back
3 comments
I am guessing the parent commenter is wondering if the full URL can be deciphered from DoH.

In the way DoH is being used in practice, it alllows third parties to collect histories of DNS lookups for myriad users, separated by individual program. In other words, the third party can tell which program was used by a given user to initiate any given DNS lookup. The program often reveals identifying information about the device on which it is installed. Other parties collect user data pertaining to IP address and device.

Device fingerprinting, i.e., associating a given user with a given device, is in widespread use purportedly "as a security measure" by "tech" companies like Facebook. Can we be sure the data collected is also not being used for other purposes.1

Combine the DNS program+IP fingerprint with, e.g., a web browser+IP fingerprint and now we can potentially identify a user from DNS lookups.

Now consider that Facebook prefixes all external URLs posted to Facebook pages (including external URLs posted in messages) so that any clicks on these URLs are captured, and the HTTP requests to non-Facebook sites are redirected via Facebook servers, again as a purported "security measure". Can we be sure the data collected is not also being used for other purposes.1 Thus Facebook has a history for each user of the URLs in Facebook pages/messages that the user clicks/follows.

The problem with DoH in practice is that it is being used almost exclusivelt to provide third party DNS. When we use third party DNS we give anyone (e.g., a "tech" company, a government, etc.) the potential opportunity to obtain from the third party (e.g., through subpoena, acquiring assets through merger, undisclosed data breach, etc.) complete DNS lookup histories for users' individual programs. There is no need to do this because there is no technical need to use third party DNS. And, of course, DoH does not have to be used only by third party DNS providers, so DoH itself is not the problem.

1. If I recall correctly, Facebook in the past has been caught lying about collecting telephone numbers "only" as a security measure.

Makes sense, thanks for explaining the bigger picture.
Since DNS (Domain Name System) only deals with the domain names themselves, any DNS resolver (communicated to via HTTP, TCP, UDP, QUIC or what have you) will only resolve a domain name => IP address. Adding a path in there makes no sense.
They can see the IP address of the machine making the request, if that's what you mean.