4 ms·

> Encrypting DNS does not require centralization, but DoH does require centralization in in the RFC. This isn't a problem that DoH was designed to solve. It i

> Encrypting DNS does not require centralization, but DoH does require centralization in in the RFC. This isn't a problem that DoH was designed to solve. It is designed to be a highly compatible, secure, endpoint DNS solution. Which it is. So while this criticism is accurate, it is also irrelevant, DoH replaces one "hop" on DNS and that's all it was ever designed to do. > DoH doesn't even "improve user privacy"; it simply changes who can record your DNS queries. I It stops passive eavesdropping. Right now you can change who you use for DNS and your ISP can still monitor your DNS to profile you and invade your privacy. With DoH you can pick a privacy focused endpoint and nobody between you or that endpoint can trivially monitor your DNS. DoT solves this too but has issues (see next response). > DNS servers need to support DNS over TLS (DoT) or some other type of encrypted transport. DoT and even unencrypted DNS is blocked on a lot of free WiFi. Now what? DoH solves this issue, as it was designed to. DoH can traverse even the most locked down network over the same HTTPS channel as any other web traffic. > You don't get privacy by centralizing all of your requests onto one server. Perhaps, but it scales really well and is the basis for all current DNS resolution. If everyone on the internet did as you suggested core internet infrastructure would fail under the load. You've essentially killed almost all caching.

deleted 7y ago
[deleted]
acqq 7y ago
> With DoH you can pick a privacy focused endpoint and nobody between you or that endpoint can trivially monitor your DNS. Even with the DoH which site you access is still trivially to track by your ISP and anybody along the wire as the site name is still not encrypted in the TLS connection traffic.
- Someone1234 7y ago
  > site name is still not encrypted in the TLS connection traffic Encrypted SNI is solves exactly that and is becoming increasingly common. None of these solutions work individually to solve privacy problems but all of them together are substantially increasing the cost and decreasing the accuracy of profiling users on-mass. DoT never gained widespread adoption as an endpoint solution due to compatibility problems. It is technically the superior choice (Vs. DoH), but what good is superior if it breaks all the time? DoH is more imperfect but actually works reliably across different network configurations and client devices, which means it "wins" even if it is "worse."
  - acqq 7y ago
    > Encrypted SNI is solves exactly that and is becoming increasingly common. Can you please elaborate? I know only this: https://serverfault.com/questions/976377/how-can-i-set-up-encrypted-sni-on-my-own-servers https://serverfault.com/questions/976377/how-can-i-set-up-en... "Encrypted Server Name Indication (ESNI) is still an Internet Draft, you will not find it in any major server implementation as it is subject to change. In fact, the draft version implemented by Firefox supports draft-ietf-tls-esni-01 which is incompatible with newer draft versions." Edit: I see Firefox Nightly is mentioned, it is the version that normal users who use Firefox (Firefox has at the moment less than 5% worldwide marker share) just don't use (it annoyingly updates every night).
    - Someone1234 7y ago
      Cloudflare's entire network supports it and Firefox Nightly can consume it see: https://blog.cloudflare.com/encrypted-sni/ https://blog.cloudflare.com/encrypted-sni/ That means over 10% of the internet's traffic supports ESNI (even if <1% of clients consume it regularly). We're also seeing additional vendors explore ESNI, including Chrome's team who have said they will look into implementing it when the spec is finalized.
    - judge2020 7y ago
      It's a draft, which means it's being pushed towards being standardized. Currently you can enable it in Firefox and Cloudflare will negotiate with eSNI. Chances are this will break some middleboxes once Chrome rolls out the standard [after the standard is finalized].
    - deleted 7y ago
      [deleted]
    - jdc 7y ago
      Look for network.security.esni.enabled in your Firefox config and set it true and you should be good to go.
  - fanf2 7y ago
    I don’t know why you say “DoT never gained widespread adoption” - it is a very new protocol so it is way too early to assess. But it is supported in recent android and works fine. I have not heard of any compatibility problems with DoT. Do you have any references? I have written a DoH + DoT server https://github.com/fanf2/doh101 https://github.com/fanf2/doh101 which I am running in production. DoT is popular, DoH is basically only used by me.
zzzcpan 7y ago
> It stops passive eavesdropping. Do you know why Tor exists? Because things like DoH don't stop passive eavesdropping, and DoH in particular only leaks information to more parties, without stopping any eavesdropping whatsoever. I guess it's easy to confuse, thinking that DNS is some private data, but DNS is not even data, it's metadata and other sources of metadata leak much more information than DNS and let build much more detailed profile on you. For example, almost all of the top million websites are uniquely identifiable just by looking at IP addressed in IP packets, as page loads force browsers to make requests to many different IPs and give sort of fingerprints of visits. Nothing short from decentralized overlay network can help with that. > DoT and even unencrypted DNS is blocked on a lot of free WiFi. Now what? DoH solves this issue, as it was designed to. No, it was not designed to solve that issue. It was designed to tunnel and control DNS traffic by a corporation. Mozilla eventually agreed to provide a convenient way to block DoH as well as DoH providers agreed to be blockable. So you should expect DoH to be equally or even more blocked everywhere, where DoT is blocked. You know there are plenty of papers on privacy. No need to repeat all that false propaganda from corporations.
- tracker1 7y ago
  Who does DoH "leak" information to besides your DNS host?
usr1106 7y ago
> DoH can traverse even the most locked down network over the same HTTPS channel as any other web traffic. Given there is a virtually unlimited number of DoH servers you can trust available. With only a couple of servers available it is easy to block them.
ryan_hallinger 7y ago
Hi Someone1234, I would be keen to discuss the topic further with you. What's the best way to connect?

