Exfiltration has always been a problem. But it's not a good reason to make MITM possible.
Network control should not give control over endpoints any degree more than is necessary to deliver packets from point A to B. We can't trust them with more.
> [...] Now Edge doesn't let you.
That's blatantly false for normal endpoints though. Be it an AV or parental controls, an endpoint administration will have that ability to intercept.
If an endpoint doesn't let you do thay then to be honest, you've already lost the battle. Even simple HTTPS is not really filterable.
> Just like this article above does a good job explaining the lack of security in the cloud, we really could use a good article explaining how completely inane the idea of DoH is.
What is actually inane is the amount of implicit trust and control given to networks right now. Your network might be a nice wonderland, but many aren't.
"But it's not a good reason to make MITM possible" is disingenuous. Avoiding DoH doesn't make MITM possible, just as adding DoH doesn't save us from MITM. It does, though, save apps / Trojans from MITM, particularly when we're the ones who want to be in the middle :P
"That's blatantly false for normal endpoints though. Be it an AV or parental controls, an endpoint administration will have that ability to intercept."
Go ahead and tell me how to remove Edge, or how to have Windows open links in other browsers, without involving third party software that forces this, then tell me how "endpoint administration" is something we can expect of people who can't set their own DNS (or who have evil ISPs and can't set up any of a number of other ways to circumvent said evil ISPs).
You didn't address the real meat of the issue: Why is avoiding one issue - ISPs tracking DNS - worth all the bad things that come with it? The only explanation that makes sense to me is that it's worth it to companies that want to control as much as they can, like Cloudflare.
"What is actually inane is the amount of implicit trust and control given to networks right now." So instead of teaching people how and encouraging them to make their networks better, you'd rather divest some of that trust to companies like Cloudflare, and to every application / Trojan writer? Right - because the amount of data collection in software isn't a problem at all. We just need to trust them, and they'll do right by us.
You've made my point for me that you, and other apologists for DoH, haven't really thought things through, have you?
It's not just being out in public. Even when you're home, you're still at the mercy of your ISP.
> Go ahead and tell me how to remove Edge, or how to have Windows open links in other browsers
What does preventing use of Edge have to do with DoH?
> You didn't address the real meat of the issue: Why is avoiding one issue - ISPs tracking DNS - worth all the bad things that come with it?
You've yet to convincingly point out a single bad thing that actually comes from DoH.
> So instead of teaching people how and encouraging them to make their networks better, you'd rather divest some of that trust to companies like Cloudflare, and to every application / Trojan writer?
You can't make public Wi-Fi or your ISP's network better no matter how knowledgeable you are.
"What does preventing use of Edge have to do with DoH?" If you can't have basic control of programs on your own computer, tell me how you're going to control programs' use of DoH.
"You've yet to convincingly point out a single bad thing that actually comes from DoH." I've named many: we lose the ability to block ads, adware, Trojan CaC, spyware, et cetera. We lose the privacy of our own DNS lookups. Your suggestion seems disingenuous.
"You can't make public Wi-Fi or your ISP's network better no matter how knowledgeable you are." No - YOU can't or don't want to, because you don't understand networking. People who want to can, though, and this is what I'd encourage, instead of enshittifying the Internet by believing companies like Cloudflare when they tell us our ISPs suck and we should just trust them instead.
If your ISP dropped all packets on port 53 that contained a response for example.com, how would you circumvent that and learn its IP otherwise?
> "What does preventing use of Edge have to do with DoH?" If you can't have basic control of programs on your own computer, tell me how you're going to control programs' use of DoH.
Name a single program (other than unambiguous malware that nobody would ever be okay with being installed at all) that always uses DoH regardless of any configuration by a local administrator.
> "You've yet to convincingly point out a single bad thing that actually comes from DoH." I've named many: we lose the ability to block ads, adware, Trojan CaC, spyware, et cetera. We lose the privacy of our own DNS lookups. Your suggestion seems disingenuous.
There are DoH resolvers that do ad and malware blocking. Moving DNS from cleartext to an encrypted protocol is certainly not losing privacy.
> "You can't make public Wi-Fi or your ISP's network better no matter how knowledgeable you are." No - YOU can't or don't want to, because you don't understand networking. People who want to can, though, and this is what I'd encourage, instead of enshittifying the Internet by believing companies like Cloudflare when they tell us our ISPs suck and we should just trust them instead.
