5 ms·
I wonder if this protocol could provide any relief to network admins trying to protect themselves from aggressive Smart TVs and other IoT devices that use DNS o
by pbronez 6y ago
I wonder if this protocol could provide any relief to network admins trying to protect themselves from aggressive Smart TVs and other IoT devices that use DNS over HTTPS to avoid local DNS blocks. I suspect not, since anything designed to protect against ISP snooping should be available to device manufacturers to protect against local admin snooping.
- skissane 6y agoI guess the only solution is to run your own MITM TLS proxy, and hope that the Smart TV or IoT device lets you install your own root certificate. (Which it quite possibly won't without jailbreaking... and even if it does, it probably isn't documented how to do it)
- unixhero 6y agoThis needs a fix
- michaelmior 6y agoWhy is protection necessary from these devices?
- p00f 6y agoYou can't use a PiHole, for example
- jsjohnst 6y agoDepends on your firewall, but yes you can (assuming your goal is to block those queries)
- eddyg 6y agoWhich firewalls let you block DNS over HTTPS? (Without resorting to blocking random IP addresses from some list that constantly needs updating.)
- jsjohnst 6y agopfSense - it only blocks known DNS over HTTPS servers, but generally all “smart” devices that use it use the publicly available servers. I log and periodically check TCP flow metadata, so I could identify new ones later.
- stephenr 6y agoSeems like a pretty simple solution. Don’t connect the tv to the internet.