It's about trust: would you rather trust your ISP, or Mozilla's choice of DoH partners?
Users never really had a reasonable (ie. non geek) opportunity to be in charge of their DNS privacy, and for most it's not something they can be bothered with.
Users never really had a reasonable (ie. non geek) opportunity to be in charge of their DNS privacy, and for most it's not something they can be bothered with.
And I will surely not allow some firm in a country with vague laws allow to do all my name resolution. Not to mozilla, not to google, not to cloudflare or anyone else (currently running unbind with caching on huge list of DNSs all over EU in random order).
ISP? They are obligated to follow the law in my country. Spying on its user would make it a criminal offense investigation, potentionally bringing their management behind bars. No, they wont even try, it is too dangerous for them.
I trust my ISP way more than mozilla. Based on law in my country. It is not DNS system to change (actually it is but convincing me that adding ssl layer on top of highly efficient protocol is worse than rolling everything trough https and changing all existing systems? I'll pass, sounds like a complex solution for simple non-problem, I am sick of looking on those in last decade), it is a law in YOUR country that allows your ISPs to spy on users and this is something that needs to change.
Users can have end to end encrypted DNS and browsers shouldn't be hijacking it.
To put it another way, you don't want the people who only care about eyeballs (Google, Mozilla, etc.) picking your DNS provider.
On the other hand, the Mozilla Corporation clearly is desperate to find alternate sources of funding.
Some of the public transit I've been on disagrees strongly with VPNs because they do heavy traffic shaping and VPNs fall into the "make this really slow" category. Reasonably so.
I also disagree with this advice. For myself and the vast majority of people $5/month is not worth it for the negligible difference in security and privacy over https, and DNS over https. This becomes even more true with encrypted SNI.
In fact, a VPN is largely worse privacy wise because "random coffee shop internet with random MAC address" is pretty anonymous unless you sign into anything over http.
You don’t ? Why would you sign up with such an ISP ? My ISP has a very clear privacy policy, and they obviously have to comply with the GDPR as well.
In America there is a vast number of countries with varied service providers, and Internet and data protection laws.
I have to wonder: is anyone actually regularly auditing these companies to make sure they abide by their privacy policy?
I see lots of privacy policies all over the internet, but absolutely zero oversight.
> Your DNS data can reveal a lot of sensitive information about you, and currently DNS providers aren’t subject to any limits on what they can do with that data; we want to change that. Our policy requires that your data will only be used for the purpose of operating the service, must not be retained for longer than 24 hours, and cannot be sold, shared, or licensed to other parties.
https://blog.mozilla.org/netpolicy/2019/12/09/trusted-recurs...
https://wiki.mozilla.org/Security/DOH-resolver-policy
(Disclosure: I work for Mozilla, but not on this)
The Mozilla TRR policy states that the DNS provider must not filter any queries unless the user explicitly opts-in.
How would a user selecting NextDNS as a TRR indicate that she wants NextDNS to filter queries in order to block ads and tracking.
The TRR policy also states that the provider must not use the EDNS Client Subnet extension. It looks like NextDNS does use some modified version of ECS, at least in its plaintext DNS service.
The FAQ states users can submit a query with class CHAOS instead of IN to get some diagnostics, e.g.,
drill -t example.com @45.90.28.0 a chaos