I think google is evil. But I know AT&T is.

Big G is driven by money like any other company, but they lose more money if they don't employ top security practices and prevent others from getting their data. ATT's main business isn't selling the data, it's selling the pipes that carry data, so security on their data lakes is probably less of a priority.

> ATT's main business isn't selling the data, it's selling the pipes that carry data

... and I'm sure their shareholders are pressing them to forego the greater revenue from subscriber data so they can keep their dividend cheques comfortably small.

With the SPs, all you have to do is look at ANYTHING security related around their business and observe what shambles it is.

The last time I looked, the csrf token issued by the homepage of one of the big three mobile carriers was "undefined."

This. I know from experience how terrible a company they are with customer service, but there is that little arrangement with the NSA called PRISM...

i suspect they somehow throttle this traffic -- i used to use 1.1.1.1 for a while and had to repeatedly switch out b/c my dns resolution times would be terrible after a while

If you are not using gmail and google search, and are using adblockers, Google shouldn’t really have any information on your IP, so it is anonymised data. Your ISP knows even your bank details.

But the limits of using google DNS (or even encrypted DNS) is that most commercial websites aren’t sharing IP addresses, so I bet the ISP can pretty much reconstruct the data it would get from DNS with very little effort just by looking at your IP traffic and mapping IP addresses to domains from other users DNS queries.

> Your ISP knows even your bank details.

Google was buying MasterCard records: https://www.bloomberg.com/news/articles/2018-08-30/google-an...

And they can use that if they know your identity, like if you provided them a phone number.

But I don't believe they can't do much from an IP alone. Unless the ISP starts ratting us out.

Theoretically, yes. For that to work, you also need everything on your network to never have encountered a google cookie, adwords, Android, Chrome, YouTube, Maps, Google DNS servers, any of various "smart" devices, etc. And hope those Google Global Cache servers living at your ISP are trustworthy.

"starts"

2001.

If you use 8.8.8.8 unencrypted, then both your ISP and Google know your query. With DoH only Google will know. But often Google can figure it out even without DNS data.

You don't need to just blindly trust, there are ToS and privacy statements. My TL;DR is that Google doesn't use logs outside of service health (eg vs DDoS).

For reference: https://developers.google.com/speed/public-dns/privacy

So what pays for this service?

I don't know. I think not everything a large company does necessarily immediately pays for itself. Also, Google overall benefits when people use the web more.

Nothing or Google depending on how you want to think about it. Google needed this service for themselves, as the default fallback DNS for their devices, their domain registrar, for GCP and it made sense to just let the public use it too for some good PR.