4 ms·

Can someone enlighten me as to why this should be a trusted default? Because I inherently wouldn't trust it. I wouldn't say I trust NextDNS, but I currently use

Can someone enlighten me as to why this should be a trusted default? Because I inherently wouldn't trust it. I wouldn't say I trust NextDNS, but I currently use them for DoH.

0xTJ 5y ago
I'd argue that if you're using it, you trust it. Otherwise you wouldn't use it. This seems a lot better than just letting the internet provider give a regular DNS.
- tremon 5y ago
  This seems a lot better than just letting the internet provider give a regular DNS Why? You're already using your internet provider, so you trust them. Otherwise you wouldn't use them.
  - dewey 5y ago
    > Otherwise you wouldn't use them. A lot of times you don't really have a choice which ISP to use so that's not really a good argument.
  - coldpie 5y ago
    No, the point of DOH is that you don't have to trust your ISP. In many countries the ISPs are actively hostile[1]. You do have to trust the DOH provider, yes, but in this case Mozilla (or yourself if you have the tech knowledge) will be verifying trust on your behalf. You cannot do that at all with plain ol' DNS. DOH is a "best of a bad situation" kind of solution, it's a reaction to hostile ISPs. It's not something anyone really likes. [1] https://www.internetsociety.org/blog/2014/04/turkish-isps-hijacking-traffic-this-is-how-an-internet-breaks/ https://www.internetsociety.org/blog/2014/04/turkish-isps-hi...
    - jeltz 5y ago
      DoH means handing your data to one more party since your ISP can already see your SNI headers and the IP addresses. The only thing DoH does is stopping DNS spoofing at the cost of handing your data to a third party.
      - coldpie 5y ago
        > The only thing DoH does is stopping DNS spoofing at the cost of handing your data to a third party. It sounds like you think that's not worth it, but the evidence is that others disagree. Personally, I see both the pros & cons and have no strong feelings either way. I trust Mozilla's evaluation of the pros & cons more than I trust my own so I'm happy to do whatever they think is best, and I suspect most users feel the same way. If you disagree with their evaluation, you can toggle it off in Preferences, and they even show a banner on first start-up giving you that option.
  - JoshTriplett 5y ago
    I don't want to trust my Internet provider to do anything other than route encrypted packets. I don't want any other service than that from them, and I don't trust them any further than "exchange bandwidth for money".
  - recursive 5y ago
    DoH brings us closer to being able to use an internet provider you don't trust. And I already don't trust my ISP's DNS servers.
  - SilverRed 5y ago
    All ISPs in Australia run malicious DNS servers and it is required by law. So my options are to use DoH and solve the problem or not use the internet.
- xg15 5y ago
  > I'd argue that if you're using it, you trust it. Nope.
kevin_thibedeau 5y ago
Your ISP is selling all of your internet activity to data brokers. This gets added into the detail profile they have on your spending, preferences, political attitudes, and much more. DoH takes that away.
- elric 5y ago
  Maybe your ISP is, but mine is not. DoH does not take that away. It might move it away from the hands of your apparently adversarial ISP, but delivers the information in the hands of whoever is running those DoH servers...presumably Cloudflare, who already hold far too much sway for my comfort.
  - 542458 5y ago
    To qualify as a DoH resolver you have to agree to not log data for purposes other than providing the service, not keep logs for longer than 24h, and not sell any such data. This is audited. https://wiki.mozilla.org/Security/DOH-resolver-policy https://wiki.mozilla.org/Security/DOH-resolver-policy
    - autoexec 5y ago
      Where are you seeing anything about audits? The link just says that Mozilla can decide to remove people from the TRR program. They aren't sending people to Cloudflare and Comcast's server rooms. It's great that should a violation be disclosed to the public Mozilla might remove them, but unless there's a whistleblower the public will never know what's being done with their browsing history.

Can someone enlighten me as to why this should be a trusted default? Because I inherently wouldn't trust it. I wouldn't say I trust NextDNS, but I currently use them for DoH.

0xTJ 5y ago

I'd argue that if you're using it, you trust it. Otherwise you wouldn't use it. This seems a lot better than just letting the internet provider give a regular DNS.

tremon 5y ago
This seems a lot better than just letting the internet provider give a regular DNS Why? You're already using your internet provider, so you trust them. Otherwise you wouldn't use them.
- dewey 5y ago
  > Otherwise you wouldn't use them. A lot of times you don't really have a choice which ISP to use so that's not really a good argument.
- coldpie 5y ago
  No, the point of DOH is that you don't have to trust your ISP. In many countries the ISPs are actively hostile[1]. You do have to trust the DOH provider, yes, but in this case Mozilla (or yourself if you have the tech knowledge) will be verifying trust on your behalf. You cannot do that at all with plain ol' DNS. DOH is a "best of a bad situation" kind of solution, it's a reaction to hostile ISPs. It's not something anyone really likes. [1] https://www.internetsociety.org/blog/2014/04/turkish-isps-hijacking-traffic-this-is-how-an-internet-breaks/ https://www.internetsociety.org/blog/2014/04/turkish-isps-hi...
  - jeltz 5y ago
    DoH means handing your data to one more party since your ISP can already see your SNI headers and the IP addresses. The only thing DoH does is stopping DNS spoofing at the cost of handing your data to a third party.
    - coldpie 5y ago
      > The only thing DoH does is stopping DNS spoofing at the cost of handing your data to a third party. It sounds like you think that's not worth it, but the evidence is that others disagree. Personally, I see both the pros & cons and have no strong feelings either way. I trust Mozilla's evaluation of the pros & cons more than I trust my own so I'm happy to do whatever they think is best, and I suspect most users feel the same way. If you disagree with their evaluation, you can toggle it off in Preferences, and they even show a banner on first start-up giving you that option.
- JoshTriplett 5y ago
  I don't want to trust my Internet provider to do anything other than route encrypted packets. I don't want any other service than that from them, and I don't trust them any further than "exchange bandwidth for money".
- recursive 5y ago
  DoH brings us closer to being able to use an internet provider you don't trust. And I already don't trust my ISP's DNS servers.
- SilverRed 5y ago
  All ISPs in Australia run malicious DNS servers and it is required by law. So my options are to use DoH and solve the problem or not use the internet.
xg15 5y ago
> I'd argue that if you're using it, you trust it. Nope.

kevin_thibedeau 5y ago

Your ISP is selling all of your internet activity to data brokers. This gets added into the detail profile they have on your spending, preferences, political attitudes, and much more. DoH takes that away.

elric 5y ago
Maybe your ISP is, but mine is not. DoH does not take that away. It might move it away from the hands of your apparently adversarial ISP, but delivers the information in the hands of whoever is running those DoH servers...presumably Cloudflare, who already hold far too much sway for my comfort.
- 542458 5y ago
  To qualify as a DoH resolver you have to agree to not log data for purposes other than providing the service, not keep logs for longer than 24h, and not sell any such data. This is audited. https://wiki.mozilla.org/Security/DOH-resolver-policy https://wiki.mozilla.org/Security/DOH-resolver-policy
  - autoexec 5y ago
    Where are you seeing anything about audits? The link just says that Mozilla can decide to remove people from the TRR program. They aren't sending people to Cloudflare and Comcast's server rooms. It's great that should a violation be disclosed to the public Mozilla might remove them, but unless there's a whistleblower the public will never know what's being done with their browsing history.