3 ms·
That's an interesting idea. One downside is that DNS isn't secure. So if someone can MITM your DNS (a coffee shop wifi for example), they could then set cookies
by Thorrez 6y ago
That's an interesting idea. One downside is that DNS isn't secure. So if someone can MITM your DNS (a coffee shop wifi for example), they could then set cookies on com . And if browsers erase cookies as soon as they see this DNS flag, the coffee shop could erase all your google.com cookies for example.
- colordrops 6y agoWhat about secure DNS?
- Thorrez 6y agoThere are multiple different types of secure DNS. DNS-over-HTTPS, DNS-over-TLS, DNSCrypt, DNSCurve, DNSSEC. Some of them don't even protect the client's traffic (you at a coffee shop). DNS-over-HTTPS (DoH) has been getting a lot of publicity lately since Chrome and Firefox started supporting it, but it's only activated sometimes. Many people don't like it: https://news.ycombinator.com/item?id=22414912 https://news.ycombinator.com/item?id=22414912 Another thing: even if your browser is using DoH 100% of the time, that's not good enough. Other things can use the public suffix list, such as a commandline go program that makes http requests[1]. If that program isn't using DoH then it's now vulnerable. Most programs use the DNS resolution capