3 ms·

DNS-over-HTTPS needs to die in a fire. There’s absolutely no way for home gateway/DNS to defend against malicious use of DNSSEC proper through DoH at applicati

DNS-over-HTTPS needs to die in a fire. There’s absolutely no way for home gateway/DNS to defend against malicious use of DNSSEC proper through DoH at application level.

detaro 6y ago
> defend against malicious DNSSEC what does that mean?
- egberts1 6y ago
  Not so much a faulty DNSSEC protocol but a misuse of DoH embedded maliciously within applications.
  - mazatta 6y ago
    This vector has always existed - all that changed is RFC 8484 defines a standard way of doing this.
iso1631 6y ago
> DNS-over-HTTPS needs to die in a fire. Sadly not going to happen
tptacek 6y ago
DNS-over-HTTPS has protected more people in just a couple years than 25+ years of DNSSEC standardization attempts. DNSSEC is moribund; meanwhile, it's not a bad bet that most DNS lookups in 5 years will originate over DoH.