3 ms·

You may not have a reason to trust Cloudflare but if DoH is off you are essentialy trusting every router / NAT gateway / anyone capable of packet inspection bet

by throwaway2016a 3y ago

You may not have a reason to trust Cloudflare but if DoH is off you are essentialy trusting every router / NAT gateway / anyone capable of packet inspection between you and the DNS server.

gkbrk 3y ago
I think this can be translated pretty accurately as follows. You may not have a reason to trust Cloudflare, a company that you have no contract with, and a company that you do not pay, and a company that blocks most of the internet to people using browsers/extensions to protect their privacy. But if DoH is off, you are essentially trusting your hardware, and your ISP with which you have a paid contract.
- djbusby 3y ago
  One must have technical expertise and lots of available time to enforce said contract
  - gkbrk 3y ago
    And one must have magical powers to enforce a contract that doesn't exist. Enforcing a hard-to-enforce contract is possible, and such contracts have been enforced before. You will have a more difficult time getting anyone to enforce good behaviour from an entity that you do not pay, and have no contractual relationship with. Especially if that entity is subject to a law that requires them to access not only their data on US servers, but foreign ones as well.
- throwaway2016a 3y ago
  My point was this can be done on any network you join... a coffee shop, a coworking space, etc (unless your using encrypted VPNed obviously) so not just your hardware. Additionally, any network along the way can inspect unencrypted packets not just your ISP. Unless your ISP is just one hop from the DNS server you're using (or you use your ISPs DNS). You are trusting potentially dozens of parties... some of whom you have a contract with any many you don't and some of whom may be a malicious government (depending on where in the world you are). But I do agree with, implicitly, what you are saying. I wish the default wasn't Cloudflare and if you change it explicitly it sounds like the canary won't work anyway.

You may not have a reason to trust Cloudflare but if DoH is off you are essentialy trusting every router / NAT gateway / anyone capable of packet inspection between you and the DNS server.

gkbrk 3y ago

I think this can be translated pretty accurately as follows. You may not have a reason to trust Cloudflare, a company that you have no contract with, and a company that you do not pay, and a company that blocks most of the internet to people using browsers/extensions to protect their privacy. But if DoH is off, you are essentially trusting your hardware, and your ISP with which you have a paid contract.

djbusby 3y ago
One must have technical expertise and lots of available time to enforce said contract
- gkbrk 3y ago
  And one must have magical powers to enforce a contract that doesn't exist. Enforcing a hard-to-enforce contract is possible, and such contracts have been enforced before. You will have a more difficult time getting anyone to enforce good behaviour from an entity that you do not pay, and have no contractual relationship with. Especially if that entity is subject to a law that requires them to access not only their data on US servers, but foreign ones as well.
throwaway2016a 3y ago
My point was this can be done on any network you join... a coffee shop, a coworking space, etc (unless your using encrypted VPNed obviously) so not just your hardware. Additionally, any network along the way can inspect unencrypted packets not just your ISP. Unless your ISP is just one hop from the DNS server you're using (or you use your ISPs DNS). You are trusting potentially dozens of parties... some of whom you have a contract with any many you don't and some of whom may be a malicious government (depending on where in the world you are). But I do agree with, implicitly, what you are saying. I wish the default wasn't Cloudflare and if you change it explicitly it sounds like the canary won't work anyway.