Hacker News Reader

Comment by m-p-3 | Hacker News Reader

What they should do is offer several alternatives when enabling DoH (Cloudflare isn't the only DoH provider out there), and anto-detect if your ISP or local network supports it at the enterprise level.

At least you can change the provider in about:config. I don't remember if you can do it through the settings page.

View on HN

Yea, Preferences > Network Settings > Enable DNS over HTTPS

Can currently choose "Cloudfare (default)" or "Custom"

But I agree, a few more options on there would be good, and if they are turning it on by default, then there should be a setup page that appears to let you choose the provider or something

Many ISPs won't offer such thing https://www.zdnet.com/article/uk-isp-group-names-mozilla-int...

> claimed that Mozilla plans to support DNS-over-HTTPS "in such a way as to bypass UK filtering obligations and parental controls, undermining internet safety standards in the UK."

> By planning to support DNS-over-HTTPS, Mozilla is throwing a monkey wrench in many ISPs' ability to sniff on customers' traffic and filter traffic for government-mandated "bad sites."

But I don't see why they can't offer their DoH, it seems their issue is with Cloudflare not with DoH per se

because most people don't know they can easily bypass the DNS based filters that is used to block "bad sites". DoH by default uses cloudflare's DNS, and so won't (need to) comply with the UK's filter laws.

> DoH by default uses cloudflare's DNS, and so won't (need to) comply with the UK's filter laws.

I'm assuming the DoH servers used by British users are physically in the UK. (I believe they anycast the service from all of their edge locations, and they have several in the UK.)

So the fact that Cloudflare doesn't have to comply with this law is precarious. Is it because only ISPs are required to comply? If so, it seems like a matter of time before Parliament amends the law to require any public DNS operator to implement the filters as well.

Also certain countries (eg. Australia), have a metadata retention law.

That means that the ISP dns will 100% be logging all requests made.

The risk of Cloudflare doing it is far outweighed by ISPs legally being required to do it, at least in Australia.

What if the user just doesn't make any DNS queries, because all their host lookups are going over DoH? They can log all the user's DNS queries, but all of them will just be for the DoH server whenever the user starts Firefox.

I assume DoH will not be logged at all. Or just many connections logged to "one.one.one.one".

Difference being if I connected to ISP ABC's DoH server - communication between will be encrypted, but the actual requests will be logged after they receive the request.

Note that Mozilla has added a way for network operators to disable DoH for their entire network, by NXDOMAINing a specific fake address. UK ISPs will presumably do that, and DoH won't happen in the UK for a while.

I can't see any way in which that could be abused.

Kazakhstan, China, Russia and the NSA all agree with me.

Reply on news.ycombinator.com