Hacker News Reader

Comment by bennyp101 | Hacker News Reader

> the article deliberately buries that it's trivial to change your DoH provider

While true for you or me, the vast majority of people will have this enabled by default - probably not even realising it's on

View on HN

And? Those same people are likely using their ISP or Google for DNS right now. How is this worse?

It's worse, because the local ISP is more trustworthy and additionally you enable cloudflare for large scale profiling. And don't claim they won't do it, it's just a matter of time

I scoff at the idea that Comcast is more trustworthy than Cloudflare.

Telia in Sweden has shared data with "selected partners" in a way that led to customers being extorted because of, among other things, porn surfing history and torrent downloading.

Trusting your ISP, even in a country with data protection laws like Sweden, is naive. I'd much rather trust a company that tells me "this is the data we store. This is the data we share with APNIC and no-one else".

Are you kidding? My ISP is blocking wikipedia.org, i.imgur.com, imbd.com, torproject.org, and many other.

I live in Sweden and I would never trust any ISP. There are too many cases of data shared with "business partners" that led to things like tries to extort torrent users or porn surfers (even reputable ISPs).

This should be, if not illegal at least highly problematic in the eyes of the law. At best the ISPs got a "better behave, because next time ...".

All ISPs have data sharing with "selected partners to ensure service quality" which, at least until GDPR, meant basically that they could sell data.

Whereas cloudflare states that the 1.1.1.1 data will only ever be shared with APNIC in anonymised form (which they define). Cloudflare defines what data they share for 1.1.1.1 users, which my ISP does not. I trust cloudflare, at least right now. If they were to change their retention policies and agreement I would maybe reconsider.

Well, if the user has configured their router to use their preferered DNS provider, and this is enabled, and they don't realise, then as far they are concerned all their requests are going via that provider, when in fact they are going out somewhere else.

That seems pretty shady to me

The default (which the majority of people will be using) is not Google, it's their ISP. And in the vast majority of cases, their ISP is under the jurisdiction of their country, while Google and Cloudflare have to obey the laws of a foreign country. Said foreign country might one day decide that for instance Google and Cloudflare now have to log the IP address of everyone who does a DNS lookup for news.ycombinator.com, even if the laws in the user's country forbid it.

Mozilla is only applying this in the US.

To start with

According to a CCC talk about DNS security, Mozilla is going to enable providers on a regional-basis by partnering with privacy-friendly non-profits.

DigitalCourage was one of the names mentioned as a potential EU-based DoH provider.

This!

This is very bad for Erdoğan. They won't be able to block DNS over HTTPS. Thus teir classic DNS blocks will be useless. Last time I've checked there was over 300K blocked domains via DNS. Even 8.8.8.8 doesn't work.

Why can't they block 1.1.1.1?

They can block but you can make any https page into DoH. What they are going to do? Block every web site?

No, just the ones that run DoH.

> They won't be able to block DNS over HTTPS

Of course they will. The DoH server can be blocked just like any other.

Eh, this is a losing battle for them. In theory any HTTPS server can be a DoH server if set up for it. One key for the future is to have so many DoH servers available for people in countries that filter that there is no way the government can block them all.

My uBlock Origin contains over 100k filter rules, and I pay zero for it. I doubt a company can't sell a list of open DoH servers for a reasonable price.

How they are going to block servers who have DoH url? DNS level block or IP block. May be SNI level block but in few years we will have ESNI.

To access a DNS-over-HTTP server, you need its IP (otherwise it would be a circular problem - must have DNS to access DNS). So they can just block the IP/port.

Wrong way around.

Said own country might one day decide to restrict access/log visits to controversial site X (e.g. Tibet, government critical news, piratebay etc.), which does not affect your DNS based in foreign country

Said country will just block the Cloudflare DoH server as well, forcing users to switch to a controlled DNS server.

I'm fairly sure that most, even non-technical users understand fairly well that their ISP can snoop on their internet connection. On the other hand I doubt that my mom expects that when she connects to https://www.impots.gouv.fr/ her browser pings an american-owned server to get access.

If she does it from a Chromebook/Chromebox, then all the requests are likely routed through Google DNS.

Tracetouting that address could reveal a lot more foreign-owned (and built) servers in the path, so I’m not sure what your litmus test is.

It's significantly better actually - gets around DNS blocking put in place by malicious ISPs and governments.

Well there is whole article linked explaining just that.

But basically, i know my ISP, and they don't log dns queries.

Most ISP's (the ones i have worked with) don't save DNS requests. They usually save netflow.

I also use vpn (my own), with its own dns resolver, for when i don't trust middle man.

Reply on news.ycombinator.com