3 ms·

I specifically said endpoints and not ISP because the proliferation of encrypted DNS traffic is a good thing regardless. Also, there is still MITM potential bet

I specifically said endpoints and not ISP because the proliferation of encrypted DNS traffic is a good thing regardless. Also, there is still MITM potential between you and your ISP's DNS server as many ISPs share pipes that have been known to be tapped at different PoPs. The value of encryption to DNS servers is obvious, even if we pretended that user-to-ISP traffic was all we were talking about. I liken these arguments to the same ones made in the past by our more-naive selves concerning encryption of corporate intranet traffic. We should be smarter now.

zamadatix 7y ago
Replace ISP with endpoint, the conversation is the same. Simply encrypting to whatever the other end of the cable tells you to is false security. If the other end of the cable is malicious it will just lie about what your DoH server is. You can establish identity with a CA infrastructure and a precoded default destination, this is what DoH is about Encrypting traffic, internal or external, only makes sense if you don't trust whatever you happen to plug in to tell you what to trust. OWE in Wi-Fi has similar faults.