Hacker News Reader

Comment by Jerry2 | Hacker News Reader

> It sends all the users DNS queries to Cloudflare

I wonder how much Cloudflare paid for this 'privilege' of being the default DNS provider.

Mozilla claims that Cloudflare is not paying them, and claims that they have a contract with cloudflare which prohibits them from selling the data.

I don't think that this improves the situation substantially. The history of internet privacy failures is full of empty and unrealized promises, and no amount of contracts or promises can trump a court order or a NSL. "Has no ability to collect" is the gold standard, and the only level of protection that guards against compromise and blanket state surveillance activities.

AFAIK they also have never published the contract itself, though doing so wouldn't address the above points.

Edit: After carefully reading the cloudflare privacy statement ( https://developers.cloudflare.com/1.1.1.1/commitment-to-priv... ) I believe it unambiguously states they will collect "aggregate data" such as how much traffic each specific domain is receiving and use it for their own 'development' purposes. To me this seems extraordinarily valuable by itself, quite a windfall.

ISPs can and do sell your information, and can also be served a warrant or NSL. Cloudflare, by contract, is prohibited from doing the former, which is a net improvement even if they're still subject to the latter.

It's an incremental improvement, but a positive one.

I would certainly love to see an even better protocol for Internet name resolution that prevents anyone from having name-lookup information, but in the meantime, DoH seems like a huge step forward in ensuring that no unencrypted traffic is visible to the ISP or local network.

> ISPs can and do sell your information

Not in my country, they'll be massively fined if they're caught doing that.

Mozilla is only enabling DoH through Cloudflare by default in the US.

Your ISP, however, is not prevented from collecting and selling your data by DoH. So the addition of default DoH in cloudflare adds an extra party that can intercept your traffic but does not remove any.

> DoH seems like a huge step forward in ensuring that no unencrypted traffic is visible to the ISP or local network

It does not do this.

DNS traffic is a much richer and more valuable resource than a simple list of IP sessions.

Yes, of course your ISP can see who you're connecting to and sell that, but denying them (and anyone else) the ability to collect all DNS traffic is better than not denying that.

DoH is significantly richer than DNS itself because of session reuse.

DNS is cached, other than potential ambiguity related to shared hosts (which can be resolved by looking at SNI)-- I'm failing to see how DNS is richer than the traffic itself. Less costly to monitor? Sure.

Agreed. Unless that contract includes heavy penalties for selling and/or losing that data, its toothless nonsense. The fact that the contract hasn't been published is also problematic. If everything is above board, why hide?

To be fair, publishing contracts like that isn't a standard practice. That alone is a sufficient explanation. It still would be better if it were.

Mozilla isn't a standard company and this isn't a standard situation.

>Mozilla claims that Cloudflare is not paying them, and claims that they have a contract with cloudflare which prohibits them from selling the data.

As you said, this does not improve the situation. Mozilla can't even verify it.

Also it could be a reverse data selling situation like with Google: They don't sell the data, companies pay money to Google to display ads to the users. Since they have so much data, they can target specific groups more easily. Data doesn't even need to leave Google for that to work.

Reply on news.ycombinator.com