4 ms·

Now consider you are visiting a friend's house and you find out they have such a setup on their network... you wouldn't be bothered to learn that all the domain

by shawnz 6y ago

Now consider you are visiting a friend's house and you find out they have such a setup on their network... you wouldn't be bothered to learn that all the domain names you visit, even over TLS, are being processed by the homeowner and could be logged?

LinuxBender 6y ago
At a friends house, my laptop will join my private VPN mesh and my DNS lookups will still use my servers. This does assume they allow outbound connectivity to more than 80/443. I have found places that do not allow this. I could run tinc [1] on 443, but if UDP is blocked, the VPN will be slower. That said, in fairness, not everyone sets up their own VPN mesh. Some people use commercial VPN providers. So in that case, it would assume my friend does not block access to that VPN provider. [1] - http://tinc-vpn.org/ http://tinc-vpn.org/
- shawnz 6y ago
  So, don't you think it would be more hospitable to just allow privacy technologies to be used on your network without forcing your guests to buy a VPN?
  - LinuxBender 6y ago
    Maybe so, but that is my choice. It is my home and my network. I can choose to protect my guests and they can choose to get a VPN. I would not subject them to my ISP's DNS, nor would I subject them to centralized DNS. Both are equally dangerous in my view. I would always disclose to my guests what they are using, how to use it and what choices they have. The people implementing DoH in the browser are taking that choice away, so now my only option is to play the never ending game of whack-a-mole with the centralized DoH servers.
    - shawnz 6y ago
      I do not think that it is fair to say that changing a default is equivalent to taking a choice away. They are only moving the choice from the network operator's hands directly into the user's hands, which is where I think it belongs (and where it really was in the first place). In the hands of the user whose device is actually establishing the connection. You could block your guest's VPN connections, but you don't do that.. why not? Aren't they subverting your protection by using VPNs? > nor would I subject them to centralized DNS. Both are equally dangerous in my view. I would argue that large providers like Cloudflare are the only ones who realistically have the resources to stand up to threats like government intervention (where it is possible). They have strong legal and financial incentives to maintain their privacy guarantees which smaller providers don't have. Also you have the advantage of your data "hiding in plain sight" due to the high volume they deal with. I certainly wish there were more providers available than just Cloudflare and Google though.
      - LinuxBender 6y ago
        I do not think that it is fair to say that changing a default is equivalent to taking a choice away For my technical friends, that would be true. They can adjust their settings and be on their way. I won't block their choices aside from intercepting requests to the ISP DNS. Most of my friends are not technical, have no idea how to tweak the settings in their browser and would not know they even need to care. So I think it is fair to say that a choice is being taken away. It isn't like browsers are going to prompt people and explain what is occurring. The masses will experience centralized DNS without any idea this is happening. I think we will fundamentally disagree here. You could block your guest's VPN connections, but you don't do that.. why not? My guests can choose to use a VPN if they wish, I would not take that choice away. That is an intentional move to protect their traffic. DoH is not an intentional choice. They did not choose this. If a technical friend chooses a DoH server, their laptop won't work and I will explain, if I had not already, that DoH servers are blocked. Anyone that knows me, would expect this behavior. Anyone that is my friend would accept this. We probably just have very different circles of friends.
        shawnz 6y ago

by shawnz 6y ago

LinuxBender 6y ago

At a friends house, my laptop will join my private VPN mesh and my DNS lookups will still use my servers. This does assume they allow outbound connectivity to more than 80/443. I have found places that do not allow this. I could run tinc [1] on 443, but if UDP is blocked, the VPN will be slower. That said, in fairness, not everyone sets up their own VPN mesh. Some people use commercial VPN providers. So in that case, it would assume my friend does not block access to that VPN provider. [1] - http://tinc-vpn.org/ http://tinc-vpn.org/

shawnz 6y ago
So, don't you think it would be more hospitable to just allow privacy technologies to be used on your network without forcing your guests to buy a VPN?
- LinuxBender 6y ago
  Maybe so, but that is my choice. It is my home and my network. I can choose to protect my guests and they can choose to get a VPN. I would not subject them to my ISP's DNS, nor would I subject them to centralized DNS. Both are equally dangerous in my view. I would always disclose to my guests what they are using, how to use it and what choices they have. The people implementing DoH in the browser are taking that choice away, so now my only option is to play the never ending game of whack-a-mole with the centralized DoH servers.
  - shawnz 6y ago
    I do not think that it is fair to say that changing a default is equivalent to taking a choice away. They are only moving the choice from the network operator's hands directly into the user's hands, which is where I think it belongs (and where it really was in the first place). In the hands of the user whose device is actually establishing the connection. You could block your guest's VPN connections, but you don't do that.. why not? Aren't they subverting your protection by using VPNs? > nor would I subject them to centralized DNS. Both are equally dangerous in my view. I would argue that large providers like Cloudflare are the only ones who realistically have the resources to stand up to threats like government intervention (where it is possible). They have strong legal and financial incentives to maintain their privacy guarantees which smaller providers don't have. Also you have the advantage of your data "hiding in plain sight" due to the high volume they deal with. I certainly wish there were more providers available than just Cloudflare and Google though.
    - LinuxBender 6y ago
      I do not think that it is fair to say that changing a default is equivalent to taking a choice away For my technical friends, that would be true. They can adjust their settings and be on their way. I won't block their choices aside from intercepting requests to the ISP DNS. Most of my friends are not technical, have no idea how to tweak the settings in their browser and would not know they even need to care. So I think it is fair to say that a choice is being taken away. It isn't like browsers are going to prompt people and explain what is occurring. The masses will experience centralized DNS without any idea this is happening. I think we will fundamentally disagree here. You could block your guest's VPN connections, but you don't do that.. why not? My guests can choose to use a VPN if they wish, I would not take that choice away. That is an intentional move to protect their traffic. DoH is not an intentional choice. They did not choose this. If a technical friend chooses a DoH server, their laptop won't work and I will explain, if I had not already, that DoH servers are blocked. Anyone that knows me, would expect this behavior. Anyone that is my friend would accept this. We probably just have very different circles of friends.
      - shawnz 6y ago