Hacker News new | past | comments | ask | show | jobs | submit login

I think it's kind of strange that they are planning to enable DOH by default;

Your ISP can see all connections/ip addresses you connect to regardless of whether you use your ISP's DNS servers or not. So, in the end by using DOH in Firefox (= Cloudflare's DNS by default) you're just sharing your internet history with yet another third party.

This may be beneficial for some people where ISP's mess with DNS resolving, but for many other people it's actually a regression in privacy (especially if you live in a country that has higher privacy standards/laws than the US.)




An IP address is not always as telling as the DNS name of what you're connecting to. E.g. I may be connecting to a CDN like CloudFlare for content over HTTPS and my ISP will have no idea what I'm doing. But if I used the DNS name that refers to that content it would likely be more obvious in many cases.


ISPs can sniff the hostname from the HTTPS Server Name Indicator (SNI) headers because they are transmitted in clear.

The next step will be to deploy the TLS 1.3 Encrypted Server Name Indicator (ESNI)[1].

[1]: https://tools.ietf.org/html/draft-ietf-tls-esni-03


AMP, Facebook groups, WordPress.com sites, shared hosting, download sites etc.

Thinking this is a step backwards is pretty naive.


> This may be beneficial for some people where ISP's mess with DNS resolving

This includes most people in the UK.


> This includes most people.

Fixed that for you.

ISPs are a crapshoot the world over apart from very few countries. Almost all block or mess with torrent sites.

Off the back of a trip overseas, the "free wifi" is also a mess with DNS hijacking for no other reason than to feed you a cookie / limit access for essentially no good reason. Breaking that shitshow when chrome eventually follows suit will be a nice change for users.




Consider applying for YC's Spring batch! Applications are open till Feb 11.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: