3 ms·
Oh no no no, it does add security. Think DNS over TLS. Okay. You think $ip:$port is a dns connection. You send query with DoT protocol. You get answers. Bingo!
by bureaucrat 7y ago
Oh no no no, it does add security.
Think DNS over TLS. Okay. You think $ip:$port is a dns connection. You send query with DoT protocol. You get answers. Bingo! It’s DNS.
If it’s DNS over HTTPS, you can’t tell. What domain(dns.quad9.net or cloudflare-dns.com or dns.google or whatever you can imagine) is it? What endpoint and method(/dns-query?url= or whatever you can imagine) is it? You can’t tell.
HTTP adds complexity. Complexity adds security.
- ori_b 7y agoIf I can't tell, neither can the legitimate users. This makes queries that would out of the box rather hard. And you still have the traffic patterns that will give you the information with sufficient confidence.
- bureaucrat 7y agoWhy should legit users need to check whether a packet is to a dns server or not? And blocking https packets with mere confidence is impossible.
- ori_b 7y agoWell, it's hard to get a DNS response when you aren't talking to a DNS server... So, yeah, I can serve up DOH on my own server with a custom endpoint, custom client configuration, and generate cover traffic. But that's not exactly easy. And http doesn't help: I can do that without http, something like https://github.com/yrutschle/sslh https://github.com/yrutschle/sslh, or using SNI (which, as of TLS 1.3, is encrypted). And merely saying something is impossible doesn't make it so. It doesn't even make it hard.