How are you proposing that people make other people's networks better? And are you saying that Americans' ISPs don't suck?
I'm fairly certain you're trolling. Do you do this with friends and family, too? Just so you know, people aren't agreeing with you just because they decide to stop engaging with you.
I like the fact that your attempts to derail are all here, plain as day, for anyone to see, because people knowing that DoH is a big scam to grab private data about them is important.
People rent their networks from one, maybe two area options. The consumer networks want to completely control router hardware these days and these days charge extra rental fees for owned hardware instead of rented hardware. (It's fascinating that they can legally get away with that.) Some of the biggest consumer networks have already proven they are happy to use this hardware control to inject additional ads into customers' networks for a paltry amount of additional revenue.
You are correct that people should have networks that they own and trust at home. You may have missed that they don't and consumers have lost that battle. (You may also be underestimating just how much time people spend on devices "out in public". The mobile device has become the most common device for a lot of users. For some users the only device.)
> every application / Trojan writer
They've always had that power.
Applications have never been forced to use OS/network-configured DNS. DNS is an absurdly simple protocol that doesn't even have encryption by default. OS firewalls might block sockets to DNS ports by default, but there are ways to tunnel over other ports plus tools like UPnP given enough user trust.
DoH is a standardized port tunnel but that doesn't mean that unstandardized ones never existed before. Trojans/viruses have been doing weird things to avoid DNS for decades. DoH doesn't make them that much easier.
DoH isn't great and it is a shame that for privacy and control it's a big ugly trade-off/compromise from ideals. It's useful for some people. There are definitely unanswered questions in terms of which big corporation truly cares about privacy. I've seen my monopolist consumer ISP inject ads against my wishes and do change the DNS on my home (owned) routers (that I pay extra for each month despite owning my own hardware because of owning my own hardware). I don't always know what to think about Cloudflare's massive PR engine of how much they claim to value privacy, but so far I've never seen them inject an ad where one doesn't belong nor have I seen ad revenue make a splash in their quarterly reports. They don't seem to be an ad company. (Yet?)
Trust is hard and we all have different threat models. I don't blame you for distrusting Cloudflare. I have direct evidence for distrusting my current ISP and indirect evidence for distrusting most consumer ISPs I've encountered, despite being paying customers. There's no free lunch and there's no right answer, just a lot of "least wrong" answers. DoH isn't the right answer objectively. But DoH can be a "least wrong" for some users. Just as trying to be the MITM in networks you own is quite wrong from a security standpoint (once you've got one MITM it becomes harder to trust that there isn't a second one) but may be the "least wrong" answer for some users including maybe you.
Moving DNS from an ISP, who we pay and with whom we have legal contracts, to a company that does things, supposedly, for altruistic reasons, with whom we do NOT have contracts, doesn't fix anything. It makes things worse. The solution is to remove DNS from your ISP and run it yourself, or use a not-for-profit that isn't trying to become a monopoly, that isn't in a position to have its data syphoned off by the NSA, that doesn't knowingly and willingly host spammers, phishers and scammers.
How about we don't trust ISPs AND we don't trust Cloudflare?
BTW - I have to flatly disagree with your suggestion that, "once you've got one MITM it becomes harder to trust that there isn't a second one". That's ridiculous. I can check and verify things to a much greater degree by running my own network. Also, I never said anything about MITM my own network. I want to run my own DNS and block DNS to the rest of the Internet. That's not MITM.
The least wrong thing is to not replace something that MIGHT be shitty with something that MIGHT also be shitty, but might also open you to new problems and security issues. The idea that it MIGHT be less shitty isn't a good enough reason for DoH.
This doesn't work because if you run your own recursive DNS server, it will make insecure requests to all of the authoritative servers, and so your ISP can hijack them all. And DNSSEC will keep you from getting sent to the wrong domain, but won't help you figure out the right domain.
Your private recursive DNS server, of course, has to send requests to the rest of the internet; you don't want to block those. They don't have to be plaintext, unless the authoritative server in question only talks plaintext.
The point is that these requests don't go to my ISP's DNS servers.
