<story><title>DNS-over-HTTPS Policy Requirements for Resolvers</title><url>https://blog.mozilla.org/security/2019/04/09/dns-over-https-policy-requirements-for-resolvers/</url></story><parent_chain><item><author>nykolasz</author><text>I replied sub-thread, but adding here to give some more visibility to some of the issues DoH is causing and will cause:&lt;p&gt;I work at a k12 school and I am involved on many k12 IT communities.&lt;p&gt;Some schools already removed Firefox from the students computers because it was being used as a &amp;quot;VPN&amp;quot; by some elementary students to access porn - at school. Guess what this VPN was? Just DNS over HTTPS.&lt;p&gt;There is a fine line between protecting yourself from your ISP and local network operators that NEED to apply some security policies to their traffic. Even Google offers &amp;quot;Safe Search&amp;quot; for schools and libraries that removes porn content.&lt;p&gt;Unfortunately, on our school network, we also allow BYOD (students with their own laptops and ipads), so we will have to have some strict rules to block DoH, the same way we block proxies and vpns.&lt;p&gt;The only other option is going to full HTTPS MITM, forcing a root SSL cert to all computers that use our network, which is the last thing that anyone wants to do.&lt;p&gt;&lt;i&gt;Summary: This may lead to more HTTPS MITM or schools forbidding BYOD AND removing Firefox from their computers.&lt;/i&gt;</text></item></parent_chain><comment><author>Avamander</author><text>Don&amp;#x27;t worry. Soon Chrome will also implement DoH and ESNI, then you actually have to either forbid BYOD or actually start teaching students manners, how browsing porn is not okay in school context. I&amp;#x27;m really quite annoyed by the connotation that kids should rather be helicopter-parented (by tech or by people) than actually taught what&amp;#x27;s okay and what&amp;#x27;s not.&lt;p&gt;The very least the new tech provides is that any silent helicopter parenting is becoming more visible and I&amp;#x27;m grateful for that. Kids deserve internet privacy just as much as real-life privacy.</text></comment>
<story><title>DNS-over-HTTPS Policy Requirements for Resolvers</title><url>https://blog.mozilla.org/security/2019/04/09/dns-over-https-policy-requirements-for-resolvers/</url></story><parent_chain><item><author>nykolasz</author><text>I replied sub-thread, but adding here to give some more visibility to some of the issues DoH is causing and will cause:&lt;p&gt;I work at a k12 school and I am involved on many k12 IT communities.&lt;p&gt;Some schools already removed Firefox from the students computers because it was being used as a &amp;quot;VPN&amp;quot; by some elementary students to access porn - at school. Guess what this VPN was? Just DNS over HTTPS.&lt;p&gt;There is a fine line between protecting yourself from your ISP and local network operators that NEED to apply some security policies to their traffic. Even Google offers &amp;quot;Safe Search&amp;quot; for schools and libraries that removes porn content.&lt;p&gt;Unfortunately, on our school network, we also allow BYOD (students with their own laptops and ipads), so we will have to have some strict rules to block DoH, the same way we block proxies and vpns.&lt;p&gt;The only other option is going to full HTTPS MITM, forcing a root SSL cert to all computers that use our network, which is the last thing that anyone wants to do.&lt;p&gt;&lt;i&gt;Summary: This may lead to more HTTPS MITM or schools forbidding BYOD AND removing Firefox from their computers.&lt;/i&gt;</text></item></parent_chain><comment><author>jeroenhd</author><text>What would removing Firefox accomplish? Why would students not just download one of the bazillion Chrome VPN addons? Or regular VPNs that they can just turn on and off? How is _removing Firefox_ a solution?&lt;p&gt;What these schools need is to set up sensible group policies. Managing BYOD on a school with kids (as opposed to grown-up people whose jobs are on the line) is simply impossible.</text></comment>