@bortzmeyer @jpmens And your answer is very biased and somewhat dishonest:
* configuring an alternate resolver is something that will only be done by power users. Default config matters a lot.
* bypassing ISP resolvers was never the purpose of an encryption protocol. The goal is to protect data over the network from snooping and from alteration.
@x_cli @jpmens Yes, the default is very important (most users won't change it or wouldn't even dare to think about it). That's why the default must be towards security. If the ISP were to pledge solemnly to follow the principles of network neutrality and privacy, they would have a right to complain. But they don't. Quite the opposite.
Also, yes, the default choice is very important but most anti-DoH texts lie by claiming that Mozilla forces the use of CLoudflare. This is simply not true.
@bortzmeyer @jpmens Most sound people complain about Mozilla-Cloudflare partnership. Not about DoH itself, although there is a bit to say about it as a protocol as well.
I, for one, have no problem with Chrome strategy for DoH implementation and deployment. But I am a fierce opponent of Mozilla's strategy.
"As a side-note: we already deny RFC1918-addresses from DNS-over-HTTPS
responses so in that regard, using TRR will save you from these DNS attacks!"
So, I was wrong. DoH-to-Cloudflare-by-default is not an issue, as far as DNS rebinding is concerned. Sorry 😶😥
@x_cli @jpmens For the second point, it goes in the opposite direction: the goal is to bypass IAP resolver because of their practices. Despite what the anti-DoH propaganda says, this can be done without DoH or even without encryption. But this is dangerous (IP hijacking, for instance). So, to use a public resolver, DoE is really useful.
(On the other hand, DoE to the IAP resolver is not very interesting.)
As you said it yourself, bypassing ISP resolvers can be done in numerous ways and could already be done for ages. DoH was not created to be "one more way of doing it".
There is a bit of security behind DoH, but mostly there is a political and economical agenda for Browsers and CDNs, that has nothing to do with ISP. ISP are just a distraction used to hide the true agenda.
So why now? Why the sudden interest? Yes, it relies on a stack browsers already implemented, but browsers obvisouly don't care about attack surface.
The answer is: being (much) faster than the other CDNs. And Cloudflare not supporting ECS "for privacy reasons" is actually doing it to be even faster than their competitors.
Le réseau social de l'avenir : Pas d'annonces, pas de surveillance institutionnelle, conception éthique et décentralisation ! Possédez vos données avec Mastodon !