4 ms·

Don't those disadvantages apply just the same to your blacklisting of marketers' DNS servers?

by shawnz 7y ago

JohnFen 7y ago
Indeed they do, which is why that's not a sufficient defense all by itself. The next level up is to block the DNS lookups that happen when the spies are trying to find their servers. That's what DoH prevents.
- shawnz 7y ago
  I think maybe you misunderstood what I'm asking. Why couldn't such a spy just hardcode their own DNS server IP address, rather than using your network provided DNS server? If the answer is that you'll blacklist the spy's DNS servers, then how is that any different than the situation with DoH? DoH isn't adding any value for the spy unless you are doing deep packet inspection of any packet that contains DNS data.
  - JohnFen 7y ago
    > If the answer is that you'll blacklist the spy's DNS servers, then how is that any different than the situation with DoH? There are two differences that DoH brings up about this. The first is that because mainstream DNS providers are beginning to support DoH, there is no need for anyone to set up their own private DNS server. In fact, they wouldn't want to -- much better to use a real one that can't be blocked without causing unacceptable collateral damage. The second is that DoH hides the entire interaction from me (unless I do what I did -- implement a MITM proxy to decrypt all HTTPS traffic). > DoH isn't adding any value for the spy unless you are doing deep packet inspection of any packet that contains DNS data. Sure it is. It effectively disables a layer of defenses from the spies.
    - shawnz 7y ago
      > The first is that because mainstream DNS providers are beginning to support DoH, there is no need for anyone to set up their own private DNS server. That was already true though, because they could have used those mainstream providers' unencrypted DNS servers too. > Sure it is. It effectively disables a layer of defenses from the spies. But why would any spy rely on such a layer when you've left the front door (unencrypted DNS) wide open?

Don't those disadvantages apply just the same to your blacklisting of marketers' DNS servers?

by shawnz 7y ago

Don't those disadvantages apply just the same to your blacklisting of marketers' DNS servers?

Indeed they do, which is why that's not a sufficient defense all by itself. The next level up is to block the DNS lookups that happen when the spies are trying to find their servers. That's what DoH prevents.

shawnz 7y ago
I think maybe you misunderstood what I'm asking. Why couldn't such a spy just hardcode their own DNS server IP address, rather than using your network provided DNS server? If the answer is that you'll blacklist the spy's DNS servers, then how is that any different than the situation with DoH? DoH isn't adding any value for the spy unless you are doing deep packet inspection of any packet that contains DNS data.
- JohnFen 7y ago
  > If the answer is that you'll blacklist the spy's DNS servers, then how is that any different than the situation with DoH? There are two differences that DoH brings up about this. The first is that because mainstream DNS providers are beginning to support DoH, there is no need for anyone to set up their own private DNS server. In fact, they wouldn't want to -- much better to use a real one that can't be blocked without causing unacceptable collateral damage. The second is that DoH hides the entire interaction from me (unless I do what I did -- implement a MITM proxy to decrypt all HTTPS traffic). > DoH isn't adding any value for the spy unless you are doing deep packet inspection of any packet that contains DNS data. Sure it is. It effectively disables a layer of defenses from the spies.
  - shawnz 7y ago
    > The first is that because mainstream DNS providers are beginning to support DoH, there is no need for anyone to set up their own private DNS server. That was already true though, because they could have used those mainstream providers' unencrypted DNS servers too. > Sure it is. It effectively disables a layer of defenses from the spies. But why would any spy rely on such a layer when you've left the front door (unencrypted DNS) wide open?