Hacker News Reader

Comment by tptacek | Hacker News Reader

Google's design doesn't ask you to trust Google more than you already do if you use Chrome. It doesn't default you to Google's DNS servers, will honor your current nameservers, and will upgrade you to DoH at any of those servers who support it. I'm honestly not sure what more you could ask for from Google on this particular issue.

View on HN

Yes, Google used the right approach here. They honor your DNS settings, and upgrade it if it's available. Firefox, on the other hand, plans to force all of their users to trust Cloudflare by default.. and most users won't even know they made that change.

[deleted]

The article itself says this.

The article?

>Firefox, on the other hand, plans to force all of their users to trust Cloudflare by default.. and most users won't even know they made that change.

Mozilla has explicitly stated on their blog that they don't intend to make any change to a user's DNS settings without getting the user's consent.

>When DoH is enabled, users will be notified and given the opportunity to opt out

https://blog.mozilla.org/futurereleases/2019/09/06/whats-nex...

This is something I really think should be opt-in, even if it's via a notification toast.

The problem is it’s just a banner with “ok” at the top, which clearly says “we’ve increased your privacy by (insert technical jumbo jumbo here).”

As Bert Hubert pointed out, to most users it ends up looking like this:

https://twitter.com/powerdns_bert/status/1123666707279695874...

So? It's clearly beneficial for the average user.

As long as the people who don't want it can easily opt out, I'm not seeing the problem.

So it's more like HSTS for DNS? Auto-switch to encryption if our chosen target supports encryption?

Because that seems MUCH more sensible than a lot of the stories/comments about this recently make it seem.

No. The HSTS security model is per-site; the DoH model covers all sites. If you get DoH working anywhere, it's working for you everywhere.

Yes, as Google plan you implement it, which is fine.

Most of the hulaboo is about Mozilla who are moving customers DNS queries to Cloudflare en mass, regardless of what DNS server they have already configured.

The UI bug tracker is private so we don't know if there might also be a "select DNS resolver" option and/or a checkbox for "encrypt DNS" in Settings.

> Google's design doesn't ask you to trust Google more than you already do if you use Chrome.

So in other words trust them with everything.

That's true, but Google has made no commitment to keep it that way.

I also don’t use chrome :p

Google has promoted its own DNS service over others in the past, including for non-chrome users, and presumably would do the same when DoH (in whatever form) is the norm.

I was simply saying we already know that ISPs misbehave, but presuming that Google wouldn’t is not necessarily a clear cut decision.

Reply on news.ycombinator.com