7 ms·

You don't _need_ to, running your own dns resolver is pretty easy... apt install dnsmasq is my preference. Even a ten dollar router will let you pick who you

You don't _need_ to, running your own dns resolver is pretty easy... apt install dnsmasq is my preference. Even a ten dollar router will let you pick who you trust for DNS.

542458 5y ago
Even in that scenario you’re still vulnerable to DNS sniffing and injection. These aren’t theoretical concerns, they’re real-world actively explored vulnerabilities. And if you still don’t care, well, that’s why you can turn DoH off.
- hulitu 5y ago
  This is valid also on Cloudfare. I really do not see why i shall have more trust on Cloudfare than on my ISP ? They both operate in the "free" market.
  - tazmondo 5y ago
    In some countries ISPs work closely with the government and block certain websites the government asks them to etc. In these cases I would trust cloudflare over my ISP
    - 1over137 5y ago
      In some countries (USA) tech companies (Cloudflare) work closely with the government (see Snowdon revelations). I trust my ISP, which I chose, more than a foreign company (Cloudflare).
      - sbarre 5y ago
        ^ This is what I don't get.. Everyday people who are worried about state-actor threats - an incredibly targeted and unlikely scenario for the average person - but are less concerned about their personal information being harvested for marketing purposes - something that happens all the time to everyone.
        ohmaigad 5y ago
        And i don't get how one would think that I, as a European, would want an overseas company to handle my data. If my ISP is breaching GDPR, all i have to do is to go to data protection agency (at least i have that option on the table), good luck doing that with an overseas company... I have zero indications that my ISP is selling data for marketing purposes (unlike some US ISPs which even inject ads).
        avar 5y ago
        Because if the situation is reversed and e.g. the local police subpoenas your ISP to find people that are "illegally torrenting" or whatever they won't include you. That's happened a lot within Europe. Even if the foreign government spies more nether jurisdiction is likely to care enough about you specifically to make an international case of it. In other words I'd think most Americans would be better off proxying through Europe, and most Europeans would be better off proxying through the US. Even better would be to proxy through a third country that your own country is unlikely to cooperate with, and which won't care about you personally. E.g. I wouldn't want to live in Iran or North Korea, but I'd think proxying DNS through them would in some way maximize my privacy if I was living in Europe or the US. I'll never travel to either of them, and my authorities are vanishingly unlikely to cooperate with either of them for anything short of murder.
        ohmaigad 5y ago
        Except proxying through Iran or North Korea literally puts a target on you locally. Not really the brightest idea. As for other things - it is not black or white, depends where you are and from that you choose the best option for you. The "copyright" cartels are mostly American so it kinda does not even make sense to use US in order to avoid that, just makes it easier for them.
        autoexec 5y ago
        > Everyday people who are worried about state-actor threats - an incredibly targeted and unlikely scenario for the average person - I agree with you that people should be more worried about companies collecting their personal info, but we know now that the state collecting your data isn't incredibly targeted or at all unlikely. They just take everything. It's happening to every last one of us every single day. It's been going on for decades. https://en.wikipedia.org/wiki/Room_641A https://en.wikipedia.org/wiki/Room_641A https://en.wikipedia.org/wiki/Russ_Tice https://en.wikipedia.org/wiki/Russ_Tice
  - 542458 5y ago
    Cloudflare has a legally binding contract with Mozilla to this effect. So you’ve traded up from a number of companies that have never promised to not sniff or tamper with your traffic (and often do, and don’t really have any positive brand image to protect) up to a single company that has a legal commitment not to tamper with your traffic (and has some form of brand image to protect). I too, would prefer if DoH had more technical features to prevent sniffing/tampering, but this is an upgrade.
    - michaelt 5y ago
      See, IMHO a "binding contract" isn't worth the paper it's written on if violations of the contract are undetectable. There's no brand image impact if there's no evidence. And if I was an intelligence agency trying place spies, Cloudflare would be among the first tech companies I'd target. This feature seems almost exclusively a feature for people in the ISP-monopoly-friendly United States.
      - wintermutestwin 5y ago
        >And if I was an intelligence agency trying place spies, Cloudflare would be among the first tech companies I'd target. This seems like a threat model swap in the conversation. The subject threat model here is (1) defending against companies stealing and selling my data. You swapped in the threat of (2) state level agencies spying on you through these companies. The problem is that #2 seems to be an intractable problem. (but not so much because of an infiltrated DNS provider, more like cable taps and infiltrated hardware manufacturers) #1 seems to be a more solvable problem (albeit at increasing levels of complexity). When you bring #2 into the conversation, it defocuses on the solution to #1 and gets to a point where we all throw up our hands and admit helplessness and defeat. I see this happen often and I think every conversation should be clearly grounded in the threat model that is being addressed.
yrro 5y ago
ISP-provided CPEs often (usually these days? I wonder if anyone has studied this) allow you to change the recursive DNS servers that they forward queries to. Nor do they let you customize the DNS servers handed out by their DHCP servers. A while back, Sky Broadband was even intercepting all customer traffic to UDP or TCP port 53, and forcing it to go to their shitty DNS servers, which panic and drop the connection when they see something 'unusual'.
- jrockway 5y ago
  > A while back, Sky Broadband was even intercepting all customer traffic to UDP or TCP port 53, and forcing it to go to their shitty DNS servers, which panic and drop the connection when they see something 'unusual'. This is exactly why DNS over HTTPS is a thing. Unencrypted services are regularly abused by ISPs and DNS is no exception.
josephcsible 5y ago
Running your own DNS resolver doesn't give you any of the benefits that using DoH does. The recursive queries that it sends out are just as vulnerable to an adversary on the network blocking or spying on as the ones sent to a regular insecure DNS server.

