9 ms·
Sorry to say this out loud, but this article is poorly written and has many misconceptions about DoH, DoT and browsers. Feel free to chide and correct my commen
by AnonHP 6y ago
Sorry to say this out loud, but this article is poorly written and has many misconceptions about DoH, DoT and browsers. Feel free to chide and correct my comments below.
> DNS-over-HTTPS isn’t used by Firefox and Google because it’s superior to DoT. It’s used because browsers operate at the HTTPS layer by default, so DNS-over-TLS doesn’t make sense (as things stand now) for a browser to implement.
Umm, browsers need to handle TLS in order to support HTTPS. I don’t know where this idea popped up that browsers only know about HTTPS and don’t care for or don’t handle TLS. They actually care so much about TLS that they can warn users about deprecated versions of TLS (like TLS 1.0) used by websites and also push web servers and server operators to plan and move to TLS 1.2.
> Google can’t use DNS-over-TLS in their browser because they can’t modify the code on Windows or MacOS operating systems (which only support DoT at the moment) in order to encrypt DNS requests done outside of the browser. And that works for Google and Firefox, because they only need to encrypt DNS requests inside of their browsers.
The latter part is true, that browsers care primarily about their web related DNS requests, but the former part is a big misunderstanding. They could’ve adopted DoT within the browser, but they chose not to for a few reasons that are explained in their FAQs. I’ve seen at least Firefox’s FAQ on why Mozilla chose DoH and not DoT, and that has nothing to do with OS support.
> Meanwhile at DNSFilter, we need to operate DNS encryption not just in the browser, but at the operating system level. That’s why we use DNS-over-TLS:
Well, there are others who provide DoH (yes, DNS Over HTTPS) at the OS level. NextDNS is one example.
- RyanGoosling 6y agoWhy does it show that DNS-over-HTTPS is app layer? Isn't HTTPS HTTP-over-TLS? (transport layer) Therefore DNS-over-HTTPS is (DNS-over-HTTP)-over-TLS? (transport layer)
- mytailorisrich 6y agoHTTP and DNS are all app layer. In fact, so is TLS but is sometimes said to belong to a session layer between the app and transport layer (there is no session layer in the internet protocols suite, this is an OSI layer: TLS is session layer in OSI, application layer in TCP/IP).
- m3047 6y agoI agree, I upvoted it because it's better technically than some of the others I've seen recently. But having DNS and HTTP conceptually jammed sideways into the networking stack makes my head hurt. You're also correct about this: DoT and HTTPS both use TLS (you can use nginx to terminate TLS in front of a DNS server and feed it TCP, just like you can put it in front of a web server).
- shock 6y ago> > DNS-over-HTTPS isn’t used by Firefox and Google because it’s superior to DoT. It’s used because browsers operate at the HTTPS layer by default, so DNS-over-TLS doesn’t make sense (as things stand now) for a browser to implement. > Umm, browsers need to handle TLS in order to support HTTPS. I don’t know where this idea popped up that browsers only know about HTTPS and don’t care for or don’t handle TLS. The author didn't refer to TLS, they referred to HTTPS which is HTTP+(TLS|SSL). The TLS part is common to both DNS-over-HTTPS and DNS-over-TLS. Browsers speak HTTP natively, but they don't speak the DNS protocol. That's the argument the author of the article is making.