3 ms·
The user's IP address is masqueraded by the proxy, and neither the DNS mothership (Cloudflare) nor the ISP get to see both who the user is and what they request
by landerwust 6y ago
The user's IP address is masqueraded by the proxy, and neither the DNS mothership (Cloudflare) nor the ISP get to see both who the user is and what they requested. It's an extremely desirable property DoH currently lacks
- TimWolla 6y agoYes, I understand that. But I don't understand what ODoH does better than a run of the mill SOCKS proxy, such as Tor.
- deleted 6y ago[deleted]
- landerwust 6y agoTor is not a run of the mill SOCKS proxy, not least in that it inserts arbitrarily high latency into the user data path. On the other hand, an actual run of the mill SOCKS proxy would have visibility of the user's queries and their identity, defeating the purpose of the design.
- TimWolla 6y ago> an actual run of the mill SOCKS proxy would have visibility of the user's queries and their identity, defeating the purpose of the design. Why would it have visibility of the queries? If I send a TLS connection (containing my DoH query) through that SOCKS proxy, then the SOCKS proxy is unable to decrypt that TLS connection without breaking certificate verification and thus can't read my DoH query.
- landerwust 6y agoVery good point! Sorry, I was confusing myself thinking about classic DNS.