4 ms·

> DNS over TSL (DoT) is a much better alternative to DoH, at least when it comes to the ability to be tracked. > For example, because it’s not using HTTP, ther

by growse 7y ago

> DNS over TSL (DoT) is a much better alternative to DoH, at least when it comes to the ability to be tracked. > For example, because it’s not using HTTP, there are no cookies or SNI to worry about. > More at https://news.ycombinator.com/item?id=22418005 https://news.ycombinator.com/item?id=22418005. The fact that it can be trivially blocked by anyone on the network path does not make it "much better".

alwillis 7y ago
The fact that it can be trivially blocked by anyone on the network path does not make it "much better". Of course anyone on the "network path" can block almost any protocol; DoT isn’t unique in that regard. The concern is many large businesses block port 853 but that's because prior to the development of DoT, there was no reason for IT departments to configure firewalls to enable it. Most organizations only have a handful of ports available, including 443, which is what HTTPS uses and therefore DoH works as a result. I've been running DNS over TLS using the Unbound [1] resolver for my home LAN on a spare laptop for a few weeks now and it’s been great. Given the privacy trade-offs between privacy and security, many IT departments would opt to make port 853 available for DoT rather than increasing the ability for their users to be tracked. As I mentioned elsewhere in this thread, the article Centralised DoH is bad for Privacy, in 2019 and beyond [2] clearly describes the issues with DoH: DNS over HTTPS opens up DNS to all the tracking possibilities present in HTTPS and TLS. As it stands, DNS over UDP almost always gets some free privacy by mixing all devices on a network together – an outside snooper sees a stream of queries coming from a household, a coffeeshop or even an entire office building, with no way to tie a query to any specific device or user. Such mixing of queries provides an imperfect but useful modicum of privacy. DNS over HTTPS however neatly separates out each device (and even each individual application on that device) to a separate query stream. This alone is worrying, as we now have individual users’ queries, but the TLS that underlies HTTPS also typically uses TLS Resumption which offers even further tracking capabilities. [1]: https://www.ctrl.blog/entry/unbound-tls-forwarding.html https://www.ctrl.blog/entry/unbound-tls-forwarding.html [2]: https://labs.ripe.net/Members/bert_hubert/centralised-doh-is-bad-for-privacy-in-2019-and-beyond https://labs.ripe.net/Members/bert_hubert/centralised-doh-is...

by growse 7y ago

alwillis 7y ago

The fact that it can be trivially blocked by anyone on the network path does not make it "much better". Of course anyone on the "network path" can block almost any protocol; DoT isn’t unique in that regard. The concern is many large businesses block port 853 but that's because prior to the development of DoT, there was no reason for IT departments to configure firewalls to enable it. Most organizations only have a handful of ports available, including 443, which is what HTTPS uses and therefore DoH works as a result. I've been running DNS over TLS using the Unbound [1] resolver for my home LAN on a spare laptop for a few weeks now and it’s been great. Given the privacy trade-offs between privacy and security, many IT departments would opt to make port 853 available for DoT rather than increasing the ability for their users to be tracked. As I mentioned elsewhere in this thread, the article Centralised DoH is bad for Privacy, in 2019 and beyond [2] clearly describes the issues with DoH: DNS over HTTPS opens up DNS to all the tracking possibilities present in HTTPS and TLS. As it stands, DNS over UDP almost always gets some free privacy by mixing all devices on a network together – an outside snooper sees a stream of queries coming from a household, a coffeeshop or even an entire office building, with no way to tie a query to any specific device or user. Such mixing of queries provides an imperfect but useful modicum of privacy. DNS over HTTPS however neatly separates out each device (and even each individual application on that device) to a separate query stream. This alone is worrying, as we now have individual users’ queries, but the TLS that underlies HTTPS also typically uses TLS Resumption which offers even further tracking capabilities. [1]: https://www.ctrl.blog/entry/unbound-tls-forwarding.html https://www.ctrl.blog/entry/unbound-tls-forwarding.html [2]: https://labs.ripe.net/Members/bert_hubert/centralised-doh-is-bad-for-privacy-in-2019-and-beyond https://labs.ripe.net/Members/bert_hubert/centralised-doh-is...