But this is a win overall for privacy.
DNS is used by ISPs to sell user's data and is one way that oppressive regimes track what their users do.
If you're technical enough to understand DNS then you are smart enough to change what the default is.
If you're a system administrator for a company. You should be able to push a profile down to the user's computer to configure DNS how you want.
Claims like these keep surfacing in every discussion. While it is good to contemplate what your ISP spying on you would look like and what you can do to minimize that risk, it is not good to present this as normal behaviour.
From my perspective I am absolutely certain that this is not something that is routinely done, not in established ISPs in democratic countries. The risks would be far too great for a tiny income. Who would you sell to? The advertising networks have their own data sources, and even the web giants with billions of users and trackers embedded in pretty much every web page you visit can't charge much.
Even if you wanted to do this, DNS would be a low value target considering it is cached at every layer. Data mining sFlow logs, which is something every ISP would use anyway for diagnostic purposes, would give you better view of which kind of services users connect to and for how long.
So please don't normalize something that is at best a niche for bad actors. That can lead to decisions for end users, many of whom would be wiser not sending their data off to a foreign third party.
Personally I have no idea whether or not this is a common practice, though I have to agree with xorcist that it's certainly not a given.
Your ISP may do this, but mine does not, so why should Mozilla get to dictate IT policy of my machine (i.e., ignoring resolve.conf)? Or policy of the company where I help run IT?
It reminds me of this silliness I sometimes hear:
"I need to use NAT with IPv6 to protect my network"
Firefox will allow you to set up a DNS rule locally that forces the client to use local dns, if you need it.
You can also configure a DNS over HTTPs server as your DNS.
If you help run IT and care about security. Then you should be blocking direct access to the internet anyway.
All your traffic should be going through a proxy server.
Also defaults should help those that are in weaker security positions. Just because you're lucky to have a good ISP doesn't mean that other people shouldn't be protected by default.
You're knowledgeable enough to configure your DNS, you just gotta learn something different.
This will just allow all applications and appliances to bypass my privacy measures.
at this point i expect to see talk of “the VPN”, a new network for hobbyists and academics, that's kinda like the old internet, and we only use devices that are wrapped in it.
It's mostly useless now with everyone defaulting to HTTPS unless you install a root certificate on all your devices.
With some additional duct tape[1] I made privoxy work on https too. I run an instance for each host, though it could be possible to distribute a personal CA certificate.
You as the local network operator are their adversary and it’s in Samsung’s every interest to bypass. They want and expect a clean connection to the internet. Giving it anything else is a problem to them.
If you’re installing one of these spyware devices in your network and relying on DNS to keep your information private then that’s on you when it doesn’t work. DoH neither creates nor solves human problems.
After all privacy is the goal, isn't it?
> DNS is used by ISPs to sell user's data and is one way that oppressive regimes track what their users do.
It's not a win for privacy, ISPs will still have that data and now third parties will have that data, state actors will have that data in a nice convenient centralized locations, governments will have an ability to force those centralized providers to do censorship for them. As for oppressive regimes - they don't care about DNS data, if they want to spy on people, they will one way or another.
I live in an increasingly oppressive regime. Most of the blocking is done at DNS level. DoH is a great solution. Slamming DoH because they can anyway spy one way or another is a poor argument.
A better solution would have been for Mozilla to fund development of an enduser friendly DNS proxy application which would enable DoH system wide.
The next best solution would be your suggestion, but that too is not practical unless it comes preinstalled on all OSes because the average user won't even know they need something called a DNS proxy. I don't see OS vendors agreeing to preinstall it. Additionally, AFAIK, popular OSes like Android and iOS prior to some versions don't even allow such system-wide DNS proxy configurations.
The practical approach left then is to implement it in browsers, solving it at least for the most common use case on all devices. Everybody knows how to download and install and use browsers. In a discussion forum I frequent, average users ask for ISP censorship bypass solutions all the time. Since Chrome does not support DoH yet, among all the possible solutions - VPN, Tor, SSHproxy - using another browser is actually the most user-friendly, least expensive, most performant option. It helps that it's Mozilla's product because their trust perception is higher than Google/MS/Apple/VPN providers.
I feel Mozilla's taken a good approach overall within the scope of their area of expertise.
Although I find it suspicious that there is just DNS filtering on your ISPs side and no IP filtering. Is it at the stage where it's not even enforced, semi-voluntary censorship by ISPs? Otherwise once the government starts checking compliance it will force IP-based filtering too, where DNS filtering circumvention is useless. And governments don't care about how broad the filtering is. Russia, for example, blocked half of the internet once in an attempt to censor Telegram.
DoH is a simple solution that works for now. TorBrowser takes it to the other extreme - it's a good secure solution (I think), but not required as of now, and seen as slow with plugin and other usage restrictions. VPNs, proxies are not seen as good solutions because people prefer free to paid, and they are not as trusted as CF and Mozilla. Self-managed VPNs/proxies are not easy for the average person to setup.