3 ms·
TLS tickets are indeed a kind of a cookie. Even without tickets, having TCP sessions means that server operators can link multiple queries to a single device,
by jedisct1 8y ago
TLS tickets are indeed a kind of a cookie.
Even without tickets, having TCP sessions means that server operators can link multiple queries to a single device, even if multiple devices share the same external IP.
This gives server operators more data than plain DNS.
The DNSCrypt protocol can use a unique key for every query in order to prevent this. Since it doesn't use sessions, and all queries are independent, there is no latency overhead.
For DoH, dnscrypt-proxy has an option to disable TLS session resumption. But it introduces some overhead every time a reconnection is necessary.