14 ms·

So the fact that some ISPs are apparently untrustworthy is enough to blow up the whole thing which has worked pretty well for the past 30 years? There are plen

by elric 5y ago

So the fact that some ISPs are apparently untrustworthy is enough to blow up the whole thing which has worked pretty well for the past 30 years? There are plenty of valid use cases for captive portals. But yes, injecting ads and tracking are obviously messed up, but DNS is only a tiny part of that problem, and I don't see how using DoH will help with them. If you want to get rid those, then get rid of shitty ISPs. This is throwing out the baby with the bathwater. This will simply lead to ISPs and network operators blocking DoH. And instead of a wonderfully decentralized DNS, we'll end up with centralized DoH in the hands of Cloudflare and their ilk. Who have been shown repeatedly to be user hostile; especially towards privacy conscious users.

kadoban 5y ago
Can they block DoH, with reasonable tradeoffs? How? And will they care enough? I get the sense that they don't really gain that much from messing with DNS, relatively.
- Hizonner 5y ago
  They couldn't necessarily block all DoH, but they could destroy its prevalence by just blocking all of the default resolvers and all of the resolvers that the browsers suggest to users. Those are public lists. I suspect you're right that they don't get that much value from messing with DNS, though... not enough to deal with the user complaints they'd get. So they probably wouldn't bother unless pressured. However, they might decide to "play chicken" with Mozilla and other sources of DoH apps by seeing who yielded to the user complaints first. There'd be a big temptation for Mozilla to fall back to "regular" DNS if DoH failed, and then the ISP would effectively win.
  - kadoban 5y ago
    They'd have to block by domain name, right, and block all HTTPS traffic to those domains? I somehow suspect that browers can win that particular cat and mouse game just by making the domains too important to block (share the domain with something users care about). Maybe I'm missing something there though, it probably is more complicated than just that.
    - Hizonner 5y ago
      In the end, DoH has to either start with some kind of seed IP address, even if it's a cache-priming DNS A record, or use a (presumably attackable) non-DoH lookup to find its server. You can't start with a domain name for the server that you use to resolve all domain names. But I don't think that's very important, because domain names always resolve to IP addresses anyhow, and you can't change the IP addresses that fast. So you would have to share an IP address with something "too important to block". The political problem with that tends to be that the operators of things that might be too important to block tend to think that those things are too important to expose to any risk of being blocked, say by sharing them with something that somebody might want to block. It's also not always administratively or technically trivial to share the domain name or IP address(es) of some giant public Web service with another fundamentally unrelated service like DoH. I mean, sure, in the end, if enough large organizations tried hard enough, they could eventually come up with ways to make it pretty painful to block... but those large organizations tend to have overriding commercial concerns... and not to want to overtly taunt large governments...
      - lmm 5y ago
        > So you would have to share an IP address with something "too important to block". The political problem with that tends to be that the operators of things that might be too important to block tend to think that those things are too important to expose to any risk of being blocked, say by sharing them with something that somebody might want to block. I think that's part of the idea of having Cloudflare run it. I'm far from a fan of them in general, but the one thing in their favour for this case is that an ISP would have to be pretty ballsy to block all Cloudflare's IPs.
        kelnos 5y ago
        They don't have to block all of Cloudflare, though; they just have to block 1.1.1.1, right?
        lmm 5y ago
Animats 5y ago
So the fact that some ISPs are apparently untrustworthy is enough to blow up the whole thing which has worked pretty well for the past 30 years? Right. In place of that, we get one central point of DNS censorship. Where any unapproved site can be made to disappear. "CIRA Canadian Shield" "Truly free". Right. "Freedom is Slavery" is more like it. In the US, Mozilla is apparently putting users under the thumb of Cloudflare.[1] I'd rather have a mode where regular DNS and centrally controlled DNS are compared, and you get a popup if they differ. That warns you of censorship attempts. But that doesn't seem to be an option. [1] https://forum.netgate.com/topic/133679/heads-up-be-aware-of-trusted-recursive-resolver-trr-in-firefox/2 https://forum.netgate.com/topic/133679/heads-up-be-aware-of-...
- josephcsible 5y ago
  > In the US, Mozilla is apparently putting users under the thumb of Cloudflare. Even if you don't think Cloudflare is perfect, don't you trust them way more than, e.g., Comcast? > I'd rather have a mode where regular DNS and centrally controlled DNS are compared, and you get a popup if they differ. That warns you of censorship attempts. But that doesn't seem to be an option. This would only fix the censorship problem, not the surveillance problem.
  - ComputerGuru 5y ago
