61–70 of 191 posts
Earlier quoted context omitted.
Not if one trusts more his/her ISP more than Cloudflare. At least, an ISP is a contractual partner and under the same jurisdiction, in Europe including GDPR.
Being in the same jurisdiction is bad: your ISP is THE place for your local law enforcement to get info on your browsing.
Earlier quoted context omitted.
That's exactly what their plan is -- and if you have experiments enabled, they may have already started sending your DNS queries to Cloudflare.
I guess thats Mozillas new monetizing strategy, sell user data to cloudflare, and market it as privacy. If you want privacy you better firewall everything your computer want to send to Cloudflare, Akamai, et.al.
Cloudflare claims they "will never sell your data or use it to target ads."
You can read their 1.1.1.1 privacy policies here:
https://developers.cloudflare.com/1.1.1.1/commitment-to-priv...
https://developers.cloudflare.com/1.1.1.1/commitment-to-priv...
Earlier quoted context omitted.
1. The connection to the authoritative servers isn't encrypted, so the whole point of DoH is undermined. 2. There's plenty of networks that don't let arbitrary DNS traffic out, so this doesn't work without another fallbacks. Fallbacks for security features are bad. I see that there are legit controversies around DoH. But these "Why don't you just do X?" comments aren't helpful. Try to understand the problem they're t…
I disagree that the OP's comment isn't helpful. Mozilla could have taken a tack that would have increased decentralization and promoted privacy (DNS-over-TLS exists). Instead, they went the way of a centralized protocol that just trades one set of potentially bad actors (ISPs) for another. re: network policy - If you're paying to use a network with policy that you disagree with vote w/ your wallet. If you're using so…
Why don't they rather include a resolver in Firefox ? This way, no privacy problems, you're directly contacting authoritarive servers. And you don't rely on a single dns-over-https provider. Is the latency a big problem there? I would say that with caching it is not too bad.
Besides what the other commenters have said, it also just seems like a bad idea to add 170 million extra recursive resolvers, I don't know how well the dns infrastructure would cope with that extra amount of traffic.
Besides, the number of domains and relatively short TTLs mean that even the big resolvers will not have most requests cached except for the most popular domains.
I am wondering, does DNS-over-HTTPS really helps since the way I understand it, after the domain name is resolved to an IP address, the client contacts the IP address so the ISP could still know the website visited especially since many if not most websites have dedicated IP addresses. So ISP could simply crawl the web and map domain names to IP addresses. Is there anything in DoH mitigating this? Or maybe is this at…
But this 1) adds a technical hurdle, 2) reduces accuracy of the data captured, and 3) adds a potential legal barrier, as the data is not theirs anymore
(before ISPs could claim that the use of their DNS gave them right to use the data collected)
I am wondering, does DNS-over-HTTPS really helps since the way I understand it, after the domain name is resolved to an IP address, the client contacts the IP address so the ISP could still know the website visited especially since many if not most websites have dedicated IP addresses. So ISP could simply crawl the web and map domain names to IP addresses. Is there anything in DoH mitigating this? Or maybe is this at…
Earlier quoted context omitted.
Or if you run your own resolver and don't want a completely unrelated third party like Cloudflare siphoning your traffic.
This. And I already have to deal with smart appliances that try to contact their own DNS (I’m looking at you, Samsung) and that break if I force their requests through my own resolver. This will just allow all applications and appliances to bypass my privacy measures.
at this point i expect to see talk of “the VPN”, a new network for hobbyists and academics, that's kinda like the old internet, and we only use devices that are wrapped in it.
Earlier quoted context omitted.
I guess thats Mozillas new monetizing strategy, sell user data to cloudflare, and market it as privacy. If you want privacy you better firewall everything your computer want to send to Cloudflare, Akamai, et.al.
>...sell user data to cloudflare... Cloudflare claims they "will never sell your data or use it to target ads." You can read their 1.1.1.1 privacy policies here: https://developers.cloudflare.com/1.1.1.1/commitment-to-priv... https://developers.cloudflare.com/1.1.1.1/commitment-to-priv...
There's a lot of negativity here. But this is a win overall for privacy. DNS is used by ISPs to sell user's data and is one way that oppressive regimes track what their users do. If you're technical enough to understand DNS then you are smart enough to change what the default is. If you're a system administrator for a company. You should be able to push a profile down to the user's computer to configure DNS how you w…
> DNS is used by ISPs to sell user's data and is one way that oppressive regimes track what their users do.
It's not a win for privacy, ISPs will still have that data and now third parties will have that data, state actors will have that data in a nice convenient centralized locations, governments will have an ability to force those centralized providers to do censorship for them. As for oppressive regimes - they don't care about DNS data, if they want to spy on people, they will one way or another.
I am wondering, does DNS-over-HTTPS really helps since the way I understand it, after the domain name is resolved to an IP address, the client contacts the IP address so the ISP could still know the website visited especially since many if not most websites have dedicated IP addresses. So ISP could simply crawl the web and map domain names to IP addresses. Is there anything in DoH mitigating this? Or maybe is this at…
ESNI can solve this, by encrypting the SNI header while still allowing serving multiple https domains on one IP. But it’s currently mainly implemented by cloudflare.