If you use your ISP's DNS servers, there is no intermediary between you and them.
Re:Turn off DoH, Firefox
by unethical_ban on Wednesday September 11, 2019 @04:51PM
(#20944551)
If you use wi-fi without a VPN, you have the coffee shop and the coffee shop's ISP. And anyone listening there. Of course there is cleartext SNI even for SSL connections... but alas.
Re:Turn off DoH, Firefox
by Aaargh20318 on Thursday September 12, 2019 @05:28AM
(#20949599)
What coffee shop ? I only connect to wifi at home and at the office.
Re:Turn off DoH, Firefox
by unethical_ban on Thursday September 12, 2019 @12:07PM
(#20953110)
And you're the only person who uses mobile computing devices.
Re:Turn off DoH, Firefox
by Aaargh20318 on Thursday September 12, 2019 @02:06PM
(#20954450)
Not sure what point you’re trying to make here.
Re:Turn off DoH, Firefox
by throw0101a on Wednesday September 11, 2019 @10:36AM
(#20940626)
Unless your ISP is running Huawei equipment. ;)
There aren't many intermediaries if you use your ISP's internal resolvers.
And there are intermediaries between Cloudflare/other DoH providers and the respective authoritative nameservers anyway.
My ISP is subject to specific regulations for licensed network providers, which Cloudflare isn't.
Thus, Cloudflare is the problematic intermediary.
But unless they have the private key for CloudFlare certs, they can't snoop in so it doesn't matter if there are intermediaries in between.
And every single intermediary and whoever else might be listening in? This is an unencrypted plaintext connection. Which is the main point here. The whole "we trust ISP more" thing is completely beside the point. The point is DNS is horribly insecure nowadays, and it is about damn time we switch to something better.
> Also, there's the whole 'applications should not override system level settings' thing.
Hopefully, DoH will become a system level setting eventually.