So, the issue described in comment 0 is really pointing out the possibility for phishing, if you are e.g. on an untrusted network and they are trying to make you visit a fake site. In particular, one needs to have placed what I would currently describe as excessive trust in DoH - and that's part of the problem, that it is not clear how reliable DoH is and from what one is protected with its use, just from looking at the UI. Generally, the fact that it's possible for networks to "force" use of native DNS by simply blocking the DoH endpoint is a well-known state of the ecosystem and e.g. we have the canary domain to *support* this. With all this in mind, this is P3 until we have more direction from e.g. Product on how we want to evolve here.
Bug 1656895 Comment 11 Edit History
Note: The actual edited comment in the bug view page will always show the original commenter’s name and original timestamp.
So, the issue described in comment 0 is really pointing out the possibility for phishing, if you are e.g. on an untrusted network and they are trying to make you visit a fake site. In particular, one needs to have placed what I would currently describe as excessive trust in DoH - and that's part of the problem, that it is not clear how reliable DoH is and from what one is protected with its use, just from looking at the UI. Generally, the fact that it's possible for networks to "force" use of native DNS by simply blocking the DoH endpoint is a well-known state of the ecosystem and e.g. we have the canary domain to *support* this (at least in case of our automated rollouts). With all this in mind, this is P3 until we have more direction from e.g. Product on how we want to evolve here.