2 ms·
Theoretically, it’s true that DoT can be easily blocked by the network through port blocking and that blocking DoH is a lot more difficult because it’s over the
by AnonHP 6y ago
Theoretically, it’s true that DoT can be easily blocked by the network through port blocking and that blocking DoH is a lot more difficult because it’s over the same port (443) as web traffic.
But in reality, the main browser makers embracing DoH have provided very easy mechanisms for network operators to tell browsers not to use DoH. So it’s not like DoH, at least as implemented by the main browsers, is against enterprises and network management.
- pgl 6y agoI don't really agree here. It's much harder to implement different mechanisms for each browser individually, and now that it's coming on the OS level (iOS 14, MacOS 11, Windows 10), there'll be a whole new set of ways to disable it. Firefox's canary domain method is a bit clunky but at least it can be set up at the DNS server level.