3 ms·

They couldn't necessarily block all DoH, but they could destroy its prevalence by just blocking all of the default resolvers and all of the resolvers that the b

They couldn't necessarily block all DoH, but they could destroy its prevalence by just blocking all of the default resolvers and all of the resolvers that the browsers suggest to users. Those are public lists. I suspect you're right that they don't get that much value from messing with DNS, though... not enough to deal with the user complaints they'd get. So they probably wouldn't bother unless pressured. However, they might decide to "play chicken" with Mozilla and other sources of DoH apps by seeing who yielded to the user complaints first. There'd be a big temptation for Mozilla to fall back to "regular" DNS if DoH failed, and then the ISP would effectively win.

kadoban 5y ago
They'd have to block by domain name, right, and block all HTTPS traffic to those domains? I somehow suspect that browers can win that particular cat and mouse game just by making the domains too important to block (share the domain with something users care about). Maybe I'm missing something there though, it probably is more complicated than just that.
- Hizonner 5y ago
  In the end, DoH has to either start with some kind of seed IP address, even if it's a cache-priming DNS A record, or use a (presumably attackable) non-DoH lookup to find its server. You can't start with a domain name for the server that you use to resolve all domain names. But I don't think that's very important, because domain names always resolve to IP addresses anyhow, and you can't change the IP addresses that fast. So you would have to share an IP address with something "too important to block". The political problem with that tends to be that the operators of things that might be too important to block tend to think that those things are too important to expose to any risk of being blocked, say by sharing them with something that somebody might want to block. It's also not always administratively or technically trivial to share the domain name or IP address(es) of some giant public Web service with another fundamentally unrelated service like DoH. I mean, sure, in the end, if enough large organizations tried hard enough, they could eventually come up with ways to make it pretty painful to block... but those large organizations tend to have overriding commercial concerns... and not to want to overtly taunt large governments...
  - lmm 5y ago
    > So you would have to share an IP address with something "too important to block". The political problem with that tends to be that the operators of things that might be too important to block tend to think that those things are too important to expose to any risk of being blocked, say by sharing them with something that somebody might want to block. I think that's part of the idea of having Cloudflare run it. I'm far from a fan of them in general, but the one thing in their favour for this case is that an ISP would have to be pretty ballsy to block all Cloudflare's IPs.
    - kelnos 5y ago
      They don't have to block all of Cloudflare, though; they just have to block 1.1.1.1, right?
      - lmm 5y ago
        Cloudflare could set it up so every IP in their address range was serving DoH and Mozilla could probably set up their clients to use random ones with retry or something like that.

kadoban 5y ago

They'd have to block by domain name, right, and block all HTTPS traffic to those domains? I somehow suspect that browers can win that particular cat and mouse game just by making the domains too important to block (share the domain with something users care about). Maybe I'm missing something there though, it probably is more complicated than just that.

Hizonner 5y ago
In the end, DoH has to either start with some kind of seed IP address, even if it's a cache-priming DNS A record, or use a (presumably attackable) non-DoH lookup to find its server. You can't start with a domain name for the server that you use to resolve all domain names. But I don't think that's very important, because domain names always resolve to IP addresses anyhow, and you can't change the IP addresses that fast. So you would have to share an IP address with something "too important to block". The political problem with that tends to be that the operators of things that might be too important to block tend to think that those things are too important to expose to any risk of being blocked, say by sharing them with something that somebody might want to block. It's also not always administratively or technically trivial to share the domain name or IP address(es) of some giant public Web service with another fundamentally unrelated service like DoH. I mean, sure, in the end, if enough large organizations tried hard enough, they could eventually come up with ways to make it pretty painful to block... but those large organizations tend to have overriding commercial concerns... and not to want to overtly taunt large governments...
- lmm 5y ago
  > So you would have to share an IP address with something "too important to block". The political problem with that tends to be that the operators of things that might be too important to block tend to think that those things are too important to expose to any risk of being blocked, say by sharing them with something that somebody might want to block. I think that's part of the idea of having Cloudflare run it. I'm far from a fan of them in general, but the one thing in their favour for this case is that an ISP would have to be pretty ballsy to block all Cloudflare's IPs.
  - kelnos 5y ago
    They don't have to block all of Cloudflare, though; they just have to block 1.1.1.1, right?
    - lmm 5y ago
      Cloudflare could set it up so every IP in their address range was serving DoH and Mozilla could probably set up their clients to use random ones with retry or something like that.