<story><title>Windows will improve user privacy with DNS over HTTPS</title><url>https://techcommunity.microsoft.com/t5/Networking-Blog/Windows-will-improve-user-privacy-with-DNS-over-HTTPS/ba-p/1014229</url></story><parent_chain><item><author>Someone1234</author><text>&amp;gt;  Encrypting DNS does not require centralization, but DoH does require centralization in in the RFC.&lt;p&gt;This isn&amp;#x27;t a problem that DoH was designed to solve. It is designed to be a highly compatible, secure, endpoint DNS solution. Which it is. So while this criticism is accurate, it is also irrelevant, DoH replaces one &amp;quot;hop&amp;quot; on DNS and that&amp;#x27;s all it was ever designed to do.&lt;p&gt;&amp;gt; DoH doesn&amp;#x27;t even &amp;quot;improve user privacy&amp;quot;; it simply changes who can record your DNS queries. I&lt;p&gt;It stops passive eavesdropping. Right now you can change who you use for DNS and your ISP can still monitor your DNS to profile you and invade your privacy. With DoH you can pick a privacy focused endpoint and nobody between you or that endpoint can trivially monitor your DNS.&lt;p&gt;DoT solves this too but has issues (see next response).&lt;p&gt;&amp;gt; DNS servers need to support DNS over TLS (DoT) or some other type of encrypted transport.&lt;p&gt;DoT and even unencrypted DNS is blocked on a lot of free WiFi. Now what? DoH solves this issue, as it was designed to. DoH can traverse even the most locked down network over the same HTTPS channel as any other web traffic.&lt;p&gt;&amp;gt; You don&amp;#x27;t get privacy by centralizing all of your requests onto one server.&lt;p&gt;Perhaps, but it scales really well and is the basis for all current DNS resolution. If everyone on the internet did as you suggested core internet infrastructure would fail under the load. You&amp;#x27;ve essentially killed almost all caching.</text></item><item><author>pdkl95</author><text>&amp;gt; There is an assumption by many that DNS encryption requires DNS centralization.&lt;p&gt;A lot of the discussion recently, like this statement, conflates &amp;quot;DNS encryption&amp;quot; with &amp;quot;DoH&amp;quot;. Encrypting DNS does &lt;i&gt;not&lt;/i&gt; require centralization, but &lt;i&gt;DoH does&lt;/i&gt; require[1] centralization in in the RFC. DoH doesn&amp;#x27;t even &amp;quot;improve user privacy&amp;quot;; it simply changes who can record your DNS queries. Instead of the ISP, Cloudflare&amp;#x2F;Microsoft&amp;#x2F;etc gets to see your unencrypted DNS queries.&lt;p&gt;The way to actually improve privacy is to perform the recursive resolution locally[2]. The actual communication with each individual DNS server needs to be encrypted, which is where work needs to be done. DNS servers need to support DNS over TLS (DoT) or some other type of encrypted transport. Hypothetically, DoH could be modified to support this, although that seems more complicated than simply wrapping the DNS protocol in TLS.&lt;p&gt;You don&amp;#x27;t get privacy by centralizing all of your requests onto one server. To protect privacy, you limit the data that any one party can see. DNS was designed for this purpose: only the NS record of a domain needs to be sent to a centralized server, which is easy to cache for a long time. Most requests then go to domain-specified authoritative server[4].&lt;p&gt;It&amp;#x27;s good to see Microsoft at least trying to address this at the OS level. App doing DNS without involving the OS seems to be more about taking away control from the user. I&amp;#x27;m sure Google would love to be able top bypass DNS based adblocking.&lt;p&gt;[1] &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;news.ycombinator.com&amp;#x2F;item?id=21110296&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;news.ycombinator.com&amp;#x2F;item?id=21110296&lt;/a&gt;&lt;p&gt;[2] Which is easy: follow NS records until you get to the server that has your authoritative answer.&lt;p&gt;[3] &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;news.ycombinator.com&amp;#x2F;item?id=21348328&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;news.ycombinator.com&amp;#x2F;item?id=21348328&lt;/a&gt;</text></item></parent_chain><comment><author>ryan_hallinger</author><text>Hi Someone1234, I would be keen to discuss the topic further with you. What&amp;#x27;s the best way to connect?</text></comment>
