TE
TechEcho
Home24h TopNewestBestAskShowJobs
GitHubTwitter
Home

TechEcho

A tech news platform built with Next.js, providing global tech news and discussions.

GitHubTwitter

Home

HomeNewestBestAskShowJobs

Resources

HackerNews APIOriginal HackerNewsNext.js

© 2025 TechEcho. All rights reserved.

Addressing some misconceptions about our plans for improving the security of DNS

24 pointsby migueldemouraover 5 years ago

4 comments

danShumwayover 5 years ago
The claim that ISPs are concerned about Google DNS being anti-competitive or too powerful really rubs me the wrong way.<p>Google has offered DNS services for years, and ISPs didn&#x27;t care. The &#x27;problem&#x27; isn&#x27;t that Google is offering its own DNS -- it&#x27;s that now those queries are encrypted and ISPs can&#x27;t read them.<p>The pushback on this has been really eye opening for me. I knew that obviously ISPs were reading DNS queries, but I think the amount of effort ISPs are putting into stopping what is a fairly basic security measure means that I under-appreciated just how much they care about that data. Apparently unencrypted DNS is a bigger threat than I realized.<p>If ISPs aren&#x27;t monetizing this stuff now, they&#x27;re probably planning to.
评论 #21382123 未加载
WarOnPrivacyover 5 years ago
My issue is with browser based DoH is when it defaults to ON.<p>That was Mozilla&#x27;s original plan for Firefox. That&#x27;s a problem for those of us who use DNS to reduce the risk from malware, advertising and other invasive technologies. DoH effectively circumvents those protections.<p>After a crapstorm, Mozilla walked that back and made DoH a user choice. Even better, Firefox queries the use-application-dns.net zone - which (added to a local DNS server) tells Firefox to turn off DoH. This is super helpful for those who use DNS to safeguard networks.<p>Now, better than DoH and a more elegant solution overall is DNS over TLS (RFC7858), which is simply encrypted DNS. It&#x27;s the natural next step. Frankly, we all should have been using it for years. It&#x27;s just beginning to gain support, tho.<p>As it stands now only a handful of public DNS resolvers support it (Quad9, Cloudflare, Google, someone in Germany). None of the root servers do. Nor do ISPs&#x27;.<p>My approach is to run a local DNS resolver (Unbound) which forwards it&#x27;s queries over TLS. Local users&#x27; queries are plain text but the forwarded (public network) queries are encrypted.
jwilkover 5 years ago
Archived copy, which can be read without JS enabled:<p><a href="https:&#x2F;&#x2F;archive.is&#x2F;5GypR" rel="nofollow">https:&#x2F;&#x2F;archive.is&#x2F;5GypR</a>
ahbybover 5 years ago
&gt;The first claim is that Google is going to redirect user DNS traffic to Google&#x27;s own DNS or another DoH-compliant DNS provider. That is incorrect. Because we believe in user choice and user control, we have no plans to force users to change their DNS provider. [...] We’re simply enabling support in Chrome for secure DoH connections if a user’s DNS provider of choice offers it.<p>Chrome will use the DoH frontend of the DNS server of the computer it&#x27;s running on, respecting the user&#x27;s choice. Instead, the Mozilla Corporation has decided that Firefox will route all DNS requests through CloudFlare regardless of user settings.
评论 #21381738 未加载