3 ms·
You're confusing DoH in "friendly" browsers like Firefox, where you and I might deliberately turn it on to thwart ISP shenanigans. In that case, it's good that
by ohazi 6y ago
You're confusing DoH in "friendly" browsers like Firefox, where you and I might deliberately turn it on to thwart ISP shenanigans. In that case, it's good that DoH is hard to filter and looks like all other TLS traffic.
But the parent is correctly describing DoH as a double-edged sword. The same properties that make it good for you and me when trying to safely access domain data make it a weapon for rogue IoT devices who want to do the same.
Your smart fridge could easily include software that allows it to acquire its own secure DNS info from a DoH network run by the smart fridge manufacturer. This would allow them to find the domains behind the chumbox ads that they want to show you in spite of your PiHole. Since the manufacturer would be doing this to get around a user's desired network configuration, it'll be configurable for them, not for you. You will not be the "owner" of this device.
- jjeaff 6y agoI don't see what any of that has to do with DoH. A device could just as easily use its own private dns service and bypass network filtering as well.
- SethKinast 6y agoOn a properly-configured network, all DNS requests are intercepted and routed to the desired DNS server. I do this to make Google devices respect my DNS preferences (send DNS through PiHole) instead of using their hardcoded setting.
- ocdtrekkie 6y agoUnencrypted DNS can be redirected or inspected and selectively blocked. DoH cannot, and whereas you can selectively tamper with DNS requests to remove advertisers, devices may fail to work at all if you block their DoH provider.