Please don't use DoH as an evil advertising bogeyman. It's a huge win in the fight against censorship and surveillance, and everything that it lets advertisers do can be equally done by hardcoding an IP address in the app instead.

Well, it does break pihole.

And I already use trusted DNS providers (over TLS) so it's not really an issue. My provider can't see my DNS lookups. Also, in the EU providers are not allowed to use deep packet inspeciton so they only know your queries if you use their own DNS.

Hardcoding an IP is really difficult to do for adtech providers for 2 reasons:

1) They usually subcontract to cloud providers that don't guarantee IPs

2) It breaks SNI (Server Name Indication), also heavily used on cloud services

There's better ways to do secure DNS than DoH, like DoT (DNS over TLS)

I like secure DNS but I still want my own server to be the middleman. With DoH this isn't easily possible, especially on mobile due to the root CA issue. DoH is normally implemented using a major player like CloudFlare. Sure, they promise not to look at it. But the phrase "Don't be evil" still is pretty fresh in my mind.

But anyway, it's a moot point. Even if we could block DoH somehow (we can't due to certificate pinning and Android no longer allowing to add a global root CA since Android 7), app providers could just implement their own lookup system or something. Whether we like DoH or not it's here to stay.

> Well, it does break pihole.

Sure, but that's only because your computer can't distinguish your Pi-hole blocking DNS to block ads from an evil ISP blocking DNS to censor you. And if your device supports DoH, can't you just point it to one of the many publicly-available DoH servers, or set up a DoH server on your Pi-hole and then point at that?

> It breaks SNI (Server Name Indication), also heavily used on cloud services

They can just hardcode the IP in the hosts file, not in the client program. Then SNI will still work normally.

> There's better ways to do secure DNS than DoH, like DoT (DNS over TLS)

Then the people who want to do censorship and surveillance will all just block port 853. It's a feature that DoH is hard to distinguish from other HTTPS traffic.

> I like secure DNS but I still want my own server to be the middleman. With DoH this isn't easily possible, especially on mobile due to the root CA issue.

Can't you set up your own DoH server with its own domain name, get a Let's Encrypt certificate for it, then point your mobile device at that?

> DoH is normally implemented using a major player like CloudFlare. Sure, they promise not to look at it. But the phrase "Don't be evil" still is pretty fresh in my mind.

Isn't the alternative that your ISP is definitely looking at it?

> Can't you set up your own DoH server with its own domain name, get a Let's Encrypt certificate for it, then point your mobile device at that?

Yes. But what’s the angle here? You trust “ISP(s) hosting your DoH server” but not “ISP providing phone connection?”

Might be a legitimate reason for that, but ultimately as with all these discussions it’s just a matter of who you’d rather give the data to.

And your ISP will still be able to see from SNI for the most part so… it boils down to “my ISP can see anyway (via SNI), should I also let someone else see (DoH provider)?”

> Yes. But what’s the angle here? You trust “ISP(s) hosting your DoH server” but not “ISP providing phone connection?”

Your own DoH server could just do the filtering you want and then hand off the work to another real DoH server like Cloudflare's.

> Might be a legitimate reason for that, but ultimately as with all these discussions it’s just a matter of who you’d rather give the data to.

True, but in most of the USA, your ISP is the least trustworthy choice for who to give your data to.

> And your ISP will still be able to see from SNI for the most part so… it boils down to “my ISP can see anyway (via SNI), should I also let someone else see (DoH provider)?”

So let's hurry up and deploy eSNI/ECH everywhere.

> Then the people who want to do censorship and surveillance will all just block port 853. It's a feature that DoH is hard to distinguish from other HTTPS traffic.

Not an issue here in the EU. Alternative DNS is not blocked. Providers sometimes block the pirate bay but they're never obliged to block alternative DNS and they're not allowed to anyway as they're not allowed to do Deep Packet Inspection.

> Isn't the alternative that your ISP is definitely looking at it?

No, this is not allowed in the EU. They can see it if you use their DNS. Otherwise not.

I understand the feature that hiding the DNS traffic among other HTTPS traffic brings, but this is mainly a feature in countries without strong privacy laws. For me I would prefer to separate the traffic so I can control it myself.

