Google rolls out pro-privacy DNS-over-HTTPS support in Chrome 83... with a handy kill switch for corporate IT

Re: Can no longer Easily see what extensions are installed

Was the requirement to unpin an extension really the thing stopping people from installing malicious plugins on other people's computers?

Re: Can no longer Easily see what extensions are installed

The better option would be a quick link to plugins/extensions, vs having to grab the 3 bars -> More Tools -> Extensions.

Every browser has this issue, quick access to toolbars, but the counter to these buttons is that there a sh*t ton of them sometimes, which makes it harder to review a URL at a glance when the buttons shrink the bar too far.

Having a bookmarks bar and Add-ons / Extensions bar would also be a good choice ..

but of course this is a mega corporation and despite user choice, mega corporations know best.. right? (insert eye roll here)

Re: Can no longer Easily see what extensions are installed

If you are using someone else’s computer, the extensions is the least of your worry. You should never assume there is any privacy or security if you don’t control your computer fully.

Re: DoH

The way you'll know is all the adverts start loading again.

Re: DoH

Nope, Chrome will only upgrade your DNS if your current DNS provider supports DoH. I.e. if you are using 8.8.8.8 currently, it will use DoH to talk to 8.8.8.8. Nothing will change if you have something custom setup. See https://www.chromium.org/developers/dns-over-https for the list of supported DoH providers - which is really small still.

Re: DoH

Excuse my ignorance but what’s blocking port 53 all about?

Re: DoH

I can;t read any of this without going doh! all the time!

Re: DoH

Probably. DoH requests are HTTPS, so they’re easy to pick apart by looking at the requests (if you have the certs).

Re: DoH

You'd probably be using an internal DNS in an organisation anyway, so that you can use internal domains. I'm not sure it therefore makes any difference if set up correctly.

Re: DoH

I have set up rules to block DoH at the firewall. The browsers and smartphones just drop back to using my internal DNS server (DNS over TLS with DNSSEC to Quad9). The internal DNS server blacklists around 2.5 million sites (most of them tracking and known malware flingers). However it will be a moving target as more and more DoH servers come on line.

I worked out that DoH was being used on my tablet when it suddenly started showing Facebook in the new tab list - I had blocked over 2,500 Facebook domains in DNS. I quickly set up additional rules to block DoH to known providers.

Re: DoH

Chrome allows you to set enterprise policies in managed mode.

Re: Nanny statism strikes again

Because they want it on for everyone so they are the only ones who can sell your data to advertisers.

But they don't want to be banned in the financial industry that is required to check your traders aren't logging into libor-rigging.org from their work machines

Re: Nanny statism strikes again

>"Chrome will disable DoH in managed environments that declare relevant enterprise policies"

And has any one found a reference that explains just what exactly these policies are - a quick Google fails to return anything.

Personally, the out-of-the-box action (for Windows) should be to simply detect active domain membership and network type (Public/Work) and play nicely with the Domain provided DNS server. Obviously, the user is free - until Chrome Group Policy settings prevent it - to change the settings for themselves.

Re: "We understand this concern"

Remember when the "settings" page was actually useful?

And now chrome doesn't let me manually edit urls in the url bar (which is how i like to roll) unless I jump through hoops each time... No option to revert it..

Yes, completrly fed up of software writers in general dumbing everything down against our will.

Re: Power grab

Exactly. Firefox started using Cloudflare's DoH by default and suddenly people inside my network couldn't see internal Web servers. Oh, and Firefox's "opt-out" dialog is basically "Do you want to be secure, or do you want to douse yourself in kerosene and light off fireworks like a moron?"

No, I am not going to run DoH on my internal network, plain old NSD over UDP is all I want to use. No, I do not want Cloudflare collecting DNS queries from my users.

I'm all for secure by default, but I am not for making a handful of corporations the de facto backbone of the Internet.

Re: Who do you want to hide from ?

some CDN's will serve any site they CDN for on any of the IP's they resolve on.

As an example, the reg & the pirate are on cloudflare. internally resolve the pirate to the IP of the reg and you can visit the pirate on https without your isp blocking.

Re: Who do you want to hide from ?

I don't see how they could target people for using DoH when it is the default in two widely used browsers, including now the most widely used.

But if, hypothetically, they did, Google could have Chrome make some random lookups to the top 1000 sites using regular DNS, while it still uses DoH, as an option for people living under repressive regimes.

Well the idea is...

that there may be countries somewhere, where your ISP is less trustworthy than Cloudflare. Of course this doesn't apply to Europe where your ISP could easily get shut down if they were caught exploiting your DNS traffic, whereas Cloudflare only makes a non-enforcable "promise" that they won't mess with your queries.

I wouldn’t call Edge Chrome identical to Google Chrome, there are several key differences especially when it comes to tracking options.

Re: As a system administrator of 25 years

Too many sysadmins have Asparagus Syndrome, in fact, it seems to be a pre-requisite.