And for the other people who're making up unrealistic scenarios such as the ISP trying to MITM all DNS, not just queries they answer, there are many forms of tunneling that can be used such as VPNs. It's still easier to do one solution for the whole network than individual solutions for each client (or each application, for DoH).
That's not the LAN.
> The consumer networks want to completely control router hardware these days and these days charge extra rental fees for owned hardware instead of rented hardware. (It's fascinating that they can legally get away with that.)
You can put your own router behind theirs. It's ridiculous for them to make you do that but nothing actually stops you.
> You may also be underestimating just how much time people spend on devices "out in public".
For which anyone can use a VPN.
> Applications have never been forced to use OS/network-configured DNS. DNS is an absurdly simple protocol that doesn't even have encryption by default. OS firewalls might block sockets to DNS ports by default, but there are ways to tunnel over other ports plus tools like UPnP given enough user trust.
Your local network can intercept ordinary DNS queries to any server and redirect them to your own. To work around this, a piece of malware would have to contact some custom server on a different port to do a name lookup -- but where does it look up that server's IP address? Hard-coding the IP address allows the malware's lookup server to be blocked.
But if centralized DoH servers become too popular to block because blocking them breaks too many legitimate applications, now the malware can use them and the user can't block them.
> I don't always know what to think about Cloudflare's massive PR engine of how much they claim to value privacy, but so far I've never seen them inject an ad where one doesn't belong nor have I seen ad revenue make a splash in their quarterly reports. They don't seem to be an ad company.
The question is, what are they doing with the data they collect?
> There's no free lunch and there's no right answer, just a lot of "least wrong" answers.
There is already a "least wrong" answer: Use a VPN you trust and use your VPN's DNS or run your own. VPNs have plenty of competition, and you can set up your own on any hosting provider, which also have plenty of competition.
This is basically the same thing as having Cloudflare do it over TLS, except that it's not centralized and remains in the control of the user, so is better.
It doesn't matter much that your LAN itself is trustworthy if the only way out of it isn't.
> You can put your own router behind theirs. It's ridiculous for them to make you do that but nothing actually stops you.
Yes, you can do that, but it doesn't do anything to help with the problem that DoH solves.
> For which anyone can use a VPN.
I want to live in a world in which you can have privacy without having to be on a VPN 24/7.
> To work around this, a piece of malware would have to contact some custom server on a different port to do a name lookup -- but where does it look up that server's IP address? Hard-coding the IP address allows the malware's lookup server to be blocked.
Couldn't it host a file with the IP on a service like Dropbox or GitHub Pages? People aren't likely to block them at the firewall.
> But if centralized DoH servers become too popular to block because blocking them breaks too many legitimate applications, now the malware can use them and the user can't block them.
Isn't this basically "privacy for computer programs is bad because malware benefits from it", which is wrong for the same reason that "privacy for people is bad because criminals benefit from it"?
> The question is, what are they doing with the data they collect?
What's your ISP doing with all of the data they collect from your insecure DNS queries? And if you're concerned about Cloudflare in particular, then just use some other DoH provider.
> There is already a "least wrong" answer: Use a VPN you trust and use your VPN's DNS or run your own. VPNs have plenty of competition, and you can set up your own on any hosting provider, which also have plenty of competition.
> This is basically the same thing as having Cloudflare do it over TLS, except that it's not centralized and remains in the control of the user, so is better.
Cloudflare doesn't have a monopoly on DoH. There's plenty of competition between providers for it too: https://github.com/curl/curl/wiki/DNS-over-HTTPS#publicly-av...
> Yes, you can do that, but it doesn't do anything to help with the problem that DoH solves.
Well sure it is, because if you know the ISP isn't trustworthy, then you can have your own local DNS server encrypt the DNS traffic to the upstream DNS server of your choosing.
> I want to live in a world in which you can have privacy without having to be on a VPN 24/7.
Something has to encrypt the DNS queries. Why is TLS/HTTPS any better than a VPN?
> Couldn't it host a file with the IP on a service like Dropbox or GitHub Pages? People aren't likely to block them at the firewall.
Those services will take down the page when it's hosting malware.
> Isn't this basically "privacy for computer programs is bad because malware benefits from it", which is wrong for the same reason that "privacy for people is bad because criminals benefit from it"?
The question is, privacy from who? Privacy from governments and corporations is good. Privacy from the device owner is bad.
