Hacker News Reader

Comment by ocdtrekkie | Hacker News Reader

The ad industry is prepared for this. DNS-over-HTTPS will ignore your PiHole, and lovingly bring you ads anyways. While you can turn DoH off in your browser, your IoT device will not be so configurable. And will most likely fail to work entirely if you block access to Google's DoH endpoint.

DoH is an incredibly user hostile technology designed to remove your agency to control your network traffic, and by and large, the majority of tech enthusiasts have cheered for it.

View on HN

It'll be an arms race. DNS-based blackholes would give way to IP-by-IP firewall rules.

I remember when personal firewalls were mostly about blocking threats coming in through incoming connections. Now, I use mine more to block threats already on my network from exfiltrating through outgoing connections.

DoH removes the agency of the network provider. This is great if you can't trust the network.

If I used my ISPs DNS resolver it wouldn't allow me to access sci-hub. I can trivially use Googles DNS, but if that where to change DoH would save me.

The other problem is solvable by not buying an IOT device with a screen. I can't buy a dumb TV, but I do okay with my current one and my computer monitor.

This is only partially true: You are also, more than likely, your own network provider too. So unless you have full control over devices on your network (including closed source IoT devices), it takes away your agency as well.

So it's terrible, unless you can trust every device on your network.

> DoH is an incredibly user hostile technology designed to remove your agency to control your network traffic

I view it as more of a double-edged sword. It can be very handy if you have a hostile ISP playing shenanigans with DNS or logging your queries and selling the data, but as you point out, it's also useful for bad actors as well.

I'd say on average, tech companies pushing DoH like Google, Cloudflare, and Mozilla, are using the excuse of hostile ISPs, knowing that the primary goal is to defeat enterprise security and ad blocking.

I mean, sure, Google's worried about your ISP logging your queries and selling the data... because that would compete with Google's business of logging your web activity and selling ads based on it. DoH isn't a privacy technology at that point, it's a anti-competition play.

1. DoH is a user configurable setting, it cannot be dictated by ad vendors or websites.

2. DoH fails back to standard DNS.

3. DoH is hard to filter, just like other TLS encrypted traffic.

4. DoH is a user FRIENDLY technology meant to increase user privacy and reduce DNS hijacking.

5. Don't like it? Turn it off. Only you have that power to enable or disable it.

DoH can be enforced by user-hostile devices and applications.

Including Internet-of-shit infested appliances and devices.

With 5G SIMS embedded and financed at rock-bottom mass-contract data-dribble rates via advertising, other revenue flow, or up-front / ongoing purchase revenue streams, WiFi LAN egress controls --- PiHole or other DNS blocklists, or IP and protocol firewalls --- simply won't be effective.

You're confusing DoH in "friendly" browsers like Firefox, where you and I might deliberately turn it on to thwart ISP shenanigans. In that case, it's good that DoH is hard to filter and looks like all other TLS traffic.

But the parent is correctly describing DoH as a double-edged sword. The same properties that make it good for you and me when trying to safely access domain data make it a weapon for rogue IoT devices who want to do the same.

Your smart fridge could easily include software that allows it to acquire its own secure DNS info from a DoH network run by the smart fridge manufacturer. This would allow them to find the domains behind the chumbox ads that they want to show you in spite of your PiHole. Since the manufacturer would be doing this to get around a user's desired network configuration, it'll be configurable for them, not for you. You will not be the "owner" of this device.

I don't see what any of that has to do with DoH. A device could just as easily use its own private dns service and bypass network filtering as well.

On a properly-configured network, all DNS requests are intercepted and routed to the desired DNS server. I do this to make Google devices respect my DNS preferences (send DNS through PiHole) instead of using their hardcoded setting.

Unencrypted DNS can be redirected or inspected and selectively blocked. DoH cannot, and whereas you can selectively tamper with DNS requests to remove advertisers, devices may fail to work at all if you block their DoH provider.

Reply on news.ycombinator.com