3 ms·
If you run a local DNS server (e.g. AdGuard Home or Pi-Hole) you can set them up as a DoH system and still block requests. My bigger issue with this is that Mi
by dastx 7y ago
If you run a local DNS server (e.g. AdGuard Home or Pi-Hole) you can set them up as a DoH system and still block requests.
My bigger issue with this is that Microsoft is trying to paint themselves as an angel when in reality, as part of Windows 10, they've added so much telemetry, it feels as if they're closer to an ad giant than a software giant.
- tybit 7y agoGenuine question, at that point does DoH buy you anything?
- kodablah 7y agoThere are security benefits of TLS. Now, if you're asking what benefits it has over DNS-over-TLS, making DNS requests indistinguishable from other HTTP requests has privacy/shaping benefits.
- tptacek 7y agoIf you're in the US, your ISP is right now actively recording and monetizing your DNS requests by passive collection. DoH immediately exempts you from this surveillance.
- dastx 7y ago> exempts Specifically, ISPs are unable to read the requests or responses of your DNS requests due to end to end encryption between the client and the DNS server.
- alibert 7y agoOne possible problem is when devices start to use their own hardcoded DoH resolver. Today, Chromecast devices use their own resolver (still standard DNS), tomorrow, they might use DoH resolver. Worse, think about apps starting to do that on your mobile phone... Now, you need MITN on your home network or you block everything to google.dns:443... but what if they rotate their DoH resolvers?
- Someone1234 7y agoAs you said companies are already doing this without DoH so really DoH neither solves this issue nor creates it. It is an issue that will exist no matter what underlying protocol is used for DNS (raw UDP/TCP, DoT, DoH, etc).
- deleted 7y ago[deleted]
- dastx 7y agoAh, yes, didn't think of that. Though, I'm not sure if it's a problem. DNS by nature must be static. Unless something changes you certainly can block DNS addresses, and you can block it indiscriminately on all ports. I don't care what port or protocol used if my non trusted devices contact 8.8.8.8 on any port. If you rotate your resolvers, you'll have to push out a software update to update the DNS servers, which takes time and money.
- EvanAnderson 7y agoMitM wont help, eventually. They'll start pinning certificates. The DNS content filtering ship has sailed. It was nice while it lasted.
- JohnFen 7y ago> If you run a local DNS server (e.g. AdGuard Home or Pi-Hole) you can set them up as a DoH system and still block requests. Yes, but you have no way to force software to use your local DoH resolver.
- dastx 7y agoWhy not? Software that hardcodes DNS servers usually fallback to DHCP, so you can simply block all requests to well known DNS servers, and they will automatically go through the DNS server you've served using DHCP.
- JohnFen 7y agoBecause you have no visibility that the lookup is happening. If software is doing a lookup via DoH, you have no way of knowing that's happening, let alone be able to do anything about it, without MITMing your HTTPS connections. You could, of course, block all requests to public DNS servers, but that's of limited use (do you even know all the public DNS servers in the world?), can cause unacceptable collateral damage, and the fallback of malicious code would probably be to use a private DoH resolver that you don't know about. > they will automatically go through the DNS server you've served using DHCP. This would only be true if the software is using the operating system or browser to do the lookups. If the software is doing the lookups itself without involving the OS or browser (which is trivial to do), then the behavior will be whatever the dev of the malicious code wants it to be.