Hacker News Reader

Comment by seanieb | Hacker News Reader

Privacy.

Why is DoH in the browser more private than DoH in the OS?

It's not Google. My heuristic is that the bigger the tech giant the more sophisticated, indirect, and obfuscated the sharing/selling of data.

The fact that Google has incurred over $3 billion in fines in recent years specifically for infringing people's privacy should be a consideration!

It's all about whether you trust the OS to not track you when doing DoH at that level. In both mobile browser ecosystems, I can see why users of a browser would prefer the independent browser to do the DoH themselves, rather than leave it to the OS.

Because there are fewer actors to trust.

In the OS you need to trust (1) the OS vendor, (2) the client vendor & (3) any VPN app or HTTP intermediary that's integrated with OS network APIs.

In the client you need only to trust the client vendor.

Surely you're at the mercy of the hardware vendor and os in either case?

Granted, the os would need to read your address space, not simply supply a recording DNS API, but still...

The hardware and OS in the case of DoH only gets the IP address for the connection. It's not horribly hard to figure out who owns that IP address, but it's definitely harder than just reading a domain name.

You're at the mercy of the hardware in all cases. You can't do anything without trusting some external party unless you make an apple pie from scratch, but reducing the number of parties needing trusting is usually a good security approach.

Yeah, Android is Google

does android not allow you to configure a custom DoH resolver? could Mozilla simply offer a public resolver, and encourage users to switch at the OS level (possibly including a first-launch dialog offering to set the configuration for you)?

Reply on news.ycombinator.com