Can you disable this?
Yes. The article linked to explains how.
Mozilla’s DNS over HTTPs
221–230 of 777 posts
Re: Mozilla’s DNS over HTTPs
#222Earlier quoted context omitted.
In fact, the only meaningful difference between DoH and DoT is that DoT runs on a separate port, so network operators (and ISPs) can filter it. DoT is DoH with a kill switch.
DoH can be blocked by IP addresses, DNS canary and probably SNI, while DoT by IP addresses and port number. So "DoT is DoH with a kill switch." is again nonsense.
So one is easy to block and the other is hard, requiring maintaining a blacklist and or deep packet inspection. I'll take the hard one please.
Just increase the cost/difficulty of a thing makes that thing less common. In this case that "thing" is ISPs selling highly accurate web histories to anyone who will pay. Please make that harder/more expensive, every cent of cost to the ISP is welcomed.
Re: Mozilla’s DNS over HTTPs
#223Earlier quoted context omitted.
So I should block outgoing TLS requests to be able to stop DoH? Seems a bad idea.... At least with DNS I could run a local DNS server and block outgoing port 53 from anything else. Now I no longer have this option and each app gets to look up what it wants, when it wants. Sure, it's great that my ISP cannot see what's in these requests but nor can I! And it also means that any application (eg. any Google product) can…
Don't put devices on your network if you don't want to give them network access. And don't block technologies and protocols that help people protect themselves just because they also help devices protect themselves from you MITMing their connections. If you want to run a device reverse-engineering lab you have more work to do to break the security of a device. Also remember that if you can break the security of a dev…
> Don't run devices on your network you don't trust.
This advice is about as practical as "Do not use ISPs and their forwarders that you don't trust.". Which is to say, not much. Let us know about your experience with smart TVs and similar devices, and how much you trust them.
Re: Mozilla’s DNS over HTTPs
#224Can you disable this?
Re: Mozilla’s DNS over HTTPs
#225Can you disable this?
Yes, instructions to do so are in the article.
Re: Mozilla’s DNS over HTTPs
#226Can you disable this?
In preferences search for DNS. You'll find a checkbox to enable/disable it along with a select for choosing a provider.
Re: Mozilla’s DNS over HTTPs
#227Questions I couldn’t find answers to in the post or linked info about the Trusted Resolver Program: What’s in it for the Cloudflare & NextDNS? Are they getting paid to handle this traffic or paying to have the opportunity to access this data? Can users outside the US opt-in? The comment about having “no plans” to enable this outside the USA seems a bit disingenuous. Hard to believe they built this program / feature a…
> having “no plans” to enable this outside the USA seems a bit disingenuous. Other countries have censorship (China, UK, New Zealand, etc) whereas there is none in the US. I wonder if that’s why?
it's probably because cloudflare and friends went "we want to see what hit we're taking if we do this for free for you, by only enabling this by default for the US first" or something.
Re: Mozilla’s DNS over HTTPs
#228I’m wondering, is the US a phased roll out or is this in light of government mandated censorship in the UK, Australia, New Zealand, India, China, etc.?
Re: Mozilla’s DNS over HTTPs
#229Earlier quoted context omitted.
> What’s in it for the Cloudflare & NextDNS? It gives them a competitive advantage in DNS industry against other B2B providers, such as NS1.
How? Surely the only way that's possible is if they derive data about users, which they can then sell .. which is what Mozilla claim to be preventing.
Cloudflare's resolver does not send the client subnet, which hurts performance when users connect to anything that doesn't use Cloudflare.
Re: Mozilla’s DNS over HTTPs
#230I recently upgraded my home router to DNS over HTTP (pfSense now supports it pretty easily). I started with Quad9 (9.9.9.9) and Cloudflare as a backup (1.1.1.1). One thing I noticed right away was that my ping times to Cloudflare ended up being way faster (15ms) compared to Quad9 (50ms). Cloudflare seems to have a presence in my local area. Now both are good, but adding a 50ms delay (+TCP handshake + TLS setup and te…
> Cloudflare seems to have a presence in my local area.
In case you're interested in rolling out your own low-latency DoH: I run a DoH stub-resolver on Cloudflare Workers [0]. Their free-tier covers one device's worth traffic. You could do so on stackpath, too [1].