Hacker News Reader

Comment by denton-scratch | Hacker News Reader

"Need" is too strong. Without going into the arguments against DoH, we don't "need" it, because there is an alternative: run your own recursive DNS. That should be something that a consumer could switch on or off. A default install of Unbound, for example, seems to /just work/.

Downside: if you have any kind of home network, running your own recursive DNS probably implies running your own DHCP, which isn't normally a consumer alternative (you could do it using settings on a domestic router, but not if it's crippled or locked-down). Also, DNS caching shouldn't be so effective (but I haven't noticed that effect).

Upside: all kinds of problems resulting from relying on DNS servers controlled by others disappear. You're not relying on them any more.

View on HN

Recursive DNS is still unencrypted and would be visible to your ISP

Yes, they can observe my queries to authoritative servers. But I didn't claim that running your own recursive DNS guaranteed privacy; I only claimed that it dispelled all problems arising from relying on someone else's DNS recursors.

I happen to trust my ISP, BTW; I really just like running my own because I can observe what it's doing.

So your “alternative” is strictly worse / solving a different problem.

> I happen to trust my ISP, BTW

Unless you can prove otherwise you should assume they're selling you out.

I can't "prove" it. But my ISP is a nerd ISP; it's Andrews & Arnold, a rather unusual outfit. If they were caught selling us out, they'd lose all their customers in a flash.

What if I want privacy on a non-home network? Huge part of my traffic is over 5G/LTE.

VPN if that isn't blocked or throttled by your carrier?

Though you need a trusted host to act as the other end, or you are just swapping one monitored link with another, and finding that could be a task in its own right depending on your threat model / paranoia level.

There are some apps (like Intra) which allow you to connect to a built-in (cloudflare, google) or custom DoH server (your own or other providers which support DoH).

Nextdns have their own app for this as well.

For android 9 or higher there should be an option in network settings.

Right, I specifically use DoH with Cloudflare on my phone. I'm talking about the "we don't need this" reply above, which is a suggestion for tinkerers, not a good recommendation for general population.

Reply on news.ycombinator.com