DNS over HTTPS (RFC 8484)

This is the thread to discuss RFC 8484, DNS Queries over HTTPS (DoH). Attached is the RFC itself in the normal text format and part of an illustration Mozilla saw fit to create in an article encouraging people to use this new protocol. Clearly, this standard's effects on security relating to network management, implementation reliability, protocol complexity, and other repercussions are all relevant subtopics, as are discussing other standards that are being pushed in relation to this, such as HTTP/2 -- HTTP/2 [RFC7540] is the minimum RECOMMENDED version of HTTP for use with DoH. -- along with other standards one may believe are related. To encourage proper discussion, take some time to familiarize yourself with related materials, such as reading or scanning over the RFC itself. Here is the link for the Mozilla article from which this image originates; feel free to provide other links to yet more material you want to share: https://hacks.mozilla.org/2018/05/a-cartoon-intro-to-dns-over-https/

My opinion is that DNS over HTTPS is another protocol that is being forced by these companies, such as Google, Mozilla, and Cloudflare, in order to help their centralization and control over the Internet. I see it as being similar to HTTP/2 and more recently HTTP/3 (HTTP/3 is coincidentally not compatible with Tor by virtue of using UDP.), in that the primary benefactors are not normal users or even people hosting their own servers, but primarily those with very large organizations who have begun to hit limits due to their massive sizes. I have not read of a single benefit of DNS over HTTPS that does not apply to these behemoths. It has been pointed out before that the IP address being used is still observable by the network operators and the only counterexample to this that I've read is it benefits massive servers that host many different websites by obscuring things. This is hardly a benefit for the average person or organization. Mozilla seems to seek to make Cloudflare the default DNS provider eventually; my thoughts are at least many disparate DNS providers have a harder time spying collectively than a single entity. This is a message from Paul Vixie complaining of Google interfering with normal DNS as it stands; Google very clearly wants to completely control every Internet protocol its services use, increasing its spying capabilities and pushing dependence on itself unto others: https://mailarchive.ietf.org/arch/msg/dnsop/WCVv57IizUSjNb2RQNP84fBclI0 That the HTTP and so the WWW would begin to consume normal Internet protocols that are fine on their own or can be improved in better, simpler ways is just evidence to me of how the WWW will continue to drift away from the rest of the Internet, where standards become ever larger, increasingly poorly-specified, more and more implemented in purposefully incorrect ways, with fewer and fewer conforming implementations, and leading to increasing consolidation among large organizations that will reap the benefits at the cost of everyone else. With regards to this general push in the direction of omnipresent and mandatory encryption by these groups, I find it very telling that they don't espouse distributed encryption, but Certificate Authorities and other central bodies that will have the ability to intercept and control messages. For privacy concerns, you won't see a single mention of Tor anywhere, either. I don't think encryption should be mandatory, just as a simplicity concern, but I certainly don't believe that these authorities are particularly trustworthy and I find it disconcerting that more and more interaction with them is being pushed for every communication and providing a false sense of security for most people.

>>7246 Its an alternate method ofndns resolution that beleive it or not has a use case lain would approve of. Many networks forbis use of alternate dns (Use Opennic if you are 水) by intercepting or filtering dns queries. By offering resolution of port 443 with tls, this is no longer possible as dns cant be distinguished from https. It also prevents ISP from logging your dns queries for (((analytics))) . I prefer dnscrypt but this has a use case.