Re: [Add] [EXTERNAL] Re: Malware adopting DoH

[Rob Sayre <[e-mail]>]

Hi,

Here's some data on this point:

https://developers.google.com/speed/public-dns/docs/intro#google_public_dns_what_it_is_and_isnt

"Google Public DNS is not... A malware-blocking service. Google Public DNS
rarely performs blocking or filtering, though it may if we believe this is
necessary to protect our users from security threats. In such extraordinary
cases, it simply fails to answer; it does not create modified results."

Google and other browser makers do perform malware blocking, in a sense.
They just generally don't use DNS to do it. See:
https://safebrowsing.google.com

It seems to me that DoH provides the typical benefits of encryption over
the wire. On the "informed consent" argument: there are many divergent
opinions. Some people on this list seem to think DNS is special in some
way, but I don't think there is an IETF document that states anything like
that. As we have seen, there are many libraries, applications, and products
that connect to DNS servers without informing the user.

thanks,
Rob

On Sun, Sep 15, 2019 at 7:44 AM Robert Mortimer <robm=
[e-mail]> wrote:

> No that's an argument for making an informed decision about what DNS
> service provider you use and possibly for being able to avoid limitations
> being imposed by the network you happen to be using at the time.
>
> Using a VPN to access your DNS provider would achieve the same thing, as
> would using DoT or in many cases simply not using DHCP to decide your DNS
> provider.
>
> If my an application is deciding which DNS service to use without my
> informed consent then even if it's using DoH it achieves none of the things
> you list.
>
> Your list merely describes informed choice of DNS provider not any benefit
> uniquely inherent to DoH
>