undefined | Better HN

0 pointszzzcpan6y ago0 comments

Your ISP doesn't really need DNS traffic to know things about you, IP addresses alone leak a lot of information, add to that SNI, response sizes, active probing, clear text traffic, etc. and you should realize that the only thing DoH does is letting one extra party to know what you are doing in addition to your ISP. DoH is net negative for privacy. You need at least a VPN to get to net positive, so that your ISP can't get that much data.

0 comments

wbl6y ago

How is DoH a net negative? ESNI is coming soon. Also ISPs do all sorts of other badness with DNS like NXDOMAIN interception.

zzzcpanOP6y ago

If you can't trust your ISP, leaking all of your DNS traffic to another party still doesn't let you trust your ISP, but now you have to trust that other party too, hence net negative. To avoid trusting your ISP you need at least a VPN.

judge20206y ago

ISPs already don't have a good track record, so I would argue them NXDOMAIN advertising (like Spectrum does by redirecting you to a yahoo search page) won't make someone unsubscribe from their services. But if a service like 1^4, that specifically states they don't track you, lies about it, then that would be a huge issue for all of the customers that pay for the company's other products.

wbl6y ago

Now that I use another revolver the NXDOMAIN problem is fixed.

sroussey6y ago

SNI is getting encrypted soon too

zzzcpanOP6y ago

Within next 10 years maybe. It doesn't solve anything though and is plenty of time for DPI vendors to pursue other snooping techniques.

the84726y ago

Only if you go through big, centralized cloud providers fronting the traffic. You're just replacing your ISP with the the CDN.

Spivak6y ago

The person who wrote your application stood it up using that CDN though. There are two parties we're concerned about: you and the entity you're communicating with.

You trust your device and the entity, and the entity trusts the infrastructure and services they're using. Everything else is the enemy. So moving the barrier to a CDN which the entity trusts is actually an improvement over intermediate ISPs which neither of you trust.

1 more reply

j / k navigate · click thread line to collapse

0 pointszzzcpan6y ago0 comments

0 comments

wbl6y ago

How is DoH a net negative? ESNI is coming soon. Also ISPs do all sorts of other badness with DNS like NXDOMAIN interception.

zzzcpanOP6y ago

judge20206y ago

wbl6y ago

Now that I use another revolver the NXDOMAIN problem is fixed.

sroussey6y ago

SNI is getting encrypted soon too

zzzcpanOP6y ago

Within next 10 years maybe. It doesn't solve anything though and is plenty of time for DPI vendors to pursue other snooping techniques.

the84726y ago

Only if you go through big, centralized cloud providers fronting the traffic. You're just replacing your ISP with the the CDN.

Spivak6y ago

The person who wrote your application stood it up using that CDN though. There are two parties we're concerned about: you and the entity you're communicating with.

1 more reply

j / k navigate · click thread line to collapse