>...sell user data to cloudflare... Cloudflare claims they "will never sell your data or use it to target ads." You can read their 1.1.1.1 privacy policies here: https://developers.cloudflare.com/1.1.1.1/commitment-to-priv... https://developers.cloudflare.com/1.1.1.1/commitment-to-priv...
That does not say they cannot use it for other purposes.
It says what they use, how they use it, how they won’t use it, who can use what (APNIC or if required by law), and how long they retain what. Your comment is misleading.
>...sell user data to cloudflare... Cloudflare claims they "will never sell your data or use it to target ads." You can read their 1.1.1.1 privacy policies here: https://developers.cloudflare.com/1.1.1.1/commitment-to-priv... https://developers.cloudflare.com/1.1.1.1/commitment-to-priv...
That does not say they cannot use it for other purposes.
This. And I already have to deal with smart appliances that try to contact their own DNS (I’m looking at you, Samsung) and that break if I force their requests through my own resolver. This will just allow all applications and appliances to bypass my privacy measures.
who will write the article about the weird world we live in, where the person who is mitm'ing the network connection is me, and it's the non-mitm'ed connection that is untrusted and worrying. at this point i expect to see talk of “the VPN”, a new network for hobbyists and academics, that's kinda like the old internet, and we only use devices that are wrapped in it.
I was just thinking this. It's crazy: we used to all be concerned about protecting the transport (HTTPS/TLS) but now the bigger problem seems to be the endpoints themselves being untrustworthy--"smart" appliances, Google, Facebook, Mozilla and CloudFlare with DNS-over-HTTPS. Untrustworthy endpoints using secure transport to hide malintent.
I am wondering, does DNS-over-HTTPS really helps since the way I understand it, after the domain name is resolved to an IP address, the client contacts the IP address so the ISP could still know the website visited especially since many if not most websites have dedicated IP addresses. So ISP could simply crawl the web and map domain names to IP addresses. Is there anything in DoH mitigating this? Or maybe is this at…
This is why IP itself is no longer a workable solution--it's point-to-point by nature. Take a look at Named Data Networking for possible approaches to this problem.
So what will be « safer » ? Using a pi-hole or equivalent, or using this ? IIRC all DoH requests are sent to Cloudflare. Is there a way to host your own DNS server and use it with DoH instead ?
They are not mutually exclusive. Pi-hole supports dns-over-https. My concern with this technology is my port 53 masquerade rule on my router will no longer grab all dns requests when this becomes common practice. I imagine there will be a solution but I'm not sure what it is.
I don't really see a solution without installing root CA's to MitM HTTPS traffic. I too would be interested in solutions for this.
So what will be « safer » ? Using a pi-hole or equivalent, or using this ? IIRC all DoH requests are sent to Cloudflare. Is there a way to host your own DNS server and use it with DoH instead ?
Yeah, you can re-configure Pi-Hole to use DoH (with your preferred servers). unbound can be configured to use DoH as well.
For forwarding yes, but not for recursive resolution.
I guess thats Mozillas new monetizing strategy, sell user data to cloudflare, and market it as privacy. If you want privacy you better firewall everything your computer want to send to Cloudflare, Akamai, et.al.
Good luck with blocking Cloudflare and Akamai and still using the internet.
Which is why some people, like Paul Vixie (no DNS dummy, he), think that this is an absolutely terrible idea.
Mozilla is now basically dictating policy to organizations.
That does not say they cannot use it for other purposes.
It says what they use, how they use it, how they won’t use it, who can use what (APNIC or if required by law), and how long they retain what. Your comment is misleading.
And policies never change. There is never a change of management, especially after a company goes public (which CF is planning to do). /s
The article is not clear about one issue: are all applications expected to disregard the OS DNS? Is there an option to tell all applications that they should not bypass it? I will be pretty pissed if I wake up one day and find that Firefox decided to stop using my DNS server and instead started sending my requests to a third-party.
> Firefox decided to stop using my DNS server In an ideal world, your probably want some sort of encrypted connection to your own DNS server (unless your LAN is 100% trusted). Maybe something like HTTPS would work... oh wait. Most people don't have their own DNS server, so their DNS traffic is already who-knows-what server with who-knows-what monetization in place (plus its in plaintext, so the rest of the internet g…
And how the hell is split-horizon DNS supposed to work if resolve.conf is ignored?
This may be "fine" for (some) home users, but most organizations have a whole bunch of internal-only records. And even a lot of residences have things like printers and such that live under .local: how is the browser supposed to connect to those?
Who the fsck is Mozilla that they get to dictate policy in my IT organization about how DNS "should" work?
Same story as always with Google "innovations": "hey, we're preventing DNS queries to go to your ISP who is selling it" (to go to our service instead so we can profit from it). It's scary that Moz sides with monopolies like Google and Cloudflare on this one.
In my Firefox settings I can choose any DoH provider I want, not just Cloudflare. Naturally something has to be set up as a default so it works. Why is adding DoH in the browser a bad thing?