3 ms·
They don’t hijack https they hijack DoH. The point behind this is to protect the average user but they’re just going to get the recursive resolver from dhcp. Pe
by swiley 6y ago
They don’t hijack https they hijack DoH. The point behind this is to protect the average user but they’re just going to get the recursive resolver from dhcp. People who bother to use something are the same ones who will tunnel traffic or run their own resolver.
- MaxBarraclough 6y ago> They don’t hijack https they hijack DoH DoH stands for DNS-over-HTTPS. You cannot hijack DoH without hijacking an HTTPS connection. > they’re just going to get the recursive resolver from dhcp In answer to my earlier question then, you're using your ISP's DoH DNS service, correct? If that's the case, there's no hijacking going on. > People who bother to use something are the same ones who will tunnel traffic or run their own resolver. This is the reason Firefox went with CloudFlare's DoH. Resisting ISPs' bullshit is much of the point.
- withinboredom 6y ago> You cannot hijack DoH without hijacking an HTTPS connection. Not true. An ISP can always reroute packets where ever they want. Want to reroute from a trusted resolver to your own, which is bootstrapped over regular DNS? No problem. Client checks it? No problem, it will fallback to regular DNS.
- MaxBarraclough 6y ago> Client checks it? No problem, it will fallback to regular DNS. That's a good point, I'd missed that. I'd hope the browser would show a warning in this case though. I don't imagine there'd be any point redirecting a DoH request rather than just blocking it outright though. No serious DoH implementation is going to fail to check the cert.
- valenciarose 6y agoUnless you have trusted a CA from your ISP, they won't have a valid cert. They can divert the packETS, but their response will be invalid (fail when the client checks the cert).
- MaxBarraclough 6y agoI addressed this in my response. You're right that redirection does little more than just blocking the traffic, on account of the certificate check, but if the attacker can force a fallback to regular DNS, that's a problem.
- tptacek 6y agoEvery browser DoH implementation checks certificates.
- swiley 6y agoNope. All you have to do is block the ones the two border vendors use as defaults and you’re back to square one.
- MaxBarraclough 6y agoRight, as withinboredom said. I don't know if ISPs are likely to be so brazen though.