4 ms·
DoT only solves the SNI problem during the DNS request itself. It doesn't do a thing about the SNI during the request to the actual website, which is where all
by alwillis 7y ago
DoT only solves the SNI problem during the DNS request itself. It doesn't do a thing about the SNI during the request to the actual website, which is where all the privacy concerns are.
Sure, but until we have encrypted SNI, which is in draft, meta data is going to leak, but that's a separate issue from either DoT or DoH.
But because DoT doesn't use HTTPS, you don't get some of its downsides like using cookies for tracking, for example.
- zamalek 7y agoDoH (edit from DoT) doesn't use cookies, it is stateless. But your original comment didn't mention that anyway, it only mentioned SNI.
- alwillis 7y agoFrom "The Big DNS Privacy Debate" [1]: DoH shares the benefits and downsides of HTTPS. It sends out more trackable data than regular DNS, simply because HTTP supports things like headers and cookies. TLS session resumption functions as another tracking mechanism. There’s a draft RFC [2] to address these and other privacy issues that weren't specified in the original RFC for DoH. [1]: https://labs.ripe.net/Members/bert_hubert/the-big-dns-privacy-debate https://labs.ripe.net/Members/bert_hubert/the-big-dns-privac... [2]: https://www.ietf.org/archive/id/draft-dickinson-doh-dohpe-00.txt https://www.ietf.org/archive/id/draft-dickinson-doh-dohpe-00...