4 ms·

ISPs regularly data-mine their users' traffic. Meanwhile, some of the major DoH servers specifically don't. (See, for instance, the deals Mozilla has with their

ISPs regularly data-mine their users' traffic. Meanwhile, some of the major DoH servers specifically don't. (See, for instance, the deals Mozilla has with their default DoH providers.)

jjav 2y ago
> Meanwhile, some of the major DoH servers specifically don't. You can't possible make that assertion, because all it takes is one NSL and they will log and share it all.
belorn 2y ago
The policy that Mozilla ask providers to follow does not prohibit data-mining the traffic. Providers are requested to not store or share personal information, but any data-mining that removes personal identifiable information are allowed. For example, accidentally leaked internal network queries from companies are up to grabs. As is market data like what people are querying, how much, when, from where (geographical for example) and to whom, and so on. The quality of the anonymization of private information are also not guarantied.
Drawde 2y ago
> See, for instance, the deals Mozilla has with their default DoH providers. Like the one they had that just circled back around to the ISPs that regularly data-mine their users' traffic?: https://arstechnica.com/tech-policy/2020/06/comcast-mozilla-strike-privacy-deal-to-encrypt-dns-lookups-in-firefox/ https://arstechnica.com/tech-policy/2020/06/comcast-mozilla-...
chgs 2y ago
My ISP doesn’t but the people who run the increasingly centralised internet have a long track record of mining my data for commercial reasons. I’ll trust my ISP over Google or Cloudflare or Microsoft or DuckDuckGo any day.
- A4ET8a8uTh0 2y ago
  I think reasonable people these days don't really trust a provider even if they have explicit contract stating something. Personally, I just trust my ISP a little more than google when it comes to data. But I absolutely do not dream for one moment that they do not want to play with analyzing/monetizing/god knows what else with that data.
tremon 2y ago
I'm sorry, but this is an argument straight out of the totalitarian's playbook, and I'm going to call you out on it. Some <bad people> abuse <x>, therefore it is totally justified for us to impose a wholesale replacement of <x> with a solution that we can control centrally. It's for your own safety! Never mind all the people that don't have data-mining ISP's, and to hell with end-user consent. We don't need that, we're working for the good of everyone. My piety trumps all!
- JoshTriplett 2y ago
  Nothing about the DoH protocol is any more centrally controlled than DNS; that's the point. DoH treats the network as an adversary, and instead ensures the end-user's system can determine what DNS server to talk to and that their traffic can't be spied upon by an intermediary. That part is a feature, just as HTTPS was. (And there were people who complained about the push for universal HTTPS, too.) Separately from that, there's the issue of how to transition over to DoH, in a world in which many ISPs and networks are hostile. That is the point at which browsers are using the small handful of early-adopter DoH servers and assuming on behalf of some users that they want to use those instead of the servers from their ISP or other network. That part is debatable, and involves tradeoffs between protecting users who don't understand DNS or security and supporting users who do. DoH gives users the ability to ensure they're talking to the server they think they are, and not get their queries spied on or hijacked. That is the part I'm advocating here: having a protocol that cuts out MITMs and prevents spying on the network traffic. That doesn't solve the problem of needing a trusted DNS server to talk to; it solves the problem of not being sure you're talking to the server you think you are, and not being sure if some part of the network between you and that server is spying on you. If you have a DNS server you like and trust, whether that's from your ISP or something else entirely, that's great for you! DoH would still be a better protocol to use to talk to that DNS server, rather than the unencrypted DNS protocol.

ISPs regularly data-mine their users' traffic. Meanwhile, some of the major DoH servers specifically don't. (See, for instance, the deals Mozilla has with their default DoH providers.)

jjav 2y ago

> Meanwhile, some of the major DoH servers specifically don't. You can't possible make that assertion, because all it takes is one NSL and they will log and share it all.

belorn 2y ago

The policy that Mozilla ask providers to follow does not prohibit data-mining the traffic. Providers are requested to not store or share personal information, but any data-mining that removes personal identifiable information are allowed. For example, accidentally leaked internal network queries from companies are up to grabs. As is market data like what people are querying, how much, when, from where (geographical for example) and to whom, and so on. The quality of the anonymization of private information are also not guarantied.

Drawde 2y ago

> See, for instance, the deals Mozilla has with their default DoH providers. Like the one they had that just circled back around to the ISPs that regularly data-mine their users' traffic?: https://arstechnica.com/tech-policy/2020/06/comcast-mozilla-strike-privacy-deal-to-encrypt-dns-lookups-in-firefox/ https://arstechnica.com/tech-policy/2020/06/comcast-mozilla-...

chgs 2y ago

My ISP doesn’t but the people who run the increasingly centralised internet have a long track record of mining my data for commercial reasons. I’ll trust my ISP over Google or Cloudflare or Microsoft or DuckDuckGo any day.

A4ET8a8uTh0 2y ago
I think reasonable people these days don't really trust a provider even if they have explicit contract stating something. Personally, I just trust my ISP a little more than google when it comes to data. But I absolutely do not dream for one moment that they do not want to play with analyzing/monetizing/god knows what else with that data.

tremon 2y ago

I'm sorry, but this is an argument straight out of the totalitarian's playbook, and I'm going to call you out on it. Some <bad people> abuse <x>, therefore it is totally justified for us to impose a wholesale replacement of <x> with a solution that we can control centrally. It's for your own safety! Never mind all the people that don't have data-mining ISP's, and to hell with end-user consent. We don't need that, we're working for the good of everyone. My piety trumps all!

JoshTriplett 2y ago
Nothing about the DoH protocol is any more centrally controlled than DNS; that's the point. DoH treats the network as an adversary, and instead ensures the end-user's system can determine what DNS server to talk to and that their traffic can't be spied upon by an intermediary. That part is a feature, just as HTTPS was. (And there were people who complained about the push for universal HTTPS, too.) Separately from that, there's the issue of how to transition over to DoH, in a world in which many ISPs and networks are hostile. That is the point at which browsers are using the small handful of early-adopter DoH servers and assuming on behalf of some users that they want to use those instead of the servers from their ISP or other network. That part is debatable, and involves tradeoffs between protecting users who don't understand DNS or security and supporting users who do. DoH gives users the ability to ensure they're talking to the server they think they are, and not get their queries spied on or hijacked. That is the part I'm advocating here: having a protocol that cuts out MITMs and prevents spying on the network traffic. That doesn't solve the problem of needing a trusted DNS server to talk to; it solves the problem of not being sure you're talking to the server you think you are, and not being sure if some part of the network between you and that server is spying on you. If you have a DNS server you like and trust, whether that's from your ISP or something else entirely, that's great for you! DoH would still be a better protocol to use to talk to that DNS server, rather than the unencrypted DNS protocol.