4 ms·
No, they only include the DNS server name in cleartext. (Unless I’m misunderstanding DoH)
by svenfaw 6y ago
No, they only include the DNS server name in cleartext. (Unless I’m misunderstanding DoH)
- donatj 6y agoThe lookup is encrypted yes. Your actual subsequent request to the webserver you looked up the DNS entry for however exposes the host in clear text. This is how a lot of corporate firewalls sniff HTTPS requests for host without a root cert. https://security.stackexchange.com/questions/86723/why-do-https-requests-include-the-host-name-in-clear-text https://security.stackexchange.com/questions/86723/why-do-ht...
- terinjokes 6y agoIf you enable it in about:config, Firefox does support the Encrypted SNI proposal when used with DoH and providers that support it. It works for me on Firefox for Android. https://blog.cloudflare.com/encrypted-sni/ https://blog.cloudflare.com/encrypted-sni/ Disclaimer: I work for Cloudflare, but not on this project.
- livre 6y agoESNI is a great solution but unlike DoH it has yet to see wider adoption. I have it enabled and I have Firefox pointed to my local DoH server, the majority of the websites still reply with NXDOMAIN to the _esni query. Besides Cloudflare I've only found 1 other website that has it enabled.