That is, until software on any of these devices start running their DNS queries through DoH directly, circumventing any DNS filtering at the perimeter.

This is what browsers, like Firefox, are likely to do as it stands today.

And then you change the setting from the default to make it do what you want. The sky is not falling.

It's nice that browsers are likely offering an opt-out. However it seems likely to me that DoH will soon be used by non-browser apps as well, which are in no way obligated to provide an opt-out. What will you do about them?

The target is not Application Level DOH, Firefox implements DOH now because it will take a while until OS' ship it, and the OS vendors want to know it's worth it first.

Once OS vendors include support, your pihole can run a DoH server locally and all apps in your network use that DoH server.

I don't believe OS-level support would be relevant.

Once there is a decent set of public/commercial DoH servers available, devs can simply follow the browsers' example: Directly embed a DoH client into the application and supply a hardwired list of URLs and certificates. To my knowledge, you cannot block that with pihole.

At least, if I were an app developer with financial interest in users not blocking my ads and trackers, this would seem like an obvious thing to do.

I don't see why that would happen once OS-level support is deployed?

After all, glibc already did the hard work, why do it again?

(Oh and Applications with Ads were already able to do this, no need for firefox to do anything at all, it's just too complicated to be worth it)

Well, it has happened like this with TLS certificate validation. In theory, apps can use the system cert stores and you as a user can install custom root CAs if you want to find out what an app is actually sending. In practice, many apps have pinned certificates embedded to prevent that.

> it's just too complicated to be worth it

That's the point. It's complicated and costly today if you have to design your own protocol, run your own DNS proxy and be the target of outrage if someone finds out.

It won't be if DoH normalizes application-specific DNS servers and provides an ecosystem with infrastructure and tooling for it.

I don't think DoH will normalize it. As mentioned, App-level DoH is merely here because the OS-level doesn't support it yet. I don't see how that means DoH will replaced OS-level DNS.

I do hope you are right

Until you can't any more

Until they take that setting away from you, "because security".

Not to mention that where DNS was centrally managed before, now you have to change settings in each and every application that uses DoH to resolve names on the Internet.

(And then Google decides to do cert pinning on DoH, and suddenly you can only ever use 8.8.8.8 and 1.1.1.1, and if you want to change it, you need to buy Enterprise version of Chrome.)

I do think you're right. And I also think that DoH will legitimate MITM because if application developers can break an long standing contract like DNS on OS well... "why can't we"

Then there can be a browser that does not do that and this is what I will use.

Until you're minority, the browser don't receives funds enough and dies

So instead of getting spied, blocked, tampered, etc. by your ISP you are getting spied by Cloudflare? We didn’t solve the problem, just shifted it..

Cloudflare has a list of all data they collect from firefox DoH here: https://developers.cloudflare.com/1.1.1.1/commitment-to-priv...

Before CF was CF, they were a group of blackhats running honeypots. I was part of that community. It turned out, building a distributed CDN had potential to make money. And here we are. They built a great CDN. I would use them over Akamai any day. They have very talented hackers. That said, consolidating all DNS lookups to one central company guarantees they will have non stop pressure (if not already) to give warrant-less access to the data. This is very valuable data.

I never take privacy statements on a website seriously. A company can say one thing and do another. HN crowd knows this better than anyone.

source?

For what, the honeypots? I have no idea of such an article exists. I was one of their members and ran several honeypots and made use of several of my domains. It was started on freenode's IRC network, or at least that is how I learned about it and joined in. There are probably IRC logs on archive servers out there somewhere.

Interesting story, thanks for sharing it!

Why do people trust cloudflare more then FB and Google? Isnt the ultimate goal of all this big tech co the same: to known everything?

My ISP knows my real-world identity: name, address, phone number and credit card information. Cloudflare knows none of these things about me, so there's much less they can do with my browsing information.

Cloudflare has access to many of the sites you browse. They have the SSL keys, they host the services. They (potentially) know a lot more about you than your ISP. If you ever bought something from a web shop hosted on Cloudflare they have access to your billing address, credit card info and what you are buying. They may not collect it but they do have access.

Who said he was using cloudflare as his upstream DNS? There are far more choices than cloudflare, google, or your ISP.

They delete it after 24 hours and aggregate it via sampling for tuning afterwards.

Even I keep logs for 7 days before selecting for permanent storage, they are saints.

Doesn't matter if they are saints or not. My point was that we need a solution that we don't have to trust the other party being saint.

Does such a thing exist? You ask for a key lookup from address A, that can be stored no matter what. You can obfuscate it through proxies I guess

Pi-Hole doesn't require Cloudflare DNS. You can use your ISPs DNS service as they know who you're connecting to anyways.

Or you take 15 minutes and set up unbound.

You can operate a full resolver without Cloudflare or any other resolver DNS server. Every time you do a complete recursive resolution on the DNS names yourself locally and then only the DNS servers of the service you are using are going to know that you visited their service (and the adversary eavesdropping on the network between you and the service).

Set up your own server then?

What DNS provider is actually trustworthy and how can you prove it?

Run DoH over a Tor socket then...

I was thinking for a while to do more networking security at home, from basic stuff like a guest's wifi, to white-listing content and ports. How much time did it take you to set up Pi-hole to your liking?

I set it up a couple of months ago as well and as I recall I went from zero to "up and running" in an hour or two — I usually wake up a little earlier than my wife and I'd finished setting it up by the time we were ready to make breakfast. The ArchWiki page (https://wiki.archlinux.org/index.php/Pi-hole) was a useful reference for the few snags I encountered.

I’ll second this. Pi-Hole was very easy to set up and gives me some good peace of mind. Love seeing query trends too.

Not long at all for the basic setup.

For encrypted DNS setup I used this guide which worked: https://scotthelme.co.uk/securing-dns-across-all-of-my-devic...

Thanks all. Of course the arch wiki is a good place to go. I will definitely give it a try.

It is pretty simple to set up. You can do it in 1 hour.

tried this (installing unbound) — seems to work well, easy install

https://docs.pi-hole.net/guides/unbound/#setting-up-pi-hole-...