    > Even if you don't think Cloudflare is perfect, don't you trust them way more than, e.g., Comcast? Why would I trust a company I have no binding contract with, that doesn’t gain anything from my using their services, that doesn’t stand to lose anything if they lose me and others as a user of this particular service, etc over a company I entered into a legal agreement with, pay a monthly sum to provide a named service, and can sue in a court of law with some modicum of standing if things go sour?
    - hlieberman 5y ago
      You can't sue Comcast; you signed away your right to do so, individually and as a class, when you signed up for their service[1]. Most ISPs have class action waivers and binding arbitration, these days. In fact, you explicitly agreed to let them aggregate your data and sell it to others for their profit[2], assist third-parties in targeting you for advertisements[3], and combine data they have on file with you from other companies databases[4]. So, no, if I were in your shoes, I wouldn't trust Comcast at all. [1]: Comcast Agreement for Residential Service, Section 13 and 14. https://www.xfinity.com/Corporate/Customers/Policies/SubscriberAgreement https://www.xfinity.com/Corporate/Customers/Policies/Subscri... [2]: Xfinity Privacy Policy. https://www.xfinity.com/privacy/policy https://www.xfinity.com/privacy/policy "Create measurement and analytics reports for us and others" [3]: Ibid. "We use the information we collect to... deliver personalized marketing and advertising for our own and others’ products and services" [4]: Ibid. "We may combine information across our systems, platforms, and databases. This includes combining information we receive from third parties and information about your use of our Services."
syoc 5y ago
The "some ISPs" is really important here. This is very much a US thing, I don't know as much about the situation in Canada, might be as bad. I really hope that this is not the begging of a roll out to the rest of the world.
- hiharryhere 5y ago
  Yeah agree, ISP choice here in Australia (at least in the metro areas) is plentiful and in my experience all my ISPs have behaved pretty ethically. I'm on Aussie Broadband now and their service has been fantastic, they even let you run your own line tests and connection resets from their customer portal. I spent a number of years in the US at the mercy of Comcast and Later TWC in new york city and it was a very different experience. Also had a weird experience in Chicago where my building provided internet to all the Apartments with ads injected on 404 pages and the like. Really odd and no option to change.
  - SilverRed 5y ago
    All ISP dns servers in Australia are malicious. By law they must log all of your requests tied to your ID and they must block copyright infringement sites. The first one alone is reason to have DoH enabled by default for all users in Australia.
- aendruk 5y ago
  When I lived there a few years ago my ISP was frustratingly adversarial. https://news.ycombinator.com/item?id=6993831 https://news.ycombinator.com/item?id=6993831
- Semaphor 5y ago
  > This is very much a US thing DNS censorship is absolutely a thing in Germany and the UK for example. While here in Germany we might not get injected ads and other stuff, there are still more than enough problems to not make this a "US thing"
qmarchi 5y ago
> If you want to get rid those, then get rid of shitty ISPs. Good luck, when 30M+ only have DSL as an option, and >70% only have one Cable provider, and one DSL provider. FCC Data: https://broadbandmap.fcc.gov/#/area-comparison?version=jun2020&tech=cf&speed=25_3&searchtype=county https://broadbandmap.fcc.gov/#/area-comparison?version=jun20... More Info: https://www.theverge.com/22177154/us-internet-speed-maps-competition-availability-fcc https://www.theverge.com/22177154/us-internet-speed-maps-com...
danShumway 5y ago
> which has worked pretty well for the past 30 years? But DNS hasn't worked pretty well for the past 30 years. It's been abused for a pretty long time now, both for hijacking requests and for violating privacy. I don't think that DoH advocates looked at a perfectly good system and just decided to replace it. They looked at a system with significant flaws, saw that this system was holding back consumer privacy and security, and proposed an alternative. > but DNS is only a tiny part of that problem [...] If you want to get rid those, then get rid of shitty ISPs. This is throwing out the baby with the bathwater. DNS is a huge part of that problem, because without encrypted DNS most people can't realistically keep their DNS queries private. What we're seeing is that we can do all kinds of fancy stuff around encrypting connections, but the DNS is always going to be a hole, and it's always going to make the other protections much less useful. We want to eventually plug other holes that make websites identifiable. During that process, there are going to be periods where some of the holes are plugged, and some aren't. But that doesn't mean all of the efforts are useless, it means we're in the process of plugging security holes. The fact that we haven't widely deployed SNI encryption or TLS 1.3 does not mean that encrypted DNS is useless, it means that multiple technologies are required to work together to make progress towards meaningfully masking domain names. We still have very hard problems to solve, like IP addresses themselves and statistical analysis of response sizes to determine which pages are being visited. But it's not much use trying to mitigate those problems if we can't even secure DNS resolution. In regards to ISPs, in general (where possible) we like to avoid the model of "everyone is insecure but there are no bad actors." Imagine