Knowing that I'm watching YouTube is one thing, knowing what YouTube video I'm watching is a completely different problem.

Edit also: even with DNS over HTTPS, a lot of the Internet uses SNI for TLS, so anyone snooping can anyway see what hostname you're visiting (not to mention, IPs are not significantly more private than host names, and those will always be public unless you're using ToR or something similar).

Comcast injects data into plain http pages, altering them when they see fit (they put in a datacap warning into the text of the page).

If Comcast is doing something wrong, why does everyone else need to do something about it? If Comcast stops routing packets on port 433, should everyone else stop using it as well?

ISPs are evil and untrusted. That’s just a fact. The solution is to not allow them to see or modify anything.

Other IT corporations are also evil and untrusted.

But no one cares if they can look into all your mails and documents (Microsoft, Google), track you all over the web, see where you are going, which flight you are taking,...

The important is that ISPs are evil and untrusted. facepalm

> But no one cares if they can look into all your mails and documents (Microsoft, Google), track you all over the web, see where you are going, which flight you are taking,...

I don't think I go a single day without reading posts complaining about exactly that, so obviously people do care.

ISPs are the most blatantly scummy of the lot. They log everything, usually by government requirements, sell it to anyone, give it to the government without a warrant, inject adverts and js in to unprotected requests, and all kinds of malicious things.

They are easily eliminated from the picture. One less party with access to your data the better. There is really _no_ good argument for not having HTTPS on any site unless its some very rare case like an intranet site.

Some places the ISP's are monopolies, or duopolies. Even with current tech giants you have many options.

This is like saying we shouldn't use encryption just because there are bad guys stealing our data... just because hackers do something wrong, why does everyone else need to do something about it?

We have to do a lot of things because bad guys do bad things. What is the alternative? Pretend they don't exist?

They would know the IP address and host name from SNI, but they wouldn't know which articles on the blog I read.

And if you're using TLS ECH, then they wouldn't even know the host name.

The website operator has to use it, too. Many HTTP servers still do not support TLS1.3 let alone ECH (Draft 13). ECH is still experimental. Cloudflare disabled their ESNI trial a while back (ESNI worked great for me outside the browser), so unless they have now got ECH working (I still have not seen any announcement), currently there are even fewer sites offering encrypted SNI. You could probably count them on one hand. And Firefox (nightly), Chromium (105+) and Brave (nightly) are probably the only browsers that would support ECH and it is not enabled by default. I would be pleased to learn I am wrong here, because I would love to again start using sites that do not return requested pages unless a servername is sent.

HTTPs not completely blinding traffic analyzer doesn’t make the partial blinding useless.

DNS over HTTPS is default on some browsers now. Firefox does it iirc.

> Unless you use DNS over HTTPS

It really isn't hard to set up an unbound resolver.

DoH is bad use DoT instead.

This couldn't be further from the truth. DoT is easy to block, so anyone who wants to censor or surveil you will just do so. You should always use DoH instead, since it's way more resistant to blocking.

Can't wait til google owns your DNS and you can't do shit about it

How does DoH make DNS any more centralized than DoT does?

When Google embed their DNS and their certificate into every Google product you have to use, you can't effectively block it.

If your goal isn't to censor or surveil other people, then why do you need to block Google's DNS rather than just not using it yourself?

Unfortunately, people are now often fighting with their own devices for control over which 3rd party services they access. This sometimes means that you have reasons to MITM or block traffic your own devices generate if you want to control aspects of who you actually send data to, or what data you actually send.

Not just block. I run split-horizon DNS at home for a few of my services. Without being able to control the DNS for devices on my LAN, they can't use those services.

Now you might argue that's a bit silly, but it is a use-case.

Chromecast will use Google DNS and there is nothing you can do about it on the device. Guarantee this will happen to Chrome eventually.