> What's your ISP doing with all of the data they collect from your insecure DNS queries?
Nothing, when you configure your LAN or device to encrypt them.
> And if you're concerned about Cloudflare in particular, then just use some other DoH provider.
Hard-coding Cloudflare in multiple applications on multiple devices makes it arduous to do this, which is the entire criticism.
Isn't DoH exactly the way to "encrypt the DNS traffic"?
> Something has to encrypt the DNS queries. Why is TLS/HTTPS any better than a VPN?
Because with a VPN, you need a VPN endpoint that costs somebody money to run. With TLS/HTTPS, there are no extra systems in the mix.
> Those services will take down the page when it's hosting malware.
Don't domains hosting malware get seized and taken down too?
> The question is, privacy from who? Privacy from governments and corporations is good. Privacy from the device owner is bad.
I 100% agree with this. DoH only provides the former, though.
> Nothing, when you configure your LAN or device to encrypt them.
Again, isn't DoH exactly the way to encrypt them?
> Hard-coding Cloudflare in multiple applications on multiple devices makes it arduous to do this, which is the entire criticism.
Other than Firefox, what applications currently have Cloudflare hardcoded as their default DoH provider?
There are any number of ways to do it, the most relevant factor being that the user can choose which DNS server they want to trust, not which protocol you use.
> Because with a VPN, you need a VPN endpoint that costs somebody money to run. With TLS/HTTPS, there are no extra systems in the mix.
Someone is paying to run the DoH servers. You might also ask why they're doing so, for free, when that costs money.
> Don't domains hosting malware get seized and taken down too?
Malware often uses domains on foreign registries that are legally complicated to seize, so it only happens to the most serious offenders and can take a long time.
> I 100% agree with this. DoH only provides the former, though.
It doesn't. If legitimate applications are using DoH to a server outside of the device owner's control without providing an expedient way to make them all stop, that server can't be blocked without breaking too many things, and then malware running on the owner's device can use it without being blocked or monitored.
> Other than Firefox, what applications currently have Cloudflare hardcoded as their default DoH provider?
When someone is setting a bad precedent it's reasonable to be concerned about what happens when others follow suit.
My point is that even when you are the owner of a network, you shouldn't have control of traffic on it between endpoints that you don't own either of.
> what happens when applications and Trojans start doing DoH lookups, skipping our system's configured DNS?
The Trojans could just hardcode the IP instead, so blocking DoH wouldn't magically guarantee you could catch them with DNS.
> So yes, your statement about control residing with the endpoints is correct, but DoH removes control, doesn't add it.
Which programs specifically don't let the user disable DoH? If none, then how does its presence remove control?
> For the case of "can't, because even if you change the setting, $evil_isp will hijack the queries anyway", that's FUD. There are many, many better ways to deal with evil ISPs.
Such as? How would you solve the specific problem of an evil ISP hijacking DNS?
> centralized entity like Cloudflare (who, by every right, are precisely in a position to be an evil ISP)
ISPs tend to have regional monopolies, but DoH servers don't. If Cloudflare becomes evil, you can just switch to some other DoH server.
> If you care to learn, consider things without DoH: you can edit your hosts file. You can choose your DNS servers. You can run a local recursive resolving DNS server. You can block ads and advertisingware using your DNS server and/or something like Pihole. You can block all DNS queries to the outside world on your network so that they all go through your own resolvers.
All but the last thing is still possible with DoH, and it's a good thing that it breaks the last thing, since doing that would affect other people's endpoints too.
> Next, consider a world where DoH is commonplace: you have no control over DNS lookups on your own system.
How do you figure? DoH is still configurable.
> Your only choice is to not run binaries that might do things you don't like.
I already don't.
> Want to block ads or adware, or adult sites, or conspiracy sites, or any of a number of other things on the Windows system that your child uses? Now Edge doesn't let you. Want to block the Trojans and phishing sites that Google serves through their ad network? Chrome doesn't let you.
Those are still easy: just point at a DoH server that does those blocks, the same way you'd point at an insecure DNS server that does them today.
> You can block common DoH servers, until Cloudflare puts them on the same address as the endpoints for their millions of hosting customers. But what happens when apps do DoH lookups using random Amazon AWS or Google Cloud servers? How do you block them? Do you block ALL https?