<story><title>Windows will improve user privacy with DNS over HTTPS</title><url>https://techcommunity.microsoft.com/t5/Networking-Blog/Windows-will-improve-user-privacy-with-DNS-over-HTTPS/ba-p/1014229</url></story><parent_chain><item><author>Someone1234</author><text>&amp;gt;  Encrypting DNS does not require centralization, but DoH does require centralization in in the RFC.&lt;p&gt;This isn&amp;#x27;t a problem that DoH was designed to solve. It is designed to be a highly compatible, secure, endpoint DNS solution. Which it is. So while this criticism is accurate, it is also irrelevant, DoH replaces one &amp;quot;hop&amp;quot; on DNS and that&amp;#x27;s all it was ever designed to do.&lt;p&gt;&amp;gt; DoH doesn&amp;#x27;t even &amp;quot;improve user privacy&amp;quot;; it simply changes who can record your DNS queries. I&lt;p&gt;It stops passive eavesdropping. Right now you can change who you use for DNS and your ISP can still monitor your DNS to profile you and invade your privacy. With DoH you can pick a privacy focused endpoint and nobody between you or that endpoint can trivially monitor your DNS.&lt;p&gt;DoT solves this too but has issues (see next response).&lt;p&gt;&amp;gt; DNS servers need to support DNS over TLS (DoT) or some other type of encrypted transport.&lt;p&gt;DoT and even unencrypted DNS is blocked on a lot of free WiFi. Now what? DoH solves this issue, as it was designed to. DoH can traverse even the most locked down network over the same HTTPS channel as any other web traffic.&lt;p&gt;&amp;gt; You don&amp;#x27;t get privacy by centralizing all of your requests onto one server.&lt;p&gt;Perhaps, but it scales really well and is the basis for all current DNS resolution. If everyone on the internet did as you suggested core internet infrastructure would fail under the load. You&amp;#x27;ve essentially killed almost all caching.</text></item><item><author>pdkl95</author><text>&amp;gt; There is an assumption by many that DNS encryption requires DNS centralization.&lt;p&gt;A lot of the discussion recently, like this statement, conflates &amp;quot;DNS encryption&amp;quot; with &amp;quot;DoH&amp;quot;. Encrypting DNS does &lt;i&gt;not&lt;/i&gt; require centralization, but &lt;i&gt;DoH does&lt;/i&gt; require[1] centralization in in the RFC. DoH doesn&amp;#x27;t even &amp;quot;improve user privacy&amp;quot;; it simply changes who can record your DNS queries. Instead of the ISP, Cloudflare&amp;#x2F;Microsoft&amp;#x2F;etc gets to see your unencrypted DNS queries.&lt;p&gt;The way to actually improve privacy is to perform the recursive resolution locally[2]. The actual communication with each individual DNS server needs to be encrypted, which is where work needs to be done. DNS servers need to support DNS over TLS (DoT) or some other type of encrypted transport. Hypothetically, DoH could be modified to support this, although that seems more complicated than simply wrapping the DNS protocol in TLS.&lt;p&gt;You don&amp;#x27;t get privacy by centralizing all of your requests onto one server. To protect privacy, you limit the data that any one party can see. DNS was designed for this purpose: only the NS record of a domain needs to be sent to a centralized server, which is easy to cache for a long time. Most requests then go to domain-specified authoritative server[4].&lt;p&gt;It&amp;#x27;s good to see Microsoft at least trying to address this at the OS level. App doing DNS without involving the OS seems to be more about taking away control from the user. I&amp;#x27;m sure Google would love to be able top bypass DNS based adblocking.&lt;p&gt;[1] &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;news.ycombinator.com&amp;#x2F;item?id=21110296&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;news.ycombinator.com&amp;#x2F;item?id=21110296&lt;/a&gt;&lt;p&gt;[2] Which is easy: follow NS records until you get to the server that has your authoritative answer.&lt;p&gt;[3] &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;news.ycombinator.com&amp;#x2F;item?id=21348328&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;news.ycombinator.com&amp;#x2F;item?id=21348328&lt;/a&gt;</text></item></parent_chain><comment><author>acqq</author><text>&amp;gt; With DoH you can pick a privacy focused endpoint and nobody between you or that endpoint can trivially monitor your DNS.&lt;p&gt;Even with the DoH which site you access is still trivially to track by your ISP and anybody along the wire as the site name is still not encrypted in the TLS connection traffic.</text></comment>