3 ms·

True. I'm just saying that it's a lot of work for a pretty small improvement (as the world looks today). But maybe I'm incorrect, maybe this would solve real wo

True. I'm just saying that it's a lot of work for a pretty small improvement (as the world looks today). But maybe I'm incorrect, maybe this would solve real world problems today? I'm just thinking that if you don't have encrypted DNS queries, your basically still revealing similar info (at least on first/uncached connections). If you use DoT to your ISP, they will have similar info. If you use DoH to Google/Cloudflare, they will have similar info. How big is the privacy gain over cleartext SNI on first connection + client side caching of certs and encrypted SNI on later connections? Obviously it depends on your threat model, this + DoH/DoT to someone you trust would protect from plenty of things in an environment where a passive attacker can see your network traffic. But the question is who to trust...

pas 6y ago
It's a long term investment. And it helps especially big sites. It's kind of the new RSA/AES/SSL hype (SSL 3.0 released in 1996, IE shipped with Win95 already supported SSL 2, then Win98SE shipped IE 4.01 if I remember correctly, and ... people were amazed. Ecommerce was all the rage, and boom, dot-com boom.) But it's hopefully done properly this time. :) It's the next logical step. There's no rush to implement it, even if it's nice and shiny. Both Firefox and Chrome already has built-in support for DoH. So encrypted DNS is already getting taken care of. There are an increasing number of providers to choose from: https://github.com/curl/curl/wiki/DNS-over-HTTPS https://github.com/curl/curl/wiki/DNS-over-HTTPS And rolling your own is always an option. Info leak, trust a 3rd party, invest your time, pick your poison :) I think the infoleak is not that serious, because in most cases a passive observer will have the IPs you connect to, and currently it's pretty easy to just enumerate the IPs of the "top 1 million websites" (I have no idea if anyone on Earth still uses the Alexa toolbar at all, or if it exists at all, but that list seems eternal somehow). This is basically where the hiding in the noise strategy is made possible "thanks" to CDNs. If there are thousands of sites all hosted on a handful of IPs then correlating who views what is getting increasingly harder. We shall see if this kind of slow but steady activism helps with government censorship on the long term or not.

pas 6y ago

It's a long term investment. And it helps especially big sites. It's kind of the new RSA/AES/SSL hype (SSL 3.0 released in 1996, IE shipped with Win95 already supported SSL 2, then Win98SE shipped IE 4.01 if I remember correctly, and ... people were amazed. Ecommerce was all the rage, and boom, dot-com boom.) But it's hopefully done properly this time. :) It's the next logical step. There's no rush to implement it, even if it's nice and shiny. Both Firefox and Chrome already has built-in support for DoH. So encrypted DNS is already getting taken care of. There are an increasing number of providers to choose from: https://github.com/curl/curl/wiki/DNS-over-HTTPS https://github.com/curl/curl/wiki/DNS-over-HTTPS And rolling your own is always an option. Info leak, trust a 3rd party, invest your time, pick your poison :) I think the infoleak is not that serious, because in most cases a passive observer will have the IPs you connect to, and currently it's pretty easy to just enumerate the IPs of the "top 1 million websites" (I have no idea if anyone on Earth still uses the Alexa toolbar at all, or if it exists at all, but that list seems eternal somehow). This is basically where the hiding in the noise strategy is made possible "thanks" to CDNs. If there are thousands of sites all hosted on a handful of IPs then correlating who views what is getting increasingly harder. We shall see if this kind of slow but steady activism helps with government censorship on the long term or not.