3 ms·
DoH is good for tampering but doesn't help much against snooping since generally you will then connect to (almost) every site with a plaintext SNI.
by kevincox 7y ago
DoH is good for tampering but doesn't help much against snooping since generally you will then connect to (almost) every site with a plaintext SNI.
- tptacek 7y agoThe attack we're talking about on this thread is people using KROOK to snoop on DNS lookups. DoH decisively addresses that threat, and DNSSEC does literally nothing about it; it doesn't even address integrity in this setting; link-layer DNS attacks will reveal QIDs that can be used to spoof AD=1 responses to DNSSEC-validated queries, and that obviously doesn't work against DoH.