Hacker News Reader

Comment by Clamchop | Hacker News Reader

For web browsing, these solutions necessarily cannot be as sophisticated as software running in the browser. They're also much less convenient to install and use.

DNS filters and firewall rules are crude tools by comparison but you can't install uBO on random apps or your TV.

View on HN

Not to mention this is an attack on multiple fronts: do you _really_ believe DoH is about privacy?

It both is and it isn't. It moves people from different threat models to a middle ground, and for some people that's worse and for some people it's significantly better.

If you live in the U.S. for most major ISP users it's probably a wash and you're just letting a different party have your info. If you live in a nation that desires to control what you consume online then it probably is a net gain.

dnscrypt.org will shuffle between multiple encrypted resolvers. So no single party has your info.

Isn't that worse though since your data would be spread across multiple potentially untrustworthy parties instead of just a single one? Given how many requests a browser makes and normal browsing habits like regularly visiting the same sites, it would eventually lead to each resolver having a full profile of what you browse.

That makes me think of the reason Tor has Entry Guards where the first hop is limited to just a few selected nodes instead of random: https://support.torproject.org/about/entry-guards/

Having adblocker that can monitor all https traffic is very effective, and works on the level of the whole machine.

Reply on news.ycombinator.com