You don't _need_ to, running your own dns resolver is pretty easy... apt install dnsmasq is my preference. Even a ten dollar router will let you pick who you trust for DNS.

542458 5y ago

Even in that scenario you’re still vulnerable to DNS sniffing and injection. These aren’t theoretical concerns, they’re real-world actively explored vulnerabilities. And if you still don’t care, well, that’s why you can turn DoH off.

hulitu 5y ago
This is valid also on Cloudfare. I really do not see why i shall have more trust on Cloudfare than on my ISP ? They both operate in the "free" market.
- tazmondo 5y ago
  In some countries ISPs work closely with the government and block certain websites the government asks them to etc. In these cases I would trust cloudflare over my ISP
  - 1over137 5y ago
    In some countries (USA) tech companies (Cloudflare) work closely with the government (see Snowdon revelations). I trust my ISP, which I chose, more than a foreign company (Cloudflare).
    - sbarre 5y ago
      ^ This is what I don't get.. Everyday people who are worried about state-actor threats - an incredibly targeted and unlikely scenario for the average person - but are less concerned about their personal information being harvested for marketing purposes - something that happens all the time to everyone.
      - ohmaigad 5y ago
        And i don't get how one would think that I, as a European, would want an overseas company to handle my data. If my ISP is breaching GDPR, all i have to do is to go to data protection agency (at least i have that option on the table), good luck doing that with an overseas company... I have zero indications that my ISP is selling data for marketing purposes (unlike some US ISPs which even inject ads).
        avar 5y ago
        Because if the situation is reversed and e.g. the local police subpoenas your ISP to find people that are "illegally torrenting" or whatever they won't include you. That's happened a lot within Europe. Even if the foreign government spies more nether jurisdiction is likely to care enough about you specifically to make an international case of it. In other words I'd think most Americans would be better off proxying through Europe, and most Europeans would be better off proxying through the US. Even better would be to proxy through a third country that your own country is unlikely to cooperate with, and which won't care about you personally. E.g. I wouldn't want to live in Iran or North Korea, but I'd think proxying DNS through them would in some way maximize my privacy if I was living in Europe or the US. I'll never travel to either of them, and my authorities are vanishingly unlikely to cooperate with either of them for anything short of murder.
        ohmaigad 5y ago
        Except proxying through Iran or North Korea literally puts a target on you locally. Not really the brightest idea. As for other things - it is not black or white, depends where you are and from that you choose the best option for you. The "copyright" cartels are mostly American so it kinda does not even make sense to use US in order to avoid that, just makes it easier for them.
      - autoexec 5y ago
        > Everyday people who are worried about state-actor threats - an incredibly targeted and unlikely scenario for the average person - I agree with you that people should be more worried about companies collecting their personal info, but we know now that the state collecting your data isn't incredibly targeted or at all unlikely. They just take everything. It's happening to every last one of us every single day. It's been going on for decades. https://en.wikipedia.org/wiki/Room_641A https://en.wikipedia.org/wiki/Room_641A https://en.wikipedia.org/wiki/Russ_Tice https://en.wikipedia.org/wiki/Russ_Tice
- 542458 5y ago
  Cloudflare has a legally binding contract with Mozilla to this effect. So you’ve traded up from a number of companies that have never promised to not sniff or tamper with your traffic (and often do, and don’t really have any positive brand image to protect) up to a single company that has a legal commitment not to tamper with your traffic (and has some form of brand image to protect). I too, would prefer if DoH had more technical features to prevent sniffing/tampering, but this is an upgrade.
  - michaelt 5y ago
    See, IMHO a "binding contract" isn't worth the paper it's written on if violations of the contract are undetectable. There's no brand image impact if there's no evidence. And if I was an intelligence agency trying place spies, Cloudflare would be among the first tech companies I'd target. This feature seems almost exclusively a feature for people in the ISP-monopoly-friendly United States.
    - wintermutestwin 5y ago
      >And if I was an intelligence agency trying place spies, Cloudflare would be among the first tech companies I'd target. This seems like a threat model swap in the conversation. The subject threat model here is (1) defending against companies stealing and selling my data. You swapped in the threat of (2) state level agencies spying on you through these companies. The problem is that #2 seems to be an intractable problem. (but not so much because of an infiltrated DNS provider, more like cable taps and infiltrated hardware manufacturers) #1 seems to be a more solvable problem (albeit at increasing levels of complexity). When you bring #2 into the conversation, it defocuses on the solution to #1 and gets to a point where we all throw up our hands and admit helplessness and defeat. I see this happen often and I think every conversation should be clearly grounded in the threat model that is being addressed.

yrro 5y ago

ISP-provided CPEs often (usually these days? I wonder if anyone has studied this) allow you to change the recursive DNS servers that they forward queries to. Nor do they let you customize the DNS servers handed out by their DHCP servers. A while back, Sky Broadband was even intercepting all customer traffic to UDP or TCP port 53, and forcing it to go to their shitty DNS servers, which panic and drop the connection when they see something 'unusual'.

jrockway 5y ago
> A while back, Sky Broadband was even intercepting all customer traffic to UDP or TCP port 53, and forcing it to go to their shitty DNS servers, which panic and drop the connection when they see something 'unusual'. This is exactly why DNS over HTTPS is a thing. Unencrypted services are regularly abused by ISPs and DNS is no exception.

josephcsible 5y ago

Running your own DNS resolver doesn't give you any of the benefits that using DoH does. The recursive queries that it sends out are just as vulnerable to an adversary on the network blocking or spying on as the ones sent to a regular insecure DNS server.