Re: [Add] [EXTERNAL] Re: Malware adopting DoH

[Ted Lemon <[e-mail]>]

On Sep 13, 2019, at 2:51 PM, Andrew Campling <[e-mail]> wrote:
> If the centralisation potential of DoH takes effect as some anticipate, this would leave Google (and Cloudflare and other resolvers to a lesser extent) with significant control of the cybersecurity “market”, both in terms of protection capability and also cyber intelligence gathering, crowding out specialist provision.  Much as I respect people in Google, from an antitrust perspective, as well as when considering innovation etc, I would urge people to be careful what they wish for!   

Again, we are talking specifically about malware using DoH.  It will probably use whatever DoH servers can be counted on.  This is entirely out of Google’s control.  The original point was that there is a problem with DoH and malware because Google.  My response was merely to point out that if such a problem exists, there is a mitigation strategy that could be very effective.

This is entirely orthogonal to any other operational issues that may come up as a result of the availability of DoH.   The fact that malware is using DoH is not a clear indication that the sky is falling, and may turn out quite differently than the author(s) of that malware intended.