if we had rejected HTTPS because "this is only really a problem if your router is compromised or the ISPs are snooping." We have a solution now that helps reduce the amount of trust we need for ISPs. That's good, we should deploy it. Even if ISPs weren't a problem, it would be worth deploying. > This will simply lead to ISPs and network operators blocking DoH. And instead of a wonderfully decentralized DNS, we'll end up with centralized DoH in the hands of Cloudflare and their ilk. I don't see a lot of reason to believe this. First, there was nothing preventing ISPs from blocking DNS and forcing you to use their DNS resolvers in the past, so I don't see what DoH changes about that situation -- other than that it's a meaningful privacy increase, which might make bad actors more aggressive about blocking it. But surely we're not claiming that we should abandon meaningful privacy improvements because we're scared of what ISPs might do. Second, DoH is decentralized, you can still use other resolvers other than Cloudflare, and you can still chain resolvers together. For the moment, I happen to recommend Cloudflare because I think it's offering more believable privacy promises than other providers, but I understand the concerns about Cloudflare's centralization. It's valid to use something else. But seriously, what is centralized about DoH that isn't centralized about DNS? The fact that requests can't be hijacked? Did the Internet become centralized specifically because you can't MITM HTTPS requests now? I'm seeing people claim that DoH means every request will go to Cloudflare, and that's just flat out not true: anyone can set up a DoH resolver, even locally on their own network. Okay, granted, not everyone on your network might respect your DoH settings you put on your Piihole or router, but that's not really different from today. Google already doesn't respect network settings for its DNS resolution on Chromecasts (or at least didn't last I checked). My browser already allows me to override my network settings for DNS. DoH changes nothing about that other than that OSes and routers are lagging on implementing network-wide DoH settings. If you think that staying with DNS would mean that IOT devices will perpetually respect your network settings for domain resolution, then I have bad news for you, because they're definitely going to stop doing that in the future regardless of what technology exists, and some of them have already stopped doing that today.
josephcsible 5y ago
> This will simply lead to ISPs and network operators blocking DoH. With eSNI/ECH, browsers would just have to hardcode a bootstrap IP, and then ISPs won't be able to block DoH without also blocking all of every major CDN.
- silon42 5y ago
  yup, will have to block eSNI (disable all hosts on firewall unless looked up on local DNS, per application)
  - josephcsible 5y ago
    Maybe this will bring back a form of domain fronting. Let the user put in a list of hosts that your tyrannical dictatorship allows through its firewall, and then do a fake DNS lookup through your local DNS server for them, then use the resulting IP to access other hosts on the same CDN.
- gsich 5y ago
  Might still work. All DoH requests go to the same IP from the "major" proviers.
1vuio0pswjnm7 5y ago
"Who have shown repeatedly to be user hostile; especially towards privacy conscious users." What examples were you thinking of. They are still the only CDN offering TLS1.3 with ESNI. Problem is they do not necessarily encrypt backend connections. TLS version and SNI are relevant IMO because even with DoH, without TLS1.3 plus ESNI, the ISP can still see domain names in the clear on the wire in client hello packets sent and TLS certificates returned from remote IPs. All those AWS-hosted sites you visit all require SNI, the domain name sent in the clear over the wire for your ISP to track. For many, you can use the cloudfront CNAME as the SNI but it would be easy for an ISP to keep lookup table for all AWS CNAMES. HN's hosting provider will not even support TLS1.3, it's TLS1.2 at best. SNI is hostile toward privacy conscious users and makes censorship easier.
- Semaphor 5y ago
  But what’s the alternative to SNI for multiple domains on one IP? And don’t say IPv6, because my ISP doesn’t even offer that yet…
  - kelnos 5y ago
    ESNI with TLSv1.3. (The "E" means "encrypted".)
    - Semaphor 5y ago
      That does sound nice, but apparently it’s already been succeeded by TLS ECH, and neither of them are widely enabled by default, so essentially there is currently no SNI alternative.
  - 1vuio0pswjnm7 5y ago
    ESNI (now called ECH): https://defo.ie https://defo.ie I use ESNI-enabled openssl from github.com/sftcd, 30 Aug 2019 release, for all HTTP requests to Cloudflare-hosted sites and it works well. A noticeable downside is one has to keep fetching a new key in a DNS TXT RR every hour. Another use for DoH; the key can re retrieved via DoH (no SNI required).
deleted 5y ago
[deleted]
SilverRed 5y ago
At this point. The vast majority of ISP dns servers are hostile. Here in Australia, the ISP dns servers are hostile by law so 100% are hostile. If you are in the minority who have a great DNS server, go to the firefox settings and make a change. Defaults should suit the majority.
- kiwijamo 5y ago
  I note Firefox is turning this on country by country. Perhaps they could turn it on for certain countries (possibly including yours, Australia) but leave it off for others (like New Zealand where all ISPs don't interfere with DNS).
gsich 5y ago
I don't know why Cloudflare is inherently more trustworthy than your ISP.

