4 ms·

> With both a DNS-over-HTTP client and potentially a DNS-over-QUIC in the browser and serving advertisements over QUIC... there is a good chance that the world

by nuker 6y ago

> With both a DNS-over-HTTP client and potentially a DNS-over-QUIC in the browser and serving advertisements over QUIC... there is a good chance that the world will see unblockable advertisements And better tracking. In DoH RFC [0], 8. Privacy Considerations, 8.2. In the Server: "HTTP's feature set can also be used for identification and tracking in a number of different ways. For example, Authentication request header fields explicitly identify profiles in use, and HTTP cookies are designed as an explicit state-tracking mechanism .." "Determining whether or not a DoH implementation requires HTTP cookie support is particularly important because HTTP cookies are the primary state tracking mechanism in HTTP. HTTP cookies SHOULD NOT be accepted by DOH clients unless they are explicitly required by a use case." I will stick to DoT. [0] https://tools.ietf.org/html/rfc8484 https://tools.ietf.org/html/rfc8484

ignoramous 6y ago
There are valid uses for DoH, the most important being its counter against internet censorship. For DoT, a block on UDP/853 is all that's needed. Blocking DoH requires much more effort. Also, it isn't like one couldn't be tracked by DNS resolvers without cookies: https://news.ycombinator.com/item?id=20219878 https://news.ycombinator.com/item?id=20219878 and https://news.ycombinator.com/item?id=19828702 https://news.ycombinator.com/item?id=19828702
- nuker 6y ago
  > For DoT, a block on UDP/853 is all that's needed. I cannot imagine it happening, it has to be blanket ban. Real life examples, excluding China? > tracked by DNS resolvers without cookies Thats Very clever :)) Safari fixed similar thing that was using HSTS, but I bet they'll kill this one too.
  - ignoramous 6y ago
    > I cannot imagine it happening... I'm sorry but this is very much going to happen since nearly 1B Androids are now DoT capable. ESNI may also be blocked for same reasons once it is widely deployed. > Safari fixed similar thing that was using HSTS, but I bet they'll kill this one too. Safari cannot cover for apps sending DNS requests.
    - nuker 6y ago
      > .. very much going to happen That's prediction, not facts I asked for.
      - ignoramous 6y ago
        Exhibit A: https://ooni.org/post/2020-iran-dot/ https://ooni.org/post/2020-iran-dot/

by nuker 6y ago

ignoramous 6y ago

There are valid uses for DoH, the most important being its counter against internet censorship. For DoT, a block on UDP/853 is all that's needed. Blocking DoH requires much more effort. Also, it isn't like one couldn't be tracked by DNS resolvers without cookies: https://news.ycombinator.com/item?id=20219878 https://news.ycombinator.com/item?id=20219878 and https://news.ycombinator.com/item?id=19828702 https://news.ycombinator.com/item?id=19828702

nuker 6y ago
> For DoT, a block on UDP/853 is all that's needed. I cannot imagine it happening, it has to be blanket ban. Real life examples, excluding China? > tracked by DNS resolvers without cookies Thats Very clever :)) Safari fixed similar thing that was using HSTS, but I bet they'll kill this one too.
- ignoramous 6y ago
  > I cannot imagine it happening... I'm sorry but this is very much going to happen since nearly 1B Androids are now DoT capable. ESNI may also be blocked for same reasons once it is widely deployed. > Safari fixed similar thing that was using HSTS, but I bet they'll kill this one too. Safari cannot cover for apps sending DNS requests.
  - nuker 6y ago
    > .. very much going to happen That's prediction, not facts I asked for.
    - ignoramous 6y ago
      Exhibit A: https://ooni.org/post/2020-iran-dot/ https://ooni.org/post/2020-iran-dot/