3 ms·
We all should be worried about loss of privacy, but we can't all run our own resolvers on the cloud. The choice of DoT vs DoH will mostly be about what is supp
by cryptonector 7y ago
We all should be worried about loss of privacy, but we can't all run our own resolvers on the cloud.
The choice of DoT vs DoH will mostly be about what is supported by one's choice of resolver. Of course, choosing DoH first will narrow the choice of resolvers.
Then there's captive portal situations.
- tptacek 7y agoThis is a false controversy. The people that "can't" run their own resolvers are, overwhelmingly, using their ISP's resolvers. At least in the US, all of those ISPs are actively attacking their users. Users are better off using practically any other mainstream centralized DNS provider than their ISP default. But this isn't a stable equilibrium; as I said, it seems clear that privacy-minded organizations will eventually stand up their own trustworthy DoH resolvers. DoH makes things somewhat better today for all users, and much better for power users. In the long term, it's easy to see how DoH makes things much better for everybody.
- cryptonector 7y agoRunning one's own recursor using DNSSEC via an ISP's resolver (for the privacy benefit relative to authoritatives) would take care of active attacks by ISPs on their users. Windows and Linux could do this you know, but security would be enhanced only relative to sites that use DNSSEC. But I don't disagree that DoH is better. I do hope that in the long run ISPs become less toxic.
- tptacek 7y agoRunning one's own resolver with DNSSEC would do absolutely nothing about the ISP threat, since DNSSEC is a cleartext signing-only protocol. Since the overwhelming majority of zones aren't signed, it won't even protect you from the garish NXDOMAIN landing page attack.
- cryptonector 7y agoI was referring to active attacks. I don't consider an ISP or a public resolver operator to be particularly different w.r.t. passive attacks: both get to do it, and both do do it.