5 ms·
You're right to be suspicious. The DNS-over-HTTPS model favors those who run the servers (because they get exclusive access to monetizable end user name resolut
by EvanAnderson 6y ago
You're right to be suspicious. The DNS-over-HTTPS model favors those who run the servers (because they get exclusive access to monetizable end user name resolution data) and those who control the resolvers.
You might control the resolver on your personal computer (for now). You probably don't control it on your phone. You most likely won't control it on your embedded devices.
- t0astbread 6y agoThe root evil here is that you can't change the root certificates in such devices. Even if you controlled its DNS, the device could still just be programmed to fail if it doesn't reach its analytics/ad/whatever server.
- GekkePrutser 6y agoThe Amazon Fire TV does this already :( If it doesn't see internet it just blocks itself and goes to a screen "Oops I have no internet". So you can forget about watching movies from your local server using the VLC app as well. Ridiculous.
- moonbug 6y agomakes it utterly useless in an IPv6+NAT64 environment, incidentally.
- tguvot 6y agoYou can go to settings > installed application and lunch VLC or anything else directly from there
- GekkePrutser 6y agoI'm pretty sure the last time my internet was down I couldn't get into anything but the wifi settings. But I'll try it next time, thanks for the tip!
- tguvot 6y agoYou can go back from network settings back to settings or something like this. just poke around. Discovered it when comcast went down for 4 days and wanted to run kodi on firetv
- hda2 6y agoAmazon also tends to hide options until you "try" connecting to your network. My device refused to work without internet until I "tried" connecting to my network using an incorrect password. When I did that and the device failed, an option to skip network setup appeared. In small font at the bottom of the screen, of course.
- mstade 6y agoThe IKEA Tradfri "smart" lighting gateway will stop responding to commands if it can't phone home to some IKEA server. I noticed this when I changed my router to use NextDNS, which blocked the IKEA lookups. I was ready to return the device as broken until I realized this. I've also had issues with Bang & Olufsen speakers in the past, and inclined to believe it's for the same reasons. I think it's insane that devices can effectively be bricked if they can't phone home. It's nothing short of waste, and I think environmental legislation should require device manufacturers to supply ways of disabling or overriding these mechanisms such that devices can continue to operate regardless of whether home servers are blocked or otherwise out of reach, e.g. company goes belly up, censorship etc.
- benttoothpaste 6y ago> I was ready to return the device as broken until I realized this. Actually you probably should return such devices as broken.
- mstade 6y agoI’m inclined to agree, frankly.
- m463 6y agoI did just that with a DJI Mavic. It was kind of hard to send back a really nice device that I had just opened up and was ready to fly. Thing is, some companies just use it as a way to fire their customers.
- CamperBob2 6y agoI tend to cut DJI a break, because customer (non-)compliance with no-fly zones is a class-1 existential threat to their business selling consumer drones. Pinging DJI servers to check for altitude restrictions at every power-up cycle is intrusive, but I honestly don't see that they have much choice. However, they are also playing these sorts of games with other types of devices, where no such justifications exist ( https://www.eevblog.com/forum/eevblab/eevblab-83-dji-pocket-2-camera-registration-bullshit/msg3351256/#msg3351256 https://www.eevblog.com/forum/eevblab/eevblab-83-dji-pocket-... ) That needs to be answered by returning the product as defective.
- throwaway201103 6y agoThen you return the device as defective and demand a refund. What you chose to pay for is up to you.
- pickledcods 6y agoI believe that Google pushed DoH to track your cross-site browsing. TLS hides your URL, and blockers can break adsense tracking and/or any other call-home backlinks. Using DoH, especially one served by an advert company is just signing up to be their open book.
- sp332 6y agoChrome didn't change the resolver, though. It just enables DoH if it's on a whitelist of known DoH-capable resolvers. It doesn't send your data to Google unless you already used Google's DNS.
- deleted 6y ago[deleted]
- sp332 6y agoI still prefer DoH giving "exclusive" access to resolvers, because the alternative is sending that data in plaintext for everyone along the path to read?
- folmar 6y agoIf your ISP is large enough it is only sent to ISP's name server which probably has everything you need cached, and if it isn't it might blend in with other queries. And your ISP can sniff SNI or guess target domains from target IPs already.
- judge2020 6y agoWhich is also being worked on via esni (now ECH for encrypted client hello) - https://crbug.com/boringssl/275 https://crbug.com/boringssl/275
- dralley 6y ago> The DNS-over-HTTPS model favors those who run the servers (because they get exclusive access to monetizable end user name resolution data) Hold up. You are claiming that the fact that DoH prevents DNS requests from being visible in cleartext network traffic is a bad thing? ...what? In a world where the choice is between one party (the DNS provider) having access to my DNS requests and everyone on the network including my DNS provider having access to my DNS requests, I'll choose "DNS provider having exclusive access" every single time.
- dec0dedab0de 6y agoHold up. You are claiming that the fact that DoH prevents DNS requests from being visible in cleartext network traffic is a bad thing? It is when its my network. If they cared about people sniffing they would use DNSSEC, but still use the network DNS server. DNS over HTTPS is just a way for shady companies to hide what they're doing.
- _-___________-_ 6y agoDNSSEC provides authenticity, not confidentiality.
- theamk 6y agoUh, DNSSEC is only signatures, it has no encryption.