3 ms·
1. DoH is a user configurable setting, it cannot be dictated by ad vendors or websites. 2. DoH fails back to standard DNS. 3. DoH is hard to filter, just like
by burnte 6y ago
1. DoH is a user configurable setting, it cannot be dictated by ad vendors or websites.
2. DoH fails back to standard DNS.
3. DoH is hard to filter, just like other TLS encrypted traffic.
4. DoH is a user FRIENDLY technology meant to increase user privacy and reduce DNS hijacking.
5. Don't like it? Turn it off. Only you have that power to enable or disable it.
- dredmorbius 6y agoDoH can be enforced by user-hostile devices and applications. Including Internet-of-shit infested appliances and devices. With 5G SIMS embedded and financed at rock-bottom mass-contract data-dribble rates via advertising, other revenue flow, or up-front / ongoing purchase revenue streams, WiFi LAN egress controls --- PiHole or other DNS blocklists, or IP and protocol firewalls --- simply won't be effective.
- ohazi 6y agoYou're confusing DoH in "friendly" browsers like Firefox, where you and I might deliberately turn it on to thwart ISP shenanigans. In that case, it's good that DoH is hard to filter and looks like all other TLS traffic. But the parent is correctly describing DoH as a double-edged sword. The same properties that make it good for you and me when trying to safely access domain data make it a weapon for rogue IoT devices who want to do the same. Your smart fridge could easily include software that allows it to acquire its own secure DNS info from a DoH network run by the smart fridge manufacturer. This would allow them to find the domains behind the chumbox ads that they want to show you in spite of your PiHole. Since the manufacturer would be doing this to get around a user's desired network configuration, it'll be configurable for them, not for you. You will not be the "owner" of this device.
- jjeaff 6y agoI don't see what any of that has to do with DoH. A device could just as easily use its own private dns service and bypass network filtering as well.
- SethKinast 6y agoOn a properly-configured network, all DNS requests are intercepted and routed to the desired DNS server. I do this to make Google devices respect my DNS preferences (send DNS through PiHole) instead of using their hardcoded setting.
- ocdtrekkie 6y agoUnencrypted DNS can be redirected or inspected and selectively blocked. DoH cannot, and whereas you can selectively tamper with DNS requests to remove advertisers, devices may fail to work at all if you block their DoH provider.