chrome uses this list to match the user’s current DNS service provider with that provider’s DNS-over-HTTPS service, if the provider offers one. By keeping the user’s chosen provider, we can preserve any extra services offered by the DNS service provider, such as family-safe filtering, and therefore avoid breaking user expectations. Secure DNS is a "same-provider DNS-over-HTTPS upgrade" approach, and it sounds like you're conflating it with a different design, where Chrome would talk to Google-run DNS servers? (Disclosure: I work at Google, speaking only for myself)
- ve55 6y ago
  As far as I have noticed, only time Google makes something 'more private for everyone' historically, has been when they themselves have found a superior way to get around it. Whether this is because the entire Internet uses Google Analytics, Gmail, etc, or because they have a different more effective way of tracking DNS queries is irrelevant, since they always manage to find a way due to being omnipresent.
  - krn 6y ago
    > As far as I have noticed, only time Google makes something 'more private for everyone' historically, has been when they themselves have found a superior way to get around it. In theory, DNS-over-HTTPS in Chrome allows Google to bypass OS-level ad blockers. Just like Manifest v3 limits the capabilities of in-browser ad blocking.
  - tptacek 6y ago
    Yes, Google is pushing DoH because, internally, in the AdWords division, they've broken elliptic curve DSA.
    - ve55 6y ago
      Not quite the implication I intended, but when you own something like Google Analytics, you don't need to see everyone's DNS queries, because you have much, much more.
- acqq 6y ago
  I doubt that what you quote is full story, however and I would really like if somebody would be able to investigate what is actually happening. Let's take a trivial example: everybody has their own router at home, typically with the address of the DNS server visible in the local network as the address of the router, and their computers are seeing only that address. If Chrome would keep that, nobody's router would "provide DNS-over-HTTPS" and nothing would happen. That means that Chrome will try to avoid using the router as a DNS, and instead try to "guess" if the local router is "changing something" or "using a provider" (whatever they define as that). And then the Chrome will contact that guessed provider. As far as I understand, exactly the only device we can fully control is being actively avoided, and instead some "guessed" provider is contacted using HTTPS. So what is actually going on there? I'd like a honest technical description.
  - jefftk 6y ago
    > If Chrome would keep that, nobody's router would "provide DNS-over-HTTPS" and nothing would happen. That means that Chrome will try to avoid using the router as a DNS, and instead try to "guess" if the local router is "changing something" or "using a provider" (whatever they define as that). And then the Chrome will contact that guessed provider. That's not my read of the design doc [1] or code [2]. Instead, it looks to me like if you have your DNS server set to one of a hardcoded list of IPs known to support DoH then you get upgraded. That list is currently 8.8.8.8 (Google), 1.1.1.1 (CloudFlare), 9.9.9.9 (Quad9), and their aliases. If your DNS server is set to 192.168.0.1 or something, then this change will have no effect for you. [1] https://docs.google.com/document/d/15Ss0OaJeb-T3g2RMwgikHvsC0CPKd-MLeGeetv1wYY4/edit https://docs.google.com/document/d/15Ss0OaJeb-T3g2RMwgikHvsC... [2] https://chromium.googlesource.com/chromium/src/+/b0436911ed613ac66135df780cf8b170ebcea212/net/dns/host_resolver_manager.cc#501 https://chromium.googlesource.com/chromium/src/+/b0436911ed6...
tuxracer 6y ago
What about this enables Google to snoop on all DNS?
yadco 6y ago
For someone who is using Google, it's safer to trust them with DNS rather then another company.

jefftk 6y ago

Chrome maintains a list of DNS providers known to support DNS-over-HTTPS. Chrome uses this list to match the user’s current DNS service provider with that provider’s DNS-over-HTTPS service, if the provider offers one. By keeping the user’s chosen provider, we can preserve any extra services offered by the DNS service provider, such as family-safe filtering, and therefore avoid breaking user expectations. Secure DNS is a "same-provider DNS-over-HTTPS upgrade" approach, and it sounds like you're conflating it with a different design, where Chrome would talk to Google-run DNS servers? (Disclosure: I work at Google, speaking only for myself)

ve55 6y ago
As far as I have noticed, only time Google makes something 'more private for everyone' historically, has been when they themselves have found a superior way to get around it. Whether this is because the entire Internet uses Google Analytics, Gmail, etc, or because they have a different more effective way of tracking DNS queries is irrelevant, since they always manage to find a way due to being omnipresent.
- krn 6y ago
  > As far as I have noticed, only time Google makes something 'more private for everyone' historically, has been when they themselves have found a superior way to get around it. In theory, DNS-over-HTTPS in Chrome allows Google to bypass OS-level ad blockers. Just like Manifest v3 limits the capabilities of in-browser ad blocking.
- tptacek 6y ago
  Yes, Google is pushing DoH because, internally, in the AdWords division, they've broken elliptic curve DSA.
  - ve55 6y ago
    Not quite the implication I intended, but when you own something like Google Analytics, you don't need to see everyone's DNS queries, because you have much, much more.
acqq 6y ago
I doubt that what you quote is full story, however and I would really like if somebody would be able to investigate what is actually happening. Let's take a trivial example: everybody has their own router at home, typically with the address of the DNS server visible in the local network as the address of the router, and their computers are seeing only that address. If Chrome would keep that, nobody's router would "provide DNS-over-HTTPS" and nothing would happen. That means that Chrome will try to avoid using the router as a DNS, and instead try to "guess" if the local router is "changing something" or "using a provider" (whatever they define as that). And then the Chrome will contact that guessed provider. As far as I understand, exactly the only device we can fully control is being actively avoided, and instead some "guessed" provider is contacted using HTTPS. So what is actually going on there? I'd like a honest technical description.
- jefftk 6y ago
  > If Chrome would keep that, nobody's router would "provide DNS-over-HTTPS" and nothing would happen. That means that Chrome will try to avoid using the router as a DNS, and instead try to "guess" if the local router is "changing something" or "using a provider" (whatever they define as that). And then the Chrome will contact that guessed provider. That's not my read of the design doc [1] or code [2]. Instead, it looks to me like if you have your DNS server set to one of a hardcoded list of IPs known to support DoH then you get upgraded. That list is currently 8.8.8.8 (Google), 1.1.1.1 (CloudFlare), 9.9.9.9 (Quad9), and their aliases. If your DNS server is set to 192.168.0.1 or something, then this change will have no effect for you. [1] https://docs.google.com/document/d/15Ss0OaJeb-T3g2RMwgikHvsC0CPKd-MLeGeetv1wYY4/edit https://docs.google.com/document/d/15Ss0OaJeb-T3g2RMwgikHvsC... [2] https://chromium.googlesource.com/chromium/src/+/b0436911ed613ac66135df780cf8b170ebcea212/net/dns/host_resolver_manager.cc#501 https://chromium.googlesource.com/chromium/src/+/b0436911ed6...

tuxracer 6y ago

What about this enables Google to snoop on all DNS?

yadco 6y ago

For someone who is using Google, it's safer to trust them with DNS rather then another company.