by elric 5y ago

kadoban 5y ago

Can they block DoH, with reasonable tradeoffs? How? And will they care enough? I get the sense that they don't really gain that much from messing with DNS, relatively.

Hizonner 5y ago
They couldn't necessarily block all DoH, but they could destroy its prevalence by just blocking all of the default resolvers and all of the resolvers that the browsers suggest to users. Those are public lists. I suspect you're right that they don't get that much value from messing with DNS, though... not enough to deal with the user complaints they'd get. So they probably wouldn't bother unless pressured. However, they might decide to "play chicken" with Mozilla and other sources of DoH apps by seeing who yielded to the user complaints first. There'd be a big temptation for Mozilla to fall back to "regular" DNS if DoH failed, and then the ISP would effectively win.
- kadoban 5y ago
  They'd have to block by domain name, right, and block all HTTPS traffic to those domains? I somehow suspect that browers can win that particular cat and mouse game just by making the domains too important to block (share the domain with something users care about). Maybe I'm missing something there though, it probably is more complicated than just that.
  - Hizonner 5y ago
    In the end, DoH has to either start with some kind of seed IP address, even if it's a cache-priming DNS A record, or use a (presumably attackable) non-DoH lookup to find its server. You can't start with a domain name for the server that you use to resolve all domain names. But I don't think that's very important, because domain names always resolve to IP addresses anyhow, and you can't change the IP addresses that fast. So you would have to share an IP address with something "too important to block". The political problem with that tends to be that the operators of things that might be too important to block tend to think that those things are too important to expose to any risk of being blocked, say by sharing them with something that somebody might want to block. It's also not always administratively or technically trivial to share the domain name or IP address(es) of some giant public Web service with another fundamentally unrelated service like DoH. I mean, sure, in the end, if enough large organizations tried hard enough, they could eventually come up with ways to make it pretty painful to block... but those large organizations tend to have overriding commercial concerns... and not to want to overtly taunt large governments...
    - lmm 5y ago
      > So you would have to share an IP address with something "too important to block". The political problem with that tends to be that the operators of things that might be too important to block tend to think that those things are too important to expose to any risk of being blocked, say by sharing them with something that somebody might want to block. I think that's part of the idea of having Cloudflare run it. I'm far from a fan of them in general, but the one thing in their favour for this case is that an ISP would have to be pretty ballsy to block all Cloudflare's IPs.
      - kelnos 5y ago
        They don't have to block all of Cloudflare, though; they just have to block 1.1.1.1, right?
        lmm 5y ago

