Big ISPs aren’t happy about Google’s plans for encrypted DNS

Post by echelon » Wed, Oct 02, 2019, 12:52 AM UTC

jchw wrote: post #9

PaulHoule wrote: post #2

From Google's perspective being able to block ads with your hosts file is a bug, not a feature.

For what it’s worth, at least in Chromium’s implementation: - The hosts file should still take effect (Chromium can read the hosts file and parse it already.) - The DoH upgrading should not override your default resolver. It works by having a lookup table of providers that support DoH and using DoH if your provider supports it. The list can be seen here: https://cs.chromium.org/chromium/src/net/dns/dns_util.cc?q=D...…

Post by tptacek » Wed, Oct 02, 2019, 12:54 AM UTC

echelon wrote: post #21

jchw wrote: post #9

Earlier quoted context omitted.

For what it’s worth, at least in Chromium’s implementation: - The hosts file should still take effect (Chromium can read the hosts file and parse it already.) - The DoH upgrading should not override your default resolver. It works by having a lookup table of providers that support DoH and using DoH if your provider supports it. The list can be seen here: https://cs.chromium.org/chromium/src/net/dns/dns_util.cc?q=D...…

For now. Google sneezes and this is gone. We didn't think they'd take away extensions' abilities to block ads, and yet here we are. We've seriously got to pursue breaking this company up. They're the absolute worst.

Post by shakna » Wed, Oct 02, 2019, 12:55 AM UTC

tbyehl wrote: post #13

xvector wrote: post #4

Death to big ISPs.

Death to PiHole and every other DNS-based ad block and security system. At least, by Mozilla's plan.

Post by tptacek » Wed, Oct 02, 2019, 12:55 AM UTC

olliej wrote: post #22

kelnos wrote: post #15

While I don't particularly trust Google all that much anymore, the fact that ISPs even have an opinion on this is a smoking gun that they're doing sketchy things with DNS data. There is no actual technical reason why they should care if you use their DNS servers or something else, even a private, encrypted DNS service.

We already know they do - they’ve injected ads + “suggestions” instead of dns failures in the past. They’ve also injected permanently unique cookies in http requests. ISPs can’t be trusted as dumb pipes, they’re closer to “clueless criminal” pipes. But I agree with you, I don’t particularly trust google either.

Post by shakna » Wed, Oct 02, 2019, 12:57 AM UTC

daedalus_j wrote: post #24

I'm fine with encrypted DNS as long as it's from my router to the (encrypted) DNS provider of MY choice. Interference from browsers with network level operations is my real worry. As far as I'm concerned, as long as the browser speaks HTTPS to my router, and my router speaks HTTPS to the servers, no problem. I'm worried about the "to protect the users we've hijacked their DNS directly via the browser" possibility tho…