> Are things like DNS sinkholes and domain blacklisting still possible with DoH?
they aren't, which is part of the reason DoH is implemented in the first place.
they aren't, which is part of the reason DoH is implemented in the first place.
What I think will really happen is the same thing as everything else. They'll use tech to take away features / abilities we have right now and then rent it back to us as a subscription.
"OpenDNS is now part of Cisco"
Add it up.
And somehow you ad this up to making it impossible not to see ads and locked down computers.
How?
I doubt that chrome will allow one to disable DoH but at least firefox does for now.
This is one step in the boiling-the-frog process.
The entire point is to make DNS secure. For every 1 person who uses DNS to block ads, there are many thousands who just use their ISP's DNS servers, and thus remain subject to surveillance, ads, redirects, and other malice. You can't possibly believe in good faith that the entire point or even the primary point of DoH is to hurt the small fraction of people who use DNS to block ads, rather than to protect the much larger set of people who are subject to the whims and financial interests of their ISP.
I'm not disputing that Google ads and tracking, like all other ads and tracking, should be blocked. Run a browser you trust, and run an adblocker. But the widespread use of unencrypted DNS is a problem that needs fixing. And DoH provides the most viable solution for that problem, by running DNS over an ordinary HTTPS connection.
AMP.
Not taking a side on this thread, but just want to point out that Comcast literally has a patent describing just such a mechanism. [0]
> including weather, emergency broadcast, and police stations
These seem like reasonable uses of this technology. My ISP has tried to inject a copyright violation notice before. (This was hilarious, actually, because it went to a guest in my house's browser, not one of mine, and I almost didn't hear about it at all, because they only sent it that way once... and I had to ask them to send me an actual letter about it with the details, which would've been the straightforward way to tell me in the first place...) Irritations with copyright holders aside, that was a notification of a mark against my account, which is arguably information that needed to be delivered to me.
Meanwhile, Google is preserving their ability to send phishing sites unimpeded.
the entire point is to make it impossible to modify DNS requests at the network level. this has a lot more serious consequences than just blocking ads. especially for the parties involved with this, none of whom are advertising companies. phishing and data security are actual big issues with financial implications that companies want to prevent. just because blocking ads is the consequence that will most immediately impact you personally, doesn't make it the whole point.
this accusation is especially rich on an article about mozilla, one of the few companies fighting to make sure that advertisers don't control the application level.
These are issues exacerbated by DoH, not fixed by it. DoH assists in the circumvention of security and monitoring. We block ads because they're security problems.
Endpoint-level control is no longer possible, since ad companies are skipping the OS network stack and bringing their own. Application-level control is less efficient, and more difficult, particularly when the applications are designed by the same ad companies trying to circumvent DNS control as well. (See Manifest V3.)
yes, that's the point. I understand you want to monitor traffic within your network, but forcing clients to use insecure protocols to enable network-wide monitoring means you're enabling network-wide monitoring. and that's the opposite of security.
remember that your browser traffic crosses multiple networks before it hits the website you're trying to connect to. forcing that traffic to be observable and modifiable in your own network means it will also be observable and modifiable by your ISP.
This is factually false. And represents a key part of the problem in the rollout browser vendors have designed: Browsers should not be implementing their own network stacks. It's the wrong place to begin encrypting network requests, but for the "if you're a hammer" crowd, everything looks like a nail.
If the browser respected the OS stack, the OS could decide to encrypt requests, but it isn't given the choice. If the browser respected the network it's in, the network could decide to encrypt requests at the border, but it isn't given the choice.
Browser vendors decided the right choice was to build a product purpose-built to bypass nearly every good method of restricting malware, phishing, and, oh of course, ads. Google and their ilk would happily install ransomware on every PC on the planet if it would guarantee Google Ads couldn't be blocked, and that ISPs couldn't compete with their well-established surveillance tools.
The latter is why any suggestion DoH is to protect user privacy is silly... the user's privacy was compromised by the browser application pre-encryption. They just need you to believe the ISPs are somehow a bad actor for tracking you, so that only they can track you.
DHCP will catch up too. https://datatracker.ietf.org/doc/html/draft-peterson-doh-dhc...
Blocking people from using DoH isn't going to solve the problem you are describing, it will just weaken users' privacy. Big vendors like Google will just create their own workarounds.
Before DoH though, my understanding is a good gateway appliance could just overwrite those DNS requests as it sees them. Now they'll be encrypted, and you'll have no way to tell the Chromecast where to connect (or even to where it is connecting).
All the major appliance vendors (Google, Amazon) already have huge fixed IP ranges to devote to this purpose, which are effectively unblockable because they might be shared with important cloud services.
https://support.mozilla.org/en-US/kb/firefox-dns-over-https#...
So, yes you can blacklist domains, as long as you can configure the DoH servers that the client uses.
Which now involves not just getting every machine, but every application on every machine
People can still use browser add-ons to block domains, URL's, objects on sites, etc... uBlock is my favorite for this.
You can choose to use that server or not
If a network intercepts your DNS traffic, you can encrypt it yourself. If you don't trust the network you should be encrypting everything anyway
If you're not using DoH, a malicious network will just redirect your requests to legitimate DNS servers to instead go to its own.
Home administrators who control their endpoints can turn DoH off with relative ease. By comparison, most governments cannot.
That was a really easy way to block harmful stuff or name things without requiring DNS. Having to choose between encryption and easy configuration is pretty poor UX.
Of course, this is just one weapon in the arms race. It doesn't completely protect you, but every bit helps.
Most people use their ISP's or organization's DNS server, and have no control over it; instead, it's something used against them. In many cases, that DNS server may do some combination of tracking, redirection to ads, or other things that make it undesirable to use.
DoH eliminates one of the last major unencrypted protocols on the Internet, and instead uses an encrypted protocol to talk exclusively to the intended server without the possibility of interception.
If you want to talk to your ISP's DNS server, you're free to do so. But that should be your choice, not your ISP's.