> the company has no plans to switch Chrome users to its own DNS servers.
Meanwhile, the Chromecast inexplicably ignores DHCP/NDP-provided DNS servers and uses 8.8.8.8 for all queries.
Big ISPs aren’t happy about Google’s plans for encrypted DNS
101–110 of 456 posts
Re: Big ISPs aren’t happy about Google’s plans for encrypted DNS
#102Earlier quoted context omitted.
I wonder why someone who knows how to do any of that, would think it is a good idea or go along with implementing that. The shitbirds who actually want to do this type of thing are not smart enough to execute it.
To make money on analytics?
He is speaking of the developers and engineers who have the technical expertise and should know it's a bad idea but still agree to implement it regardless of their moral compass.
Re: Big ISPs aren’t happy about Google’s plans for encrypted DNS
#103Earlier quoted context omitted.
DNS requests are transmitted in plaintext through the ISPs connections. Because DNS is not remotely secure there isn’t any reason they couldn’t simply redirect your selected DNS to their own, or replace “not found” responses with a link to their own advertisements. So without DoH an ISP knows everything you request, even if you have a different DNS server set, and if they really wanted to they can simply hijack any c…
It's a good point, but it is preventable by the network admin. For example, I bypass that by tunneling everything out over a VPN, and the local resolver attempts to use HTTPS to connect to upstream anyway. Obviously not every user is in a position to protect themselves in such a way, so I get why the browser is attempting to protect them. Just seems very wrong to me to take the control away from the user/network-admi…
> take the control away from the user/network-admin
You are confusing the network admin and the user. Most users have little reason to trust their router, they often don't own it, update it or have any clue about it. Even experts change roles here when they use any other entities network.
I understand your use case, but I personally think the end devices should increasingly allow interception by network devices only with user consent, not implicitly.
In other words, opt-in on the device with DNS settings and certificates. If you don't own the device (e.g. have root/admin/etc), you don't get to control it - beyond blocking it.
Re: Big ISPs aren’t happy about Google’s plans for encrypted DNS
#104Earlier quoted context omitted.
Your ISP, by virtue of supplying the pipe to the internet, can (and very likely does) still snoop on any old-fashioned plaintext DNS requests you make across it, even when you're not using their servers.
I might have misread the GP, but I kinda felt that it also brought up the issue that a pihole (or similar solutions) might cease to work in a "DoH / I automatically pick the best resolver if I deem yours not good enough" world. DNS privacy is awesome. Filtering malicious and annoying (read: ads) content at the DNS level is mandatory for me..
I don't think how that would cease to work. At least in the case of Mozilla they try to detect if you have a custom DNS server. When found, they won't use DoH for fear of breaking many intranets in enterprises.
Re: Big ISPs aren’t happy about Google’s plans for encrypted DNS
#105Earlier quoted context omitted.
I’m not saying that some ISPs aren’t malicious. But to say there is no reason for an ISP to serve DNS is absurd.
There is no reason for ISP customers to use ISP DNS, given the available alternatives, and this will become even clearer as more people boot up DoH resolvers as alternatives to Cloud Flare.
Again this is absolutely false. Your ISP, and nobody else, can deliver the lowest latency and quickest path DNS resolution short of other providers paying ISPs for last mile fog boxes (as some DNS providers do). Why can’t my ISP support DoT?
But that also highlights a huge misconception about DoT/DoH: it only provides privacy to the resolver. It does not make your requests private in the eyes of the server or spanning the recursive queries that may be required during resolution. I’m not particularly compelled to trust Cloudflare more than OpenDNS or whatever. It’s the same situation with VPN.
Anyway it’s well known that the actual solution for people concerned with utmost privacy is a round robin resolver selection strategy. It’s super easy to implement... why aren’t browsers providing this type of option?
Re: Big ISPs aren’t happy about Google’s plans for encrypted DNS
#106Re: Big ISPs aren’t happy about Google’s plans for encrypted DNS
#107Earlier quoted context omitted.
We agree that ISPs should not need to view your browsing data without your consent. But there are many technical reasons for an ISP to want to run DNS outside the resolver privacy conversation: For one some ISPs run content filtering services. Some users prefer to concede extreme privacy for what they view as a safer browsing experience. It might not be your jam, but it exists. DNS is designed to be provider independ…
But DoH is provider independent. It's just like I can swap out AT&T's regular DNS service for Cloudflare's in my home setup. Which I did. Mozilla's move to reconfigure Firefox to use DoH is a bit sneakier, but it fits with their privacy stance and their low market share does give them cover.
To be clear I’m not arguing against DoH/T. I’m arguing that there are technical and product reasons an ISP might want to run DNS.
Re: Big ISPs aren’t happy about Google’s plans for encrypted DNS
#108Earlier quoted context omitted.
To make money on analytics?
He is speaking of the developers and engineers who have the technical expertise and should know it's a bad idea but still agree to implement it regardless of their moral compass.
Why the implication that devs/engineers who have such technical expertise "know it's a bad idea"? There are plenty of devs and engineers who would have no moral issue with mass data collection and analytics. You don't magically become a paragon of morality just because you got a CS degree. Just ask Zuckerberg.
Re: Big ISPs aren’t happy about Google’s plans for encrypted DNS
#109Earlier quoted context omitted.
That is a serious misrepresentation of what's happening with Manifest v3.
> serious misrepresentation How is it a serious misrepresentation? Manifest v3 cripples the ability to block ads. Google is an ad company and has the largest browser market share by far. How is this not abuse? Google can claim that things like AMP are not intended to rope us into their walled garden, that it's all about improving performance. But at the end of the day, most of the moves they make further their goal o…
My Chrome browser still perfectly blocks ads. The day it stops doing that, then you have a valid point. Until then, it's mostly fear mongering and misrepresenting the situation.
Re: Big ISPs aren’t happy about Google’s plans for encrypted DNS
#110It's pretty clear that the ISPs drafted their letter before Google made it clear that they would not be forcing the transition to their own DNS servers. The complaints are entirely about centralization.
Google has attempted to allay some of these concerns, but their initial blog post [1] makes it lear that only certain whitelisted DNS providers would be permitted to participate. That does imply a degree of centralization regardless of Google's assurances to the contrary.
[1] https://blog.chromium.org/2019/09/experimenting-with-same-pr...