Windows 10: Google addresses misconceptions about plans for improving DNS security

Brink · Oct 29, 2019

Whenever you type a URL into your browser (for example “redcross.org”), this information is sent to a domain name system (DNS) provider that converts that request into the unique numerical “IP address” (e.g. 162.6.217.119) that identifies websites on the Internet. Your browser then uses that numerical IP address to take you to the site you were looking for. Unfortunately, today the requests from your browser to the DNS provider are not encrypted (which makes you vulnerable to passive monitoring by strangers) nor authenticated (which makes you vulnerable to online attackers). This is especially true when you’re connected to public WiFi, for example at a cafe or airport, since anyone else using the network can see and track the websites you visit and maybe redirect your browser to a malicious website.

In September, we announced an experiment in Chrome to improve online privacy and security by enabling secure DNS connections with DNS-over-HTTPS (DoH) for users already using DNS providers that support it. DoH is being developed by the Internet standards community as a step toward better security and privacy by encrypting the traffic between your browser and your DNS provider. It improves privacy by removing one of the ways used by malicious actors to observe the browsing habits of other users on the same network. DoH is also a significant security improvement, as it helps stop man-in-the-middle attacks on DNS lookups. Many privacy-minded organizations, journalists, other browser providers and internet service providers (ISPs) agree that these changes will improve your privacy and security.

Unfortunately, there has been some misinformation and confusion about the goals of our approach and whether DoH will impact existing content controls offered by ISPs. The confusion comes from two particular claims and we want to address both.

The first claim is that Google is going to redirect user DNS traffic to Google's own DNS or another DoH-compliant DNS provider. That is incorrect. Because we believe in user choice and user control, we have no plans to force users to change their DNS provider. Today, there are many independent DNS providers, although ISPs serve approximately 97% of user DNS needs. As long as these service providers keep catering to user needs and concerns, it will remain a diverse ecosystem. We’re simply enabling support in Chrome for secure DoH connections if a user’s DNS provider of choice offers it. Chrome will check if the user’s DNS provider is among a list of participating DoH-compatible providers and if so, it will enable DoH. If the DNS provider is not on the list, Chrome won’t enable DoH and will continue to operate as it does today. As DoH adoption increases, we expect to see the number of DoH-enabled DNS providers grow.

The second claim we’ve seen is that the secure DoH connection will limit the family-safe content controls offered by some ISPs. In fact, any existing content controls of your DNS provider, including any protections for children, should remain active. DoH secures the URL data only while it’s in transit between your browser and the DNS provider, so your provider’s malware protection and parental control features will continue to work as they have in the past. As a proof point, CleanBrowsing offers the same parental control features on its DoH service as it does on its unencrypted service.

As we said last month, we’re taking an incremental approach with this experiment, and our current plan is to enable DoH support for just 1% of our users, provided that they are already using a DoH compliant DNS provider. This will allow Google and DoH providers to test the performance and reliability of DoH. We’ll also monitor feedback from our users and from other stakeholders, including ISPs. Most managed Chrome deployments such as schools and enterprises are excluded from the experiment by default. We also offer policies for administrators to control the feature. Finally, Chrome users may opt-out of the DoH experiment entirely by going to chrome://flags/#dns-over-https, starting in Chrome 79.

We are optimistic about the opportunities DoH offers for improving user privacy and security, but we also understand the importance of DNS and that there could be implementation concerns we haven’t foreseen. That’s why we plan to move carefully and transparently. We’re open to feedback and welcome constructive collaboration and engagement. We are committed to ensure that the deployment of DoH does not create unintended consequences and we will continue to work with stakeholders including ISPs, DNS providers, and Internet and child safety advocates as we make progress.

Posted by Kenji Baheux, Chrome Product Manager
Click to expand...

Source: https://blog.chromium.org/2019/10/ad...ons-about.html

:)

RejZoR · Oct 30, 2019

Cloudfare, Quad9, Google, OPEN - the DNS wars!

Extensive list of DNS services:
Secure DNS servers

Keeping it updated for 4 years now. Currently, Cloudflare DNS holds the crown in 2 departments, performance and privacy. Stay away from Google though. It's an option, but I wouldn't recommend it.

lynx29 · Oct 30, 2019

Cloudfare, Quad9, Google, OPEN - the DNS wars!

Extensive list of DNS services:
Secure DNS servers

Keeping it updated for 4 years now. Currently, Cloudflare DNS holds the crown in 2 departments, performance and privacy. Stay away from Google though. It's an option, but I wouldn't recommend it.
Click to expand...

thank you kindly, I feel much more confident now switching to Cloudflare. ALL HAIL! REZJOR!

slyfox2151 · Oct 30, 2019

Dns

i use Googles @ 8.8.8.8 for primary
2ndary is Googles @ 8.8.4.4 and
3rdary is my ISPs

i ran a DNS benchmark and according to it... googles was the fastest out of a large list.

Windows 10: Google addresses misconceptions about plans for improving DNS security

Google addresses misconceptions about plans for improving DNS security

Google addresses misconceptions about plans for improving DNS security

Google addresses misconceptions about plans for improving DNS security

Google addresses misconceptions about plans for improving DNS security - Similar Threads - Google addresses misconceptions

DNS address autofill issue

Information about DNS.

Information about DNS.

What are some common misconceptions about cloud computing, and how can they be addressed?

What are some common misconceptions about cloud computing, and how can they be addressed?

Accessing a DNS address

Google Chrome Improving Site Isolation for Stronger Browser Security

Google Improving Security and Privacy for Extensions in Google Chrome

about google dns and ping