3 ms·
Can you describe the threat model your trying to account for? The reason I made that statement has to do with the means by which DNS can easily be circumvented
by bluejekyll 8y ago
Can you describe the threat model your trying to account for?
The reason I made that statement has to do with the means by which DNS can easily be circumvented and direct encrypted connections used instead. This means using DNS introspection as a means for security doesn't buy you much, DoH just makes that more apparent.
- JohnFen 8y agoThe threat model is anything that is trying to phone home without approval. This includes calling command-and-control servers, trackers for ads, data exfiltrators, etc. All of these use domain names to set up the communications, for obvious reasons, so being able to thwart those lookups is of great value. You're right, that all by itself is insufficient, but it's still very important.