**Kyle Rankin** @kyle@librem.one · Sep 11, 2019, 03:01

**Kyle Rankin** @kyle@librem.one · Sep 11, 2019, 03:01

Kyle Rankin @kyle@librem.one

Sep 11, 2019, 03:01

Disappointed that Firefox is giving Cloudflare user DNS resolution data by default via DoH. I trust my ISP but if I didn't, I'd use a trusted VPN to protect *all* my traffic. DoH is just a DNS-only VPN. What's worse, if you do use a VPN for #privacy FF will still leak your DNS data to Cloudflare by default. https://blog.mozilla.org/futurereleases/2019/09/06/whats-next-in-making-dns-over-https-the-default/

**Kyle Rankin** @kyle@librem.one · Sep 11, 2019, 03:17

**Kyle Rankin** @kyle@librem.one · Sep 11, 2019, 03:17

Sep 11, 2019, 03:17

Kyle Rankin @kyle@librem.one

Ask yourself why all these companies are fighting each other to be your default DNS provider. Why do their "privacy" solutions always give them your data instead? It's valuable data and it's easy to control it yourself. #privacy https://www.linuxjournal.com/content/own-your-dns-data

Show thread

**ｉｒｌ** @irl@57n.org · Sep 12, 2019, 10:00

**ｉｒｌ** @irl@57n.org · Sep 12, 2019, 10:00

Sep 12, 2019, 10:00

ｉｒｌ @irl@57n.org

@kyle This article seems to argue to set up a recursive resolver that sends plaintext via your ISP anyway. If your goal was to have privacy from your ISP, you failed.

**Kyle Rankin** @kyle@librem.one · 2019-09-12T14:19:37Z

Kyle Rankin @kyle@librem.one

@irl The goal is to have control over the DNS logs instead of giving them to Google or other big data firms. If you do not trust your ISP and think they sniff and capture all DNS traffic that goes over their wires, then the solution is to use a trusted VPN as they would probably also sniff all initial SNI requests too.

Sep 12, 2019, 14:19 · Web · · ·

**ｉｒｌ** @irl@57n.org · Sep 12, 2019, 14:31

**ｉｒｌ** @irl@57n.org · Sep 12, 2019, 14:31

Sep 12, 2019, 14:31

ｉｒｌ @irl@57n.org

@kyle sniffing and capturing DNS traffic is probably allowed under your TOS. At the very least they are allowed to do it for technical reasons, which might include looking at where their customers are going to so they can work out what peering arrangements they need, etc.

You're right on SNI. Even if you're not using SNI it's probably the case then that the IP address is going to give away where you're going.

I think that destination IP addresses are collected by all UK ISPs by law, and retained for some specified time period.

https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/473745/Factsheet-Internet_Connection_Records.pdf

I lost track on what was happening there in the end. Maybe that didn't happen, maybe it got worse.