deleted 7y ago

[deleted]

acqq 7y ago

> With DoH you can pick a privacy focused endpoint and nobody between you or that endpoint can trivially monitor your DNS. Even with the DoH which site you access is still trivially to track by your ISP and anybody along the wire as the site name is still not encrypted in the TLS connection traffic.

Someone1234 7y ago
> site name is still not encrypted in the TLS connection traffic Encrypted SNI is solves exactly that and is becoming increasingly common. None of these solutions work individually to solve privacy problems but all of them together are substantially increasing the cost and decreasing the accuracy of profiling users on-mass. DoT never gained widespread adoption as an endpoint solution due to compatibility problems. It is technically the superior choice (Vs. DoH), but what good is superior if it breaks all the time? DoH is more imperfect but actually works reliably across different network configurations and client devices, which means it "wins" even if it is "worse."
- acqq 7y ago
  > Encrypted SNI is solves exactly that and is becoming increasingly common. Can you please elaborate? I know only this: https://serverfault.com/questions/976377/how-can-i-set-up-encrypted-sni-on-my-own-servers https://serverfault.com/questions/976377/how-can-i-set-up-en... "Encrypted Server Name Indication (ESNI) is still an Internet Draft, you will not find it in any major server implementation as it is subject to change. In fact, the draft version implemented by Firefox supports draft-ietf-tls-esni-01 which is incompatible with newer draft versions." Edit: I see Firefox Nightly is mentioned, it is the version that normal users who use Firefox (Firefox has at the moment less than 5% worldwide marker share) just don't use (it annoyingly updates every night).
  - Someone1234 7y ago
    Cloudflare's entire network supports it and Firefox Nightly can consume it see: https://blog.cloudflare.com/encrypted-sni/ https://blog.cloudflare.com/encrypted-sni/ That means over 10% of the internet's traffic supports ESNI (even if <1% of clients consume it regularly). We're also seeing additional vendors explore ESNI, including Chrome's team who have said they will look into implementing it when the spec is finalized.
  - judge2020 7y ago
    It's a draft, which means it's being pushed towards being standardized. Currently you can enable it in Firefox and Cloudflare will negotiate with eSNI. Chances are this will break some middleboxes once Chrome rolls out the standard [after the standard is finalized].
  - deleted 7y ago
    [deleted]
  - jdc 7y ago
    Look for network.security.esni.enabled in your Firefox config and set it true and you should be good to go.
- fanf2 7y ago
  I don’t know why you say “DoT never gained widespread adoption” - it is a very new protocol so it is way too early to assess. But it is supported in recent android and works fine. I have not heard of any compatibility problems with DoT. Do you have any references? I have written a DoH + DoT server https://github.com/fanf2/doh101 https://github.com/fanf2/doh101 which I am running in production. DoT is popular, DoH is basically only used by me.

zzzcpan 7y ago

> It stops passive eavesdropping. Do you know why Tor exists? Because things like DoH don't stop passive eavesdropping, and DoH in particular only leaks information to more parties, without stopping any eavesdropping whatsoever. I guess it's easy to confuse, thinking that DNS is some private data, but DNS is not even data, it's metadata and other sources of metadata leak much more information than DNS and let build much more detailed profile on you. For example, almost all of the top million websites are uniquely identifiable just by looking at IP addressed in IP packets, as page loads force browsers to make requests to many different IPs and give sort of fingerprints of visits. Nothing short from decentralized overlay network can help with that. > DoT and even unencrypted DNS is blocked on a lot of free WiFi. Now what? DoH solves this issue, as it was designed to. No, it was not designed to solve that issue. It was designed to tunnel and control DNS traffic by a corporation. Mozilla eventually agreed to provide a convenient way to block DoH as well as DoH providers agreed to be blockable. So you should expect DoH to be equally or even more blocked everywhere, where DoT is blocked. You know there are plenty of papers on privacy. No need to repeat all that false propaganda from corporations.

tracker1 7y ago
Who does DoH "leak" information to besides your DNS host?

usr1106 7y ago

> DoH can traverse even the most locked down network over the same HTTPS channel as any other web traffic. Given there is a virtually unlimited number of DoH servers you can trust available. With only a couple of servers available it is easy to block them.

ryan_hallinger 7y ago

Hi Someone1234, I would be keen to discuss the topic further with you. What's the best way to connect?