<story><title>Turn off DoH, Firefox</title><url>https://ungleich.ch/en-us/cms/blog/2019/09/11/turn-off-doh-firefox/</url></story><parent_chain><item><author>jfindley</author><text>This is painful to read. Masses off unfounded FUD - the article deliberately buries that it&amp;#x27;s trivial to change your DoH provider if you&amp;#x27;re silly enough to believe that CF is actively logging DoH requests and selling them (CF is involved with serving vast swathes of the internet anyway - if they wanted to go down this route they have &lt;i&gt;far&lt;/i&gt; more lucrative avenues open than selling DNS requests by IP).&lt;p&gt;If instead what you worry about is the government spying on your traffic then complaining about DoH is even &lt;i&gt;more&lt;/i&gt; silly - DNS requests are routinely intercepted and monitored by ISPs in many countries, with the information available to the security services, who have very few restrictions on what they are allowed to do with this data.  This is especially true in the country the author appears to be based (Germany).&lt;p&gt;DoH is vital to protect users around the world from censorship and worse.  Enabling it by default is a &lt;i&gt;good&lt;/i&gt; thing - protecting users from abuse shouldn&amp;#x27;t only be opt-in. There has to be SOME default chosen, and the default needs to be a site large and well run enough to a) handle the load, and b) be in the firefox HSTS preload list.  There aren&amp;#x27;t a lot of good DoH providers that fit these criteria - CF is one of the few.</text></item></parent_chain><comment><author>yosamino</author><text>There&amp;#x27;s nothing that makes Cloudflare the more &amp;quot;privacy friendly&amp;quot; 3rd party. &amp;quot;Privacy friendly&amp;quot; would be a mechanism by which my desire to communicate with &amp;quot;example.com&amp;quot; involved  my computer and the computer at example.com with &lt;i&gt;no&lt;/i&gt; third party in between.&lt;p&gt;As it stands Mozilla is switching out our local ISP for CloudFlare without asking our consent which means my traffic data is now spread around one &lt;i&gt;more&lt;/i&gt; company - that seems like less privacy.&lt;p&gt;And I am not looking forward to finding out the fun ways in which this will break our local DNS.&lt;p&gt;The idea that Cloudflare is in way more trustworty than my local ISP is at best naïve. All this creates is another huge centralized pool of data with no oversight whatsoever except the &lt;i&gt;promise&lt;/i&gt; of some company that is currently growing fast, that they will not do anything with that data. Come the times when money becomes tight again, we&amp;#x27;ll see how well that promise holds up.&lt;p&gt;Sure, encrypting DNS is a good thing. But this is just like trying to make email more secure by using a 3rd party encryption gateway - all it does is moving around who to trust.&lt;p&gt;That&amp;#x27;s not privacy - that&amp;#x27;s just silly</text></comment>
<story><title>Turn off DoH, Firefox</title><url>https://ungleich.ch/en-us/cms/blog/2019/09/11/turn-off-doh-firefox/</url></story><parent_chain><item><author>jfindley</author><text>This is painful to read. Masses off unfounded FUD - the article deliberately buries that it&amp;#x27;s trivial to change your DoH provider if you&amp;#x27;re silly enough to believe that CF is actively logging DoH requests and selling them (CF is involved with serving vast swathes of the internet anyway - if they wanted to go down this route they have &lt;i&gt;far&lt;/i&gt; more lucrative avenues open than selling DNS requests by IP).&lt;p&gt;If instead what you worry about is the government spying on your traffic then complaining about DoH is even &lt;i&gt;more&lt;/i&gt; silly - DNS requests are routinely intercepted and monitored by ISPs in many countries, with the information available to the security services, who have very few restrictions on what they are allowed to do with this data.  This is especially true in the country the author appears to be based (Germany).&lt;p&gt;DoH is vital to protect users around the world from censorship and worse.  Enabling it by default is a &lt;i&gt;good&lt;/i&gt; thing - protecting users from abuse shouldn&amp;#x27;t only be opt-in. There has to be SOME default chosen, and the default needs to be a site large and well run enough to a) handle the load, and b) be in the firefox HSTS preload list.  There aren&amp;#x27;t a lot of good DoH providers that fit these criteria - CF is one of the few.</text></item></parent_chain><comment><author>huhtenberg</author><text>Don&amp;#x27;t oversimplify the issue.&lt;p&gt;&amp;gt; &lt;i&gt;it&amp;#x27;s trivial to change your DoH provider&lt;/i&gt;&lt;p&gt;Cloudfare is the default.&lt;p&gt;Cloudfare is the only provider listed.&lt;p&gt;Cloudfare will be On by default, so it will be that for 99.999% of Firefox users.&lt;p&gt;That ain&amp;#x27;t right no matter how well intended it is.</text></comment>