Hacker News Reader

Comment by floatingatoll | Hacker News Reader

DNS is plaintext, like HTTP, so running your own resolves does nothing to protect your internet provider from selling your domains resolved list - in aggregate or in specific - to other companies for revenue.

There are three well-known trusted public DNS resolvers, run by Cloudflare, Verizon, and Google.

Which of those three would you encrypt your DNS traffic to, if those were the only three options available other than plaintext for all to see?

View on HN

DNS does not need to be plaintext and DoH is not the only alternative. It's the alternative that the advertising engines and CDNs prefer because it extends control. The privacy of DNS argument is a major red herring.

DNSCrypt (or DNS over TLS or DTLS) is a wonderful alternative that works in-band and works with DNSSEC.

People are also ignoring the consequences of the switch from UDP to TCP.

I remember that DNS over HTTPS just landed recently in the generally-available Firefox 62?

I think the specific question is: Why prefer `DNS over HTTPS` over e.g. `DNS over TLS`. The relevant matter is that DNS requests are encrypted. How exactly it is encrypted should not matter.

AFAIK it doesn't matter. DNS over TLS would work fine too (though I'm not sure if Firefox supports it). The important thing is that you're not using plaintext DNS, as that would defeat the purpose of using ESNI in the first place.

What about applications that communicate over protocols other than HTTP(S)?

Reply on news.ycombinator.com