3 ms·

Yes you are missing something. DoH on-by-default means that I as a sysadmin -- for my family, enterprise, or even just my own computer -- no longer have the ab

Yes you are missing something. DoH on-by-default means that I as a sysadmin -- for my family, enterprise, or even just my own computer -- no longer have the ability to easily specify how DNS works for the systems under my control. Maybe I run a PiHole; maybe I run a parental control DNS server; maybe I'm better at privacy protection than Mozilla and Cloudflare are. Tough luck; now I'm no longer able to configure all my systems to use my DNS server over DHCP. I can't even manually set the global DNS server for one computer any more. Now I have to manually set preferences on every instance of Firefox (at least to verify that DoH is truly off), and every other application that adopts DoH one at a time. The goal of DoH for preventing snooping by ISPs is fine. It's the implementation with hardwired per-application resolver hosts that's bad. Edit: There's a way to tell Firefox to disable DoH at the network level [0] but AFAIK this is just a Mozilla thing; it's not an RFC. Will other browsers and apps adopt this mechanism? Who knows? [0] https://support.mozilla.org/en-US/kb/configuring-networks-disable-dns-over-https https://support.mozilla.org/en-US/kb/configuring-networks-di...

SahAssar 6y ago
Tell me where I'm wrong or misunderstanding here: If you consider DNS analogous to HTTP, then DoH is TLS and the DNS provider is the CA (the org you need to trust). Your objection is that you can't modify protocol traffic since there is now an authority out of your control. It seems to me like it increases the security of the user since the network operator can no longer modify the traffic that the user requested. I get that it makes some use-cases harder, just like HTTPS made some HTTP use-cases harder (like captive portals for wifi login) but in the end it seems like a net benefit for the majority of usecases (I want the same site, securely, no matter the network I'm on), right?
- dreamcompiler 6y ago
  The DNS provider is not analogous to the CA. Remember that the CA only certifies that Cloudflare is in fact the Cloudflare, and not Joe's All-Night CDN and Lotto Ticket Dealer. The CA does not vouch for the ethics of Cloudflare, just like the CA does not vouch for the ethics of Google. So that's point 1. Point 2 is that if I for some reason don't trust Cloudflare to protect my users' privacy or provide speedy service or hey, maybe I just don't like the fact that they carry traffic from a bunch of seditionists -- whatever -- then I have no easy way to say to Firefox: Don't Use Cloudflare, use my provider who I do trust. I don't care what sites my users are visiting, so inspecting their DNS traffic is not something I need to do (although perhaps it is for certain enterprises). The central point is that I no longer get to easily choose which DNS provider to trust; Mozilla has made that choice for me. That breaks the internet in a way analogous to the way AMP breaks it, and that's wrong. I can in fact change that choice but doing so introduces a new protocol and a new set of labor-intensive tasks for the sysadmin that did not exist before, and for every app that adopts the Mozilla model, that labor increases yet more.

SahAssar 6y ago

Tell me where I'm wrong or misunderstanding here: If you consider DNS analogous to HTTP, then DoH is TLS and the DNS provider is the CA (the org you need to trust). Your objection is that you can't modify protocol traffic since there is now an authority out of your control. It seems to me like it increases the security of the user since the network operator can no longer modify the traffic that the user requested. I get that it makes some use-cases harder, just like HTTPS made some HTTP use-cases harder (like captive portals for wifi login) but in the end it seems like a net benefit for the majority of usecases (I want the same site, securely, no matter the network I'm on), right?

dreamcompiler 6y ago
The DNS provider is not analogous to the CA. Remember that the CA only certifies that Cloudflare is in fact the Cloudflare, and not Joe's All-Night CDN and Lotto Ticket Dealer. The CA does not vouch for the ethics of Cloudflare, just like the CA does not vouch for the ethics of Google. So that's point 1. Point 2 is that if I for some reason don't trust Cloudflare to protect my users' privacy or provide speedy service or hey, maybe I just don't like the fact that they carry traffic from a bunch of seditionists -- whatever -- then I have no easy way to say to Firefox: Don't Use Cloudflare, use my provider who I do trust. I don't care what sites my users are visiting, so inspecting their DNS traffic is not something I need to do (although perhaps it is for certain enterprises). The central point is that I no longer get to easily choose which DNS provider to trust; Mozilla has made that choice for me. That breaks the internet in a way analogous to the way AMP breaks it, and that's wrong. I can in fact change that choice but doing so introduces a new protocol and a new set of labor-intensive tasks for the sysadmin that did not exist before, and for every app that adopts the Mozilla model, that labor increases yet more.