6 ms·
This is configurable though (it's only a default), and is still better than the status quo in a lot of areas. Either you care enough to change it, or you stick
by hiq 5y ago
This is configurable though (it's only a default), and is still better than the status quo in a lot of areas. Either you care enough to change it, or you stick to the default. Default (ISP) plain DNS is worse.
- mort96 5y agoIt's not though? You still have to trust your ISP, but now you need to trust some random company Mozilla has picked _in addition_ to your ISP.
- kemotep 5y agoThe random company in this case is Cloudflare and NextDNS. And using DoH you cut out your ISP from the equation (at least for your browser traffic). You can also setup a custom DoH provider (that can also be configured on the system level, not just the browser) so neither Cloudflare or your ISP gets your DNS queries.
- mort96 5y agoCloudflare and NextDNS absolutely counts as "some random company" in this context. I have no reason to trust random American companies more than my local ISP. I don't trust the USA more than I trust my own country.
- hvis 5y ago> I have no reason to trust random American companies more than my local ISP. I don't trust the USA more than I trust my own country. You know you are quite fortunate to be able to say so. Firefox is a project with global impact. A lot of people around the world can benefit from DoH.
- adalu 5y agoEven people in Germany who want to read the other side of the war story, like I did yesterday to read RT(.com) vs the Tagesschau propaganda. Since my ISP, O2, has removed rt.com entries and other russian propaganda outlets (I acknowledge the "west" also has propaganda outlets like Reuters etc) I was looking for ways to still read rt.com news. I looked into Firefox' preferences and searched for "DNS" and saw DNS over HTTP and I could pick Cloudflare, NextDNS (never heard of) or custom. I picked Cloudflare and read rt.com thus getting the other side of the whole bs propaganda mess. The German Grundgesetz (constitution) says "eine Zensur findet nicht statt" (censorship does not occur/there will be no censorship) yet, there is censorship. I was sceptical about DOH in general (why do we need this?) but now I see why this can be a good thing and great as well that Firefox supports it so easily.
- dnzm 5y agoHow is this different from just using different DNS settings on your OS?
- dahfizz 5y agoBecause your ISP can block a "raw" DNS request, regardless of what server you configure. Your ISP can even inspect your DNS request, and choose to give a fake response or block the request based on the domain you are requesting.
- drexlspivey 5y agoYour ISP can also block the IP via reverse DNS if they want too.. If you don’t trust your ISP only a vpn will save you
- malnourish 5y agoReferring to Reuters as a propaganda outlet seems like a bold statement; what evidence led you to make that claim?
- adalu 5y ago
- pbhjpbhj 5y agoBecause USA wouldn't issue a national security letter to get dirt on foreigners? Seems like if Mozilla wanted to choose DoH as way to protect people from being spied on they wouldn't choose USA-based companies? Like "don't get caught by your own gov accessing restricted material get caught by USA gov-related organisations so they can sell you out to your own gov & benefit USA". If you're bothered about who's watching your web traffic then it seems highly unlikely you want to add USA to the list of who is watching you??
- hvis 5y agoThere aren't many companies with that capability and scale outside of US. And the States are watching you anyway: most of the Internet resides there. Even the websites that don't are likely using Cloudflare or etc to save on traffic.
- earth_walker 5y agoCloudflare is only the default for users in the USA. I'm in Canada and the default provider is CIRA. I can also choose to switch to Cloudflare, NextDNS, or add my own. You can check out the Network Settings at the bottom of the General tab to see what your default is.
- tallanvor 5y agoAnd who on earth is NextDNS? Looking at their website, there's no mailing address, phone number, or other identifying information other than the names of the founders and their Twitter links. If that doesn't qualify as some random company, I'm not sure what does! And I simply don't trust Cloudflare.
- kemotep 5y agoAnd that’s fair, again this is all completely customizable and in fact you are better served configuring a system/network-wide DNS host that you run yourself or trust.
- mort96 5y agoMost people are going to use the defaults. Giving all DNS requests for 99.9% of Firefox users to two random American companies is irresponsible.
- kemotep 5y agoIf it is irresponsible to utilize the services provided by companies under the jurisdiction of the United States, then using much of the internet and Firefox itself is irresponsible.
- pbhjpbhj 5y agoSo? That's not an argument for doing it again. 'Everyone else is taking a bung from the NSA to forward them data', for example, isn't a moral justification to do it yourself (made up example).
- bookaway 5y agoThe user made a conscious choice to trust one specific American company. They do not want other companies they did not personally "vet"-- with whatever weird and personal criteria they feel like -- added without their approval. This shouldn't be this hard to understand.
- teknopaul 5y agoYou don't _need_ to, running your own dns resolver is pretty easy... apt install dnsmasq is my preference. Even a ten dollar router will let you pick who you trust for DNS.
- 542458 5y agoEven in that scenario you’re still vulnerable to DNS sniffing and injection. These aren’t theoretical concerns, they’re real-world actively explored vulnerabilities. And if you still don’t care, well, that’s why you can turn DoH off.
- hulitu 5y agoThis is valid also on Cloudfare. I really do not see why i shall have more trust on Cloudfare than on my ISP ? They both operate in the "free" market.
- tazmondo 5y agoIn some countries ISPs work closely with the government and block certain websites the government asks them to etc. In these cases I would trust cloudflare over my ISP
- 1over137 5y agoIn some countries (USA) tech companies (Cloudflare) work closely with the government (see Snowdon revelations). I trust my ISP, which I chose, more than a foreign company (Cloudflare).
- sbarre 5y ago^ This is what I don't get.. Everyday people who are worried about state-actor threats - an incredibly targeted and unlikely scenario for the average person - but are less concerned about their personal information being harvested for marketing purposes - something that happens all the time to everyone.
- eli 5y agoMy ISP specifically reserves the right to sell browsing data, Cloudflare and NextDNS have privacy policies forbidding them from doing so.
- jeltz 5y agoYour ISP will still get your browsing data via SNI so the only change is that now both your ISP and Clouldflare will get it.
- josephcsible 5y agoNo, Cloudflare thought of that and is fixing it with their deployment of TLS ECH.
- autoexec 5y agoYour ISP will see every IP you're communicating with. They don't need your DNS at all. Trying to hide your traffic from your ISP without a VPN is unlikely to work.
- josephcsible 5y agoBut when the IP is all they see, and it belongs to a big CDN, that doesn't really reveal anything.