3 ms·

I think maybe you misunderstood what I'm asking. Why couldn't such a spy just hardcode their own DNS server IP address, rather than using your network provided

• JohnFen 7y ago
  > If the answer is that you'll blacklist the spy's DNS servers, then how is that any different than the situation with DoH? There are two differences that DoH brings up about this. The first is that because mainstream DNS providers are beginning to support DoH, there is no need for anyone to set up their own private DNS server. In fact, they wouldn't want to -- much better to use a real one that can't be blocked without causing unacceptable collateral damage. The second is that DoH hides the entire interaction from me (unless I do what I did -- implement a MITM proxy to decrypt all HTTPS traffic). > DoH isn't adding any value for the spy unless you are doing deep packet inspection of any packet that contains DNS data. Sure it is. It effectively disables a layer of defenses from the spies.
  • shawnz 7y ago
    > The first is that because mainstream DNS providers are beginning to support DoH, there is no need for anyone to set up their own private DNS server. That was already true though, because they could have used those mainstream providers' unencrypted DNS servers too. > Sure it is. It effectively disables a layer of defenses from the spies. But why would any spy rely on such a layer when you've left the front door (unencrypted DNS) wide open?