4 ms·
It still allows to snoop on people's browsing history by looking at DNS lookups. And even mount some attacks against insecure client software that you might be
by roblabla 7y ago
It still allows to snoop on people's browsing history by looking at DNS lookups. And even mount some attacks against insecure client software that you might be running.
The solutions to DNS snooping and tampering (DoH, DoTLS, DNSSEC, etc...) are still not wildly deployed or supported, and it'll take a while until they are. Even if browsers implement DoH, there is a large amount of software that does DNS requests using the system's default, insecure resolver. Those software might not have secure encryption (e.g. using their own protocol), or might be using outdated encryption software (e.g. using an old version of OpenSSL). If those software have vulnerabilities in them, anyone on an unencrypted WiFi can spoof your DNS and exploit this vulnerability.
- tptacek 7y agoDNSSEC is not a solution to snooping or tampering in this setting. Ironically, against link-layer attacks like this, DoH does address both.
- kevincox 7y agoDoH is good for tampering but doesn't help much against snooping since generally you will then connect to (almost) every site with a plaintext SNI.
- tptacek 7y agoThe attack we're talking about on this thread is people using KROOK to snoop on DNS lookups. DoH decisively addresses that threat, and DNSSEC does literally nothing about it; it doesn't even address integrity in this setting; link-layer DNS attacks will reveal QIDs that can be used to spoof AD=1 responses to DNSSEC-validated queries, and that obviously doesn't work against DoH.
- corey_moncure 7y agoWireguard + pi-hole is the solution I'm moving to.