7 ms·

> The entire premise of DoH and DoT are that you don't want to use your ISP's DNS This is the discussion separation I am requesting. There is benefit of in-tra

> The entire premise of DoH and DoT are that you don't want to use your ISP's DNS This is the discussion separation I am requesting. There is benefit of in-transit encryption regardless of who the endpoint is. There may also be benefits to defaulting to non-system DNS, but those discussions should be separate IMO.

zamadatix 7y ago
What's the benefit of encrypting your DNS traffic to the ISP? There isn't anyone between otherwise they'd be your ISP. The point of DoH is to provide a way to configure DNS to something that isn't the ISP without the ISP being able to block it, snoop it, or intercept it. There is no separating the concept because if you're doing it to the ISP then the reasons for doing it are now invalid. Also "not the ISP" != "non-system dns". Don't conflate that just because browsers were first/most famous to implement.
- kodablah 7y ago
  I specifically said endpoints and not ISP because the proliferation of encrypted DNS traffic is a good thing regardless. Also, there is still MITM potential between you and your ISP's DNS server as many ISPs share pipes that have been known to be tapped at different PoPs. The value of encryption to DNS servers is obvious, even if we pretended that user-to-ISP traffic was all we were talking about. I liken these arguments to the same ones made in the past by our more-naive selves concerning encryption of corporate intranet traffic. We should be smarter now.
  - zamadatix 7y ago
    Replace ISP with endpoint, the conversation is the same. Simply encrypting to whatever the other end of the cable tells you to is false security. If the other end of the cable is malicious it will just lie about what your DoH server is. You can establish identity with a CA infrastructure and a precoded default destination, this is what DoH is about Encrypting traffic, internal or external, only makes sense if you don't trust whatever you happen to plug in to tell you what to trust. OWE in Wi-Fi has similar faults.

zamadatix 7y ago

What's the benefit of encrypting your DNS traffic to the ISP? There isn't anyone between otherwise they'd be your ISP. The point of DoH is to provide a way to configure DNS to something that isn't the ISP without the ISP being able to block it, snoop it, or intercept it. There is no separating the concept because if you're doing it to the ISP then the reasons for doing it are now invalid. Also "not the ISP" != "non-system dns". Don't conflate that just because browsers were first/most famous to implement.

kodablah 7y ago
I specifically said endpoints and not ISP because the proliferation of encrypted DNS traffic is a good thing regardless. Also, there is still MITM potential between you and your ISP's DNS server as many ISPs share pipes that have been known to be tapped at different PoPs. The value of encryption to DNS servers is obvious, even if we pretended that user-to-ISP traffic was all we were talking about. I liken these arguments to the same ones made in the past by our more-naive selves concerning encryption of corporate intranet traffic. We should be smarter now.
- zamadatix 7y ago
  Replace ISP with endpoint, the conversation is the same. Simply encrypting to whatever the other end of the cable tells you to is false security. If the other end of the cable is malicious it will just lie about what your DoH server is. You can establish identity with a CA infrastructure and a precoded default destination, this is what DoH is about Encrypting traffic, internal or external, only makes sense if you don't trust whatever you happen to plug in to tell you what to trust. OWE in Wi-Fi has similar faults.