> I'd rather trust unecncrypted plaintext DNS queries that go to my ISP and government!

I trust my ISP and government more than a US company I have no formal contract with and the US government.

Also, there's the whole 'applications should not override system level settings' thing. My DHCP pushes a local (caching) DNS server that also does name resolution for internal services. This change would break that for all Firefox users on my network.

> I trust my ISP and government more than a US company I have no formal contract with and the US government.

And every single intermediary and whoever else might be listening in? This is an unencrypted plaintext connection. Which is the main point here. The whole "we trust ISP more" thing is completely beside the point. The point is DNS is horribly insecure nowadays, and it is about damn time we switch to something better.

> Also, there's the whole 'applications should not override system level settings' thing.

Hopefully, DoH will become a system level setting eventually.

If you use your ISP's DNS servers, there is no intermediary between you and them.

If you use wi-fi without a VPN, you have the coffee shop and the coffee shop's ISP. And anyone listening there. Of course there is cleartext SNI even for SSL connections... but alas.

What coffee shop ? I only connect to wifi at home and at the office.

And you're the only person who uses mobile computing devices.

Not sure what point you’re trying to make here.

Unless your ISP is running Huawei equipment. ;)

There aren't many intermediaries if you use your ISP's internal resolvers.

And there are intermediaries between Cloudflare/other DoH providers and the respective authoritative nameservers anyway.

My ISP is subject to specific regulations for licensed network providers, which Cloudflare isn't.

Thus, Cloudflare is the problematic intermediary.

But unless they have the private key for CloudFlare certs, they can't snoop in so it doesn't matter if there are intermediaries in between.

The traffic between Clouflare and the authoritative nameservers will be good old 53/udp.

The only thing the snooper won't be sure with is, which Cloudflare client asked for that record.

> I trust my ISP and government more than a US company I have no formal contract with and the US government.

You're not affected then, because the DoH rollout w/ Cloudflare as the default is only planned for the US.

That is not an argument, it is clear that this is supposed to be deployed by default.

... only for users in the US. Are you aware of other plans?

For now

Do you ever use wifi in a coffeeshop or hotel?

Because if you do, at that point they are your "ISP" for purposes of this discussion. Do you still trust them more than Cloudflare?

(For a desktop machine, obviously this is not an issue, but for pretty much anyone with a laptop this is something that needs to be worried about.)

As far as internal services, is this a split-horizon setup? As far as I understand, the plan is to detect those and fall back from DoH to normal DNS as needed.

> applications should not override system level settings

I wish Windows 10 and other operating systems natively supported DNS-over-HTTPS, but many don't. So they have to work around that lack of support.

> I trust my ISP and government more than a US company I have no formal contract with and the US government.

I do not! I'd rather have that anon US co. than any government.

You can use different DoH server, you can setup your own, that's not a problem

https://www.ghacks.net/2018/04/02/configure-dns-over-https-i...

I use https://odvr.nic.cz/doh

This is exactly why DoH is enabled by default in the US only.

I do trust my ISP and my government more than I trust CloudFlare.

It seems very American to me to trust a private actor such as CouldFlare more than your own government.

I feel like at least in Europe, a large majority of people would trust their government and local ISP much more than some company halfway over the world with basically no accountancy in your own country, especially an American one since it means your data is basically at the mercy of the US government.

Cloudflare has a better track record than most ISPs and governments.

Aren't there a bunch of European ISPs applying government enforced DNS blocking?

Seems like this is a very good move for them.

The ISP I run is applying [1] such blocks on our DNS recursors (blocking illegal online gambling domains, as per legal requirements [2]).

I still trust my DNS servers (or those of most ISPs, for that matter) more than I trust Cloudflare. I'd rather have intelligence services go through the effort of infiltrating every single ISP separately to get any useful dragnet intelligence, instead of just one large entity that can illegally collect all traffic from all users of a web browser.

[1] - https://github.com/q3k/rsh-unbound

[2] - https://hazard.mf.gov.pl/Ustawa

Couldn't agree more.

And I very much hope they aren't contemplating rolling this out in Europe.

Having worked for a major European telco, I get the impression that the amount of regulation they face around data protection and privacy is tremendous and my experience has been that this stuff is by no means taken lightly either.

It would never in a million years occur to me to route my traffic in such a way as to circumvent the legal protections it enjoys as long as it stays within a European ISP's network and instead encrypt it and send it off to a nearly unregulated entity in a foreign country.

I trust Mozilla and the contract they have with CloudFlare (not just CloudFlare by itself) more than my ISP.

> https://support.mozilla.org/en-US/kb/firefox-dns-over-https

Mozilla has a strong Trusted Recursive Resolver (TRR) policy in place that forbids CloudFlare or any other DoH partner from collecting personal identifying information. To mitigate this risk, our partners are contractually bound to adhere to this policy.

These are much stronger guarantees than my ISP's.

Is your ISP in the US and your government the US government? The DoH rollout w/ Cloudflare is only planned for the US.

> The DoH rollout w/ Cloudflare is only planned for the US.

For now.

> I'd rather trust unecncrypted plaintext DNS queries that go to my ISP and government!

Your ISP has access to more detailed data on you than DNS queries. Also CF servers are typically located in the same jurisdiction as your government and send unencrypted DNS queries from there. Now instead of dealing with every ISP your government has to deal with just one company in one location, no need to even ask that company anything, just come in and setup mirroring point, very convenient for the government, not very good for you.

They can log unencrypted DNS queries coming from Cloudflare, yes. But they can't correlate those with the incoming encrypted queries, not when the amount of traffic coming in is as vast as it will be. It doesn't help much to know "some Firefox user somewhere tried to resolve such-and-such domain".

Absolutely. This warning seems disingenuous and will confuse many normal people. DNS over HTTPs and DNS over TLS are good things and increase our privacy. People should switch to them.

Are there any GDPR compliant entities there? Preferably some company/organization from Europe?

I live in Europe and I do trust my ISP (and government, which has a decent track record at enforcing GDPR).

Even with DoH, my ISP already sees all of my network traffic. My DNS queries will effectively be anonymized by their recursive name servers.

> I live in Europe and I do trust my ISP (and government, which has a decent track record at enforcing GDPR).

I believe the GP comment was referring to government surveillance. This is a thing in Europe and GDPR won't protect you from it.

Also, good news for you: Since you live in Europe, the announced switch to DoH with Cloudflare as the default for Firefox users in the US won't affect you.