Animats 5y ago

So the fact that some ISPs are apparently untrustworthy is enough to blow up the whole thing which has worked pretty well for the past 30 years? Right. In place of that, we get one central point of DNS censorship. Where any unapproved site can be made to disappear. "CIRA Canadian Shield" "Truly free". Right. "Freedom is Slavery" is more like it. In the US, Mozilla is apparently putting users under the thumb of Cloudflare.[1] I'd rather have a mode where regular DNS and centrally controlled DNS are compared, and you get a popup if they differ. That warns you of censorship attempts. But that doesn't seem to be an option. [1] https://forum.netgate.com/topic/133679/heads-up-be-aware-of-trusted-recursive-resolver-trr-in-firefox/2 https://forum.netgate.com/topic/133679/heads-up-be-aware-of-...

josephcsible 5y ago
> In the US, Mozilla is apparently putting users under the thumb of Cloudflare. Even if you don't think Cloudflare is perfect, don't you trust them way more than, e.g., Comcast? > I'd rather have a mode where regular DNS and centrally controlled DNS are compared, and you get a popup if they differ. That warns you of censorship attempts. But that doesn't seem to be an option. This would only fix the censorship problem, not the surveillance problem.
- ComputerGuru 5y ago
  > Even if you don't think Cloudflare is perfect, don't you trust them way more than, e.g., Comcast? Why would I trust a company I have no binding contract with, that doesn’t gain anything from my using their services, that doesn’t stand to lose anything if they lose me and others as a user of this particular service, etc over a company I entered into a legal agreement with, pay a monthly sum to provide a named service, and can sue in a court of law with some modicum of standing if things go sour?
  - hlieberman 5y ago
    You can't sue Comcast; you signed away your right to do so, individually and as a class, when you signed up for their service[1]. Most ISPs have class action waivers and binding arbitration, these days. In fact, you explicitly agreed to let them aggregate your data and sell it to others for their profit[2], assist third-parties in targeting you for advertisements[3], and combine data they have on file with you from other companies databases[4]. So, no, if I were in your shoes, I wouldn't trust Comcast at all. [1]: Comcast Agreement for Residential Service, Section 13 and 14. https://www.xfinity.com/Corporate/Customers/Policies/SubscriberAgreement https://www.xfinity.com/Corporate/Customers/Policies/Subscri... [2]: Xfinity Privacy Policy. https://www.xfinity.com/privacy/policy https://www.xfinity.com/privacy/policy "Create measurement and analytics reports for us and others" [3]: Ibid. "We use the information we collect to... deliver personalized marketing and advertising for our own and others’ products and services" [4]: Ibid. "We may combine information across our systems, platforms, and databases. This includes combining information we receive from third parties and information about your use of our Services."

syoc 5y ago

The "some ISPs" is really important here. This is very much a US thing, I don't know as much about the situation in Canada, might be as bad. I really hope that this is not the begging of a roll out to the rest of the world.