It's a good thing that network-level blocking of DoH is hard.
> You see, you'd give up freedom, and have everyone else give up their freedom, for some abstract "safety" from ISPs that use your DNS data. You'd apply a shitty fix for 1% of the people to 100% of the people, rather than create tools for the 1% to circumvent their evil ISPs.
What freedom am I giving up? What harm does DoH do to regular people?
You're suggesting that applications and Trojans have the "right" to be free from my control, on my network, on my machines. Wow. What a take!
You're saying that all programs, Trojans included, will allow us to configure DoH. Again, a pretty crazy take, and completely, unambiguously wrong.
"What freedom am I giving up? What harm does DoH do to regular people?"
You clearly don't care about freedom, since you actively want to send your DNS to some third party. But you'd have me give up my freedom to control what goes on on my network because some ISPs track DNS, and instead of addressing that, you're for the idea of normalizing a protocol that removes my freedom and puts it in the hands of application / Trojan makers.
It harms regular people because it exfiltrates private information that they don't know about. Someone installs Firefox (very common) and doesn't know about DoH (also very common). Now their DNS lookups are all going to Cloudflare. We have no reason to trust Cloudflare (we do have plenty of reasons to not trust them, though).
But the point is that these regular people DON'T KNOW and haven't agreed to have their DNS data shared with Cloudflare. This has all sorts of negative implications that I'm sure you can't see.
Should your ISP be allowed to censor what you can see on the Internet? Remember they own the network that all of your traffic flows through.
> You're suggesting that applications and Trojans have the "right" to be free from my control, on my network, on my machines. Wow. What a take!
I'm not arguing that anything on your machines should be free from your control. I'm specifically saying that traffic passing through your network but not from or to one of your machines should be free from your control.
> You're saying that all programs, Trojans included, will allow us to configure DoH. Again, a pretty crazy take, and completely, unambiguously wrong.
I meant all legitimate programs do. Trojans obviously do whatever they want, and that was the case even before DoH existed.
> You clearly don't care about freedom, since you actively want to send your DNS to some third party.
You're always sending your DNS requests to some third parties. The only question is which.
> But you'd have me give up my freedom to control what goes on on my network because some ISPs track DNS, and instead of addressing that, you're for the idea of normalizing a protocol that removes my freedom and puts it in the hands of application / Trojan makers.
I disagree that "my freedom to control what goes on on my network" is a freedom that should be protected. For an extreme example, consider that someone complaining "they took away my freedom to own slaves" is obviously in the wrong. As I've said before, you should only have any control of traffic for which one of the endpoints is yours.
> It harms regular people because it exfiltrates private information that they don't know about. Someone installs Firefox (very common) and doesn't know about DoH (also very common). Now their DNS lookups are all going to Cloudflare. We have no reason to trust Cloudflare (we do have plenty of reasons to not trust them, though).
Most American ISPs are way less trustworthy than Cloudflare, and that's where almost everyone's DNS would be going otherwise.
> But the point is that these regular people DON'T KNOW and haven't agreed to have their DNS data shared with Cloudflare. This has all sorts of negative implications that I'm sure you can't see.
Do regular people even know what DNS is? Did they agree that their ISP could see their insecure DNS?
My network is not my ISP's network. My ISP can't censor me. I advocate for people to have control over their own networks and to take control from their ISPs.
I'm not sure why you want to conflate my network with what my ISP provides, but anyone thinking that clearly doesn't understand how things work (or is just trying to be a troll).
Likewise, "all legitimate" programs will allow DoH configuration? Really? Have you TRIED to do simple, common sense things in Windows like use another browser? Obviously this suggestion is ridiculous.
Please tell me how traffic would pass through my network that isn't from or to one of my machines. Guests? That's a bullshit reason to suggest I shouldn't have control over my network.
"You're always sending your DNS requests to some third parties." No, I'm not. I run my own DNSSEC recursive resolvers.
At this point, I have to believe you're a troll.
"consider that someone complaining "they took away my freedom to own slaves"" is also trolling. If you think packets and programs are equivalent to humans, you're... broken. But at this point I really have to wonder what you expect to get out of trolling. You're just making yourself look dumb at this point.
Right, but traffic from your computers passes through both.
> My ISP can't censor me.
