4 ms·
What irritates me about DoH is it's lazy. I get the impression Google, Mozilla etc. are genuinely irritated with crappy networks and invasive ISPs meddling wit
by corford 6y ago
What irritates me about DoH is it's lazy.
I get the impression Google, Mozilla etc. are genuinely irritated with crappy networks and invasive ISPs meddling with DNS traffic. What I don't accept is their decision to abuse their market positions to impose a quick, unilateral solution that comes with a range of unfortunate long term implications and secondary effects vis a vis centralization.
Imho, it would have been much, much better if they had used their resources and clout to help fund & advocate for a general, independent transition over to DoT for last mile and increased adoption of DNSSEC and DNSCurve upstream.
The world manged to move to encrypted email and www. Surely it could move to encrypted DNS without browser vendors forcing us to split name resolution and send half of it over HTTP?
- comex 6y agoThe problem isn't just ISPs meddling with DNS traffic, but ISPs passively collecting DNS traffic and using it to track users, something which is believed to have happened in the US on at least one occasion. [1] DoT to your ISP doesn't help if you don't trust your ISP. There is also the risk of collection by intelligence agencies. [1] https://gigaom.com/2014/05/13/atts-gigapower-plans-turn-privacy-into-a-luxury-that-few-would-choose/ https://gigaom.com/2014/05/13/atts-gigapower-plans-turn-priv...
- corford 6y agoIf you don't trust your ISP, you are savvy enough to use a). a different resolver or b). a VPN. In both cases, the decision is opt-in (which is what it should be). Edit: or option c). apply pressure to your government representatives to update their privacy laws so ISP snooping doesn't happen in the first place. It's a sad state of affairs when the ISP market has failed so badly that you can't find an ISP you can trust.
- comex 6y ago> If you don't trust your ISP, you are savvy enough to use a). a different resolver or b). a VPN. In both cases, the decision is opt-in (which is what it should be). So you think that non-savvy users don't deserve privacy? > Edit: or option c). apply pressure to your government representatives to update their privacy laws so ISP snooping doesn't happen in the first place. That's definitely desirable. Heck, the snooping in question might already be illegal in California under the new CCPA. But I don't see federal legislation happening anytime soon, and the US is not the only jurisdiction lacking privacy protections. And while privacy laws can prevent snooping for advertising purposes, good luck convincing the government to outlaw snooping by intelligence agencies. Ultimately, legal and technical measures are not mutually exclusive, and we should use both.
- axaxs 6y agoThe nonsavy user gets zero privacy. Who cares about encrypted DNS when your ISP sees every server you connect to?
- _jarroda 6y agoThe reason I don't trust my ISP is because of my government. I don't think appealing to them for help will be of much use.
- corford 6y agoThen DoH isn't going to help you very much. Move country or use a VPN.
- tptacek 6y agoDNSSEC provides no privacy (or, for that matter, endpoint DNS protection) at all.
- corford 6y agoDoH isn't meant to provide any privacy beyond the first resolver anyway. DNSSEC gives you trust to the root servers, DNSCurve gives you privacy between supporting upstream resolvers.
- tptacek 6y agoNo, it doesn't. DNSSEC does nothing but sign requests, and nothing at all for endpoints; it collapses down to a single header bit between resolvers and DNS servers.