4 ms·

> I ditched them when they pushed so hard for DoH which looks a lot like ad delivery tech to me. It looks like privacy-enabling tech to me. I don't want my IS

by Gare 4y ago

> I ditched them when they pushed so hard for DoH which looks a lot like ad delivery tech to me. It looks like privacy-enabling tech to me. I don't want my ISP to snoop which domains I visit or hijack DNS requests.

krono 4y ago
The untouchable foreign databroker that is Google concerns me to a far greater degree than my heavily regulated and monitored ISP whose HQ is only a 30m bike-ride away here in the Netherlands.
- sp332 4y ago
  Firefox doesn't have Google on their preinstalled DoH provider list. You can go out of your way to configure it.
  - hda2 4y ago
    what about cloudflare?
    - sp332 4y ago
      Yes, Cloudflare is the default in the US.
      - sp332 4y ago
        Super late edit to add: Mozilla signed a contract with CF to put users' data under Mozilla's privacy policy instead of the one on the normal Cloudflare DoH service.
        passerby1 4y ago
        What's the difference between those two?
- Gare 4y ago
  Most of the world is not Netherlands, though.
  - krono 4y ago
    Yes I understand that's a distinctive factor, which was the reason for me mentioning it. Just wanted to point out that different threat models and actor evaluations exist.
Macha 4y ago
Do you trust your ISP or cloudflare more? In the US, I'd probably pick cloudflare too, but I'm happier with our local ISPs who are subject to GDPR and the US has been proven to be problematic in the privacy regard since the snowden leaks.
syberiyxx 4y ago
DoH does not prevent your ISP from seeing the IP addresses of the websites you visit. It only encrypts the requested url. It is not too difficult to figure out which IP addresses are from which websites and block or manipulate them. Learned first hand when trying to visit adguard.com with DoH enabled at a relative's. Comcast's router blocked the website by recognizing adguard's unencrypted website IP address. DoH is not really hiding anything from ISP's.
- tentacleuno 4y ago
  Yes. This can also be done by SNI scanning[0], which is a pretty core function of the web these days. [0]: https://www.cloudflare.com/learning/ssl/what-is-sni/ https://www.cloudflare.com/learning/ssl/what-is-sni/ P.S. not sure why your comment got flagged. It seems perfectly reasonable to me.

by Gare 4y ago

krono 4y ago

The untouchable foreign databroker that is Google concerns me to a far greater degree than my heavily regulated and monitored ISP whose HQ is only a 30m bike-ride away here in the Netherlands.

sp332 4y ago
Firefox doesn't have Google on their preinstalled DoH provider list. You can go out of your way to configure it.
- hda2 4y ago
  what about cloudflare?
  - sp332 4y ago
    Yes, Cloudflare is the default in the US.
    - sp332 4y ago
      Super late edit to add: Mozilla signed a contract with CF to put users' data under Mozilla's privacy policy instead of the one on the normal Cloudflare DoH service.
      - passerby1 4y ago
        What's the difference between those two?
Gare 4y ago
Most of the world is not Netherlands, though.
- krono 4y ago
  Yes I understand that's a distinctive factor, which was the reason for me mentioning it. Just wanted to point out that different threat models and actor evaluations exist.

Macha 4y ago

Do you trust your ISP or cloudflare more? In the US, I'd probably pick cloudflare too, but I'm happier with our local ISPs who are subject to GDPR and the US has been proven to be problematic in the privacy regard since the snowden leaks.

syberiyxx 4y ago

DoH does not prevent your ISP from seeing the IP addresses of the websites you visit. It only encrypts the requested url. It is not too difficult to figure out which IP addresses are from which websites and block or manipulate them. Learned first hand when trying to visit adguard.com with DoH enabled at a relative's. Comcast's router blocked the website by recognizing adguard's unencrypted website IP address. DoH is not really hiding anything from ISP's.

tentacleuno 4y ago
Yes. This can also be done by SNI scanning[0], which is a pretty core function of the web these days. [0]: https://www.cloudflare.com/learning/ssl/what-is-sni/ https://www.cloudflare.com/learning/ssl/what-is-sni/ P.S. not sure why your comment got flagged. It seems perfectly reasonable to me.