Either you and your ISP can both do network-level censorship, or neither can.
> I'm not sure why you want to conflate my network with what my ISP provides, but anyone thinking that clearly doesn't understand how things work (or is just trying to be a troll).
Because your endpoints' traffic goes through both, and they both have the same ability to censor.
> Likewise, "all legitimate" programs will allow DoH configuration? Really? Have you TRIED to do simple, common sense things in Windows like use another browser? Obviously this suggestion is ridiculous.
Again, what does being able to change the default browser on Windows have to do with whether you can configure DoH?
> Please tell me how traffic would pass through my network that isn't from or to one of my machines. Guests? That's a bullshit reason to suggest I shouldn't have control over my network.
Guest computers on your network are in the exact same position as your router on your ISP's network.
> "You're always sending your DNS requests to some third parties." No, I'm not. I run my own DNSSEC recursive resolvers.
Even if you don't count the servers your recursive resolver talks to as third parties, your ISP can still see all of your recursive resolver's traffic, and just drop the responses for domains it doesn't want you visiting, even with DNSSEC.
> "consider that someone complaining "they took away my freedom to own slaves"" is also trolling. If you think packets and programs are equivalent to humans, you're... broken.
I don't think they're equivalent at all. My point was just that just because you can't do a certain thing anymore doesn't necessarily mean freedom has been lost.
I hadn't considered before that DoH effectively takes an avenue away from people who want to block advertising and trackers. This makes it a fiercely unpleasant thing working against users.
Personally, I'm switching to DNS over TLS instead.
DoT is obviously immune to that, as is DoH, but at least for DoT, that seemes to never have become popular, likely due to the fear of aggressive firewalls not allowing that port.
> DoT is obviously immune to that, as is DoH, but at least for DoT, that seemes to never have become popular, likely due to the fear of aggressive firewalls not allowing that port.
What happens when your junky hostile devices start doing name resolution over a protocol that doesn't look like DNS? Like, say, HTTPS!
It takes control away from the owner of networks, even when we're the owner of those networks. Should DoH start to become more common, blocking it will become a Sisyphean task.
It takes control away from the owner of endpoints. Sure, you can go and change the settings in Firefox to turn off DoH after they've turned it on without asking and without telling us, but what happens when applications and Trojans start doing DoH lookups, skipping our system's configured DNS? So yes, your statement about control residing with the endpoints is correct, but DoH removes control, doesn't add it.
For the case of "can't, because even if you change the setting, $evil_isp will hijack the queries anyway", that's FUD. There are many, many better ways to deal with evil ISPs.
Encouraging the world to send all of their DNS lookups to a centralized entity like Cloudflare (who, by every right, are precisely in a position to be an evil ISP) is such an incredibly shortsighted idea that I have to think that you haven't thought out the implications of a world where DoH is dominant.
If you care to learn, consider things without DoH: you can edit your hosts file. You can choose your DNS servers. You can run a local recursive resolving DNS server. You can block ads and advertisingware using your DNS server and/or something like Pihole. You can block all DNS queries to the outside world on your network so that they all go through your own resolvers.
Next, consider a world where DoH is commonplace: you have no control over DNS lookups on your own system. Your only choice is to not run binaries that might do things you don't like. Want to block ads or adware, or adult sites, or conspiracy sites, or any of a number of other things on the Windows system that your child uses? Now Edge doesn't let you. Want to block the Trojans and phishing sites that Google serves through their ad network? Chrome doesn't let you. "Just don't run binaries that do that" is one heck of an ask for people who don't know how to set their own DNS or who have an evil ISP.
You can block common DoH servers, until Cloudflare puts them on the same address as the endpoints for their millions of hosting customers. But what happens when apps do DoH lookups using random Amazon AWS or Google Cloud servers? How do you block them? Do you block ALL https?
You see, you'd give up freedom, and have everyone else give up their freedom, for some abstract "safety" from ISPs that use your DNS data. You'd apply a shitty fix for 1% of the people to 100% of the people, rather than create tools for the 1% to circumvent their evil ISPs.
The fact that you'd choose this makes me think that either you want big, evil companies like Cloudflare to win, or you really don't understand the issues.
Just like this article above does a good job explaining the lack of security in the cloud, we really could use a good article explaining how completely inane the idea of DoH is.