hiharryhere 5y ago
Yeah agree, ISP choice here in Australia (at least in the metro areas) is plentiful and in my experience all my ISPs have behaved pretty ethically. I'm on Aussie Broadband now and their service has been fantastic, they even let you run your own line tests and connection resets from their customer portal. I spent a number of years in the US at the mercy of Comcast and Later TWC in new york city and it was a very different experience. Also had a weird experience in Chicago where my building provided internet to all the Apartments with ads injected on 404 pages and the like. Really odd and no option to change.
- SilverRed 5y ago
  All ISP dns servers in Australia are malicious. By law they must log all of your requests tied to your ID and they must block copyright infringement sites. The first one alone is reason to have DoH enabled by default for all users in Australia.
aendruk 5y ago
When I lived there a few years ago my ISP was frustratingly adversarial. https://news.ycombinator.com/item?id=6993831 https://news.ycombinator.com/item?id=6993831
Semaphor 5y ago
> This is very much a US thing DNS censorship is absolutely a thing in Germany and the UK for example. While here in Germany we might not get injected ads and other stuff, there are still more than enough problems to not make this a "US thing"

qmarchi 5y ago

> If you want to get rid those, then get rid of shitty ISPs. Good luck, when 30M+ only have DSL as an option, and >70% only have one Cable provider, and one DSL provider. FCC Data: https://broadbandmap.fcc.gov/#/area-comparison?version=jun2020&tech=cf&speed=25_3&searchtype=county https://broadbandmap.fcc.gov/#/area-comparison?version=jun20... More Info: https://www.theverge.com/22177154/us-internet-speed-maps-competition-availability-fcc https://www.theverge.com/22177154/us-internet-speed-maps-com...

danShumway 5y ago

> which has worked pretty well for the past 30 years? But DNS hasn't worked pretty well for the past 30 years. It's been abused for a pretty long time now, both for hijacking requests and for violating privacy. I don't think that DoH advocates looked at a perfectly good system and just decided to replace it. They looked at a system with significant flaws, saw that this system was holding back consumer privacy and security, and proposed an alternative. > but DNS is only a tiny part of that problem [...] If you want to get rid those, then get rid of shitty ISPs. This is throwing out the baby with the bathwater. DNS is a huge part of that problem, because without encrypted DNS most people can't realistically keep their DNS queries private. What we're seeing is that we can do all kinds of fancy stuff around encrypting connections, but the DNS is always going to be a hole, and it's always going to make the other protections much less useful. We want to eventually plug other holes that make websites identifiable. During that process, there are going to be periods where some of the holes are plugged, and some aren't. But that doesn't mean all of the efforts are useless, it means we're in the process of plugging security holes. The fact that we haven't widely deployed SNI encryption or TLS 1.3 does not mean that encrypted DNS is useless, it means that multiple technologies are required to work together to make progress towards meaningfully masking domain names. We still have very hard problems to solve, like IP addresses themselves and statistical analysis of response sizes to determine which pages are being visited. But it's not much use trying to mitigate those problems if we can't even secure DNS resolution. In regards to ISPs, in general (where possible) we like to avoid the model of "everyone is insecure but there are no bad actors." Imagine if we had rejected HTTPS because "this is only really a problem if your router is compromised or the ISPs are snooping." We have a solution now that helps reduce the amount of trust we need for ISPs. That's good, we should deploy it. Even if ISPs weren't a problem, it would be worth deploying. > This will simply lead to ISPs and network operators blocking DoH. And instead of a wonderfully decentralized DNS, we'll end up with centralized DoH in the hands of Cloudflare and their ilk. I don't see a lot of reason to believe this. First, there was nothing preventing ISPs from blocking DNS and forcing you to use their DNS resolvers in the past, so I don't see what DoH changes about that situation -- other than that it's a meaningful privacy increase, which might make bad actors more aggressive about blocking it. But surely we're not claiming that we should abandon meaningful privacy improvements because we're scared of what ISPs might do. Second, DoH is decentralized, you can still use other resolvers other than Cloudflare, and you can still chain resolvers together. For the moment, I happen to recommend Cloudflare because I think it's offering more believable privacy promises than other providers, but I understand the concerns about Cloudflare's centralization. It's valid to use something else. But seriously, what is centralized about DoH that isn't centralized about DNS? The fact that requests can't be hijacked? Did the Internet become centralized specifically because you can't MITM HTTPS requests now? I'm seeing people claim that DoH means every request will go to Cloudflare, and that's just flat out not true: anyone can set up a DoH resolver, even locally on their own network. Okay, granted, not everyone on your network might respect your DoH settings you put on your Piihole or router, but that's not really different from today. Google already doesn't respect network settings for its DNS resolution on Chromecasts (or at least didn't last I checked). My browser already allows me to override my network settings for DNS. DoH changes nothing about that other than that OSes and routers are lagging on implementing network-wide DoH settings. If you think that staying with DNS would mean that IOT devices will perpetually respect your network settings for domain resolution, then I have bad news for you, because they're definitely going to stop doing that in the future regardless of what technology exists, and some of them have already stopped doing that today.