And really if I'm in a country with such invasive censoring I would prefer to use a VPN and avoid their prying eyes altogether. DNS is only part of the equation. IP endpoints still tell them a lot. Especially on IPv6 as there's no more need for SNI.

I'm just not sure if it's a good idea to obfuscate core protocols of the internet, just to avoid an issue in certain countries that is not very well solved by this anyway. At the same time I have to give up a lot of valuable statistics, troubleshooting data and validation about whether apps do as they claim.

However like I said I can't stop an app doing this, precisely for the reason it's obfuscated. I won't use it on my own network however.

> Can't you set up your own DoH server with its own domain name, get a Let's Encrypt certificate for it, then point your mobile device at that?

I don't want to bother with getting public domain names and validate their IP with Let's Encrypt just because I want to use them internally. The renewal process is really complex for something that doesn't have a public IP and I don't want to have my internal DNS available on the internet (it also contains local domain names only available on my LAN and P2P VPN)

In fact encrypting that traffic on the local segment doesn't really add any value for me. I just encrypt the outbound part (from the pihole) with DoT.

> They can just hardcode the IP in the hosts file, not in the client program. Then SNI will still work normally.

How would that work? I control my host file. Apps can not mess with it. Not on my computer and not on my phone.

It's great that you live somewhere where you don't have to worry about any of these things, but a lot of us aren't so lucky.

> And really if I'm in a country with such invasive censoring I would prefer to use a VPN and avoid their prying eyes altogether.

Those countries block VPNs.

> Especially on IPv6 as there's no more need for SNI.

I can foresee CloudFlare offering a single-IPv6 shared endpoint for the sole purpose of making eSNI/ECH remain effective.

> At the same time I have to give up a lot of valuable statistics, troubleshooting data and validation about whether apps do as they claim.

Can't you get this information directly off of your endpoint device, whether or not the traffic is encrypted over the network?

> How would that work? I control my host file. Apps can not mess with it. Not on my computer and not on my phone.

I was thinking more about IoT appliances when I wrote that. For programs on your phone or computer, they can tell their TLS library to use whatever SNI you want, so even if they did hardcode the IP in the client program, SNI could still include the right hostname.

DoH itself is fine.

But to win against “surveillance” you need to make a smart, conscious decision about who you want to give your browsing history to.

For me, I’d rather my ISP sees my DNS, than all that data is sent to some American mega-corp keen to hoover up every last datapoint about me they can.

My ISP can for the most part look at HTTPS SNI field and see all the domains I access anyway. So switching to say, Google DoH, only means that now Google have that list as well as my ISP.

> some American mega-corp keen to hoover up every last datapoint about me they can

That's a really good description of both Comcast and Verizon. Not so much of Cloudflare though - they seem to actually care about people's privacy.

> My ISP can for the most part look at HTTPS SNI field and see all the domains I access anyway. So switching to say, Google DoH, only means that now Google have that list as well as my ISP.

Isn't this just an argument to hurry up and get eSNI/ECH rolled out everywhere?

Absolutely reason to promote ECH.

Sure Cloudflare are better than those other big US ISPs.

But for those of us in the EU, where such practices are illegal, we may want to think twice about giving our data to Cloudflare (who are subject to requests from US govt for instance.)

Even in the EU, couldn't there still be a privacy benefit? Set aside for a minute what's legal and illegal, and just consider what entities are capable and incapable of. By using a DoH provider (that sees what domains your client IP is looking up) other than your ISP (that knows that your client IP goes with your real-life identity), there's now no single entity capable of associating your real-life identity with which domains you've looked up.

What's DoH?

DNS over HTTPS. It is a new(ish) way to do lookups that deals with the insecurity of most DNS setups (where packets are often neither signed nor encrypted) by hitting a resolver over https. Often the application will hard code the resolvers it intends on using, which leads people to believe it is adtech as it allows apps to bypass blocking by PiHole and the like. It, like most tech, can be used or abused.

I think that’s the fundamental change it brings.

Once the system, or network admin would set the DNS servers up and everything on the system would use those. There is no reason why that paradigm couldn’t continue and move to DoH.

The other change is that applications are now bypassing the system-configured DNS and sending requests (and thus data about what you are looking at,) where the application wants. The “centralisation” issue also comes into this. But again, the change from a system-level to per-app setting could happen with regular old plaintext DNS.

DoH is part of the discussion in both cases, which clouds the debate.