4 ms·
How do they disable DoH? They block TLS over that port?
by microcolonel 6y ago
How do they disable DoH? They block TLS over that port?
- nix23 6y agoThats DoT, DoH ist just a dns query over https(443)
- microcolonel 6y agoAlright, I repeat my question, since it's almost identical: how do they block that? HTTPS starts with opening a TLS socket, how do they reliably determine that they can drop that traffic?
- cbg0 6y agoI don't know if Verizon is actively doing it, but since most providers that offer DoH have well-known IPs, like 8.8.8.8, 1.1.1.1, 9.9.9.9, they could easily just block traffic heading in that direction.
- deleted 6y ago[deleted]
- o-__-o 6y agoThis follows along with what I read, at first it’s easy to block but it’s a losing proposition because anyone can stand up a doh server (which is also a network security nightmare)
- manquer 6y agoNot sure what has changed security wise. Any one could also stand a DNS resolver. Many people use hosts file or used a local resolver for dev domains for example, security minded folks setup up resolvers on openWRT stack router for example or a use a piHole. Blocking popular DNS providers is a common tactic deployed by ISPs. It is technically easy enough to bypass depending on your skill level and interest in doing so. Their strategy is make it difficult for majority of their users, who won't know or care, users doing all this will not make substantial impact on revenue generated from selling this data, or from showing adds etc so they don't make the effort. DoT/DoH is not going to change this, Firefox's market share is not enough for that. I don't see Chrome or Safari implementing this functionality at all.
- o-__-o 6y agoOkay that’s great for my developers now what happens when they download some malicious script modified their doh queries to use their servers instead of my corporate wins?
- nix23 6y agoI don't think they do that.
- swiley 6y agoMozilla provides instructions for network operators that want to block it.