3 ms·

> With DoH you can pick a privacy focused endpoint and nobody between you or that endpoint can trivially monitor your DNS. Even with the DoH which site you acc

by acqq 7y ago

> With DoH you can pick a privacy focused endpoint and nobody between you or that endpoint can trivially monitor your DNS. Even with the DoH which site you access is still trivially to track by your ISP and anybody along the wire as the site name is still not encrypted in the TLS connection traffic.

Someone1234 7y ago
> site name is still not encrypted in the TLS connection traffic Encrypted SNI is solves exactly that and is becoming increasingly common. None of these solutions work individually to solve privacy problems but all of them together are substantially increasing the cost and decreasing the accuracy of profiling users on-mass. DoT never gained widespread adoption as an endpoint solution due to compatibility problems. It is technically the superior choice (Vs. DoH), but what good is superior if it breaks all the time? DoH is more imperfect but actually works reliably across different network configurations and client devices, which means it "wins" even if it is "worse."
- acqq 7y ago
  > Encrypted SNI is solves exactly that and is becoming increasingly common. Can you please elaborate? I know only this: https://serverfault.com/questions/976377/how-can-i-set-up-encrypted-sni-on-my-own-servers https://serverfault.com/questions/976377/how-can-i-set-up-en... "Encrypted Server Name Indication (ESNI) is still an Internet Draft, you will not find it in any major server implementation as it is subject to change. In fact, the draft version implemented by Firefox supports draft-ietf-tls-esni-01 which is incompatible with newer draft versions." Edit: I see Firefox Nightly is mentioned, it is the version that normal users who use Firefox (Firefox has at the moment less than 5% worldwide marker share) just don't use (it annoyingly updates every night).
  - Someone1234 7y ago
    Cloudflare's entire network supports it and Firefox Nightly can consume it see: https://blog.cloudflare.com/encrypted-sni/ https://blog.cloudflare.com/encrypted-sni/ That means over 10% of the internet's traffic supports ESNI (even if <1% of clients consume it regularly). We're also seeing additional vendors explore ESNI, including Chrome's team who have said they will look into implementing it when the spec is finalized.
  - judge2020 7y ago
    It's a draft, which means it's being pushed towards being standardized. Currently you can enable it in Firefox and Cloudflare will negotiate with eSNI. Chances are this will break some middleboxes once Chrome rolls out the standard [after the standard is finalized].
  - deleted 7y ago
    [deleted]
  - jdc 7y ago
    Look for network.security.esni.enabled in your Firefox config and set it true and you should be good to go.
- fanf2 7y ago
  I don’t know why you say “DoT never gained widespread adoption” - it is a very new protocol so it is way too early to assess. But it is supported in recent android and works fine. I have not heard of any compatibility problems with DoT. Do you have any references? I have written a DoH + DoT server https://github.com/fanf2/doh101 https://github.com/fanf2/doh101 which I am running in production. DoT is popular, DoH is basically only used by me.

by acqq 7y ago

Someone1234 7y ago

> site name is still not encrypted in the TLS connection traffic Encrypted SNI is solves exactly that and is becoming increasingly common. None of these solutions work individually to solve privacy problems but all of them together are substantially increasing the cost and decreasing the accuracy of profiling users on-mass. DoT never gained widespread adoption as an endpoint solution due to compatibility problems. It is technically the superior choice (Vs. DoH), but what good is superior if it breaks all the time? DoH is more imperfect but actually works reliably across different network configurations and client devices, which means it "wins" even if it is "worse."

acqq 7y ago
> Encrypted SNI is solves exactly that and is becoming increasingly common. Can you please elaborate? I know only this: https://serverfault.com/questions/976377/how-can-i-set-up-encrypted-sni-on-my-own-servers https://serverfault.com/questions/976377/how-can-i-set-up-en... "Encrypted Server Name Indication (ESNI) is still an Internet Draft, you will not find it in any major server implementation as it is subject to change. In fact, the draft version implemented by Firefox supports draft-ietf-tls-esni-01 which is incompatible with newer draft versions." Edit: I see Firefox Nightly is mentioned, it is the version that normal users who use Firefox (Firefox has at the moment less than 5% worldwide marker share) just don't use (it annoyingly updates every night).
- Someone1234 7y ago
  Cloudflare's entire network supports it and Firefox Nightly can consume it see: https://blog.cloudflare.com/encrypted-sni/ https://blog.cloudflare.com/encrypted-sni/ That means over 10% of the internet's traffic supports ESNI (even if <1% of clients consume it regularly). We're also seeing additional vendors explore ESNI, including Chrome's team who have said they will look into implementing it when the spec is finalized.
- judge2020 7y ago
  It's a draft, which means it's being pushed towards being standardized. Currently you can enable it in Firefox and Cloudflare will negotiate with eSNI. Chances are this will break some middleboxes once Chrome rolls out the standard [after the standard is finalized].
- deleted 7y ago
  [deleted]
- jdc 7y ago
  Look for network.security.esni.enabled in your Firefox config and set it true and you should be good to go.
fanf2 7y ago
I don’t know why you say “DoT never gained widespread adoption” - it is a very new protocol so it is way too early to assess. But it is supported in recent android and works fine. I have not heard of any compatibility problems with DoT. Do you have any references? I have written a DoH + DoT server https://github.com/fanf2/doh101 https://github.com/fanf2/doh101 which I am running in production. DoT is popular, DoH is basically only used by me.