josephcsible 5y ago

> This will simply lead to ISPs and network operators blocking DoH. With eSNI/ECH, browsers would just have to hardcode a bootstrap IP, and then ISPs won't be able to block DoH without also blocking all of every major CDN.

silon42 5y ago
yup, will have to block eSNI (disable all hosts on firewall unless looked up on local DNS, per application)
- josephcsible 5y ago
  Maybe this will bring back a form of domain fronting. Let the user put in a list of hosts that your tyrannical dictatorship allows through its firewall, and then do a fake DNS lookup through your local DNS server for them, then use the resulting IP to access other hosts on the same CDN.
gsich 5y ago
Might still work. All DoH requests go to the same IP from the "major" proviers.

1vuio0pswjnm7 5y ago

"Who have shown repeatedly to be user hostile; especially towards privacy conscious users." What examples were you thinking of. They are still the only CDN offering TLS1.3 with ESNI. Problem is they do not necessarily encrypt backend connections. TLS version and SNI are relevant IMO because even with DoH, without TLS1.3 plus ESNI, the ISP can still see domain names in the clear on the wire in client hello packets sent and TLS certificates returned from remote IPs. All those AWS-hosted sites you visit all require SNI, the domain name sent in the clear over the wire for your ISP to track. For many, you can use the cloudfront CNAME as the SNI but it would be easy for an ISP to keep lookup table for all AWS CNAMES. HN's hosting provider will not even support TLS1.3, it's TLS1.2 at best. SNI is hostile toward privacy conscious users and makes censorship easier.

Semaphor 5y ago
But what’s the alternative to SNI for multiple domains on one IP? And don’t say IPv6, because my ISP doesn’t even offer that yet…
- kelnos 5y ago
  ESNI with TLSv1.3. (The "E" means "encrypted".)
  - Semaphor 5y ago
    That does sound nice, but apparently it’s already been succeeded by TLS ECH, and neither of them are widely enabled by default, so essentially there is currently no SNI alternative.
- 1vuio0pswjnm7 5y ago
  ESNI (now called ECH): https://defo.ie https://defo.ie I use ESNI-enabled openssl from github.com/sftcd, 30 Aug 2019 release, for all HTTP requests to Cloudflare-hosted sites and it works well. A noticeable downside is one has to keep fetching a new key in a DNS TXT RR every hour. Another use for DoH; the key can re retrieved via DoH (no SNI required).

deleted 5y ago

[deleted]

SilverRed 5y ago

At this point. The vast majority of ISP dns servers are hostile. Here in Australia, the ISP dns servers are hostile by law so 100% are hostile. If you are in the minority who have a great DNS server, go to the firefox settings and make a change. Defaults should suit the majority.

kiwijamo 5y ago
I note Firefox is turning this on country by country. Perhaps they could turn it on for certain countries (possibly including yours, Australia) but leave it off for others (like New Zealand where all ISPs don't interfere with DNS).

gsich 5y ago

I don't know why Cloudflare is inherently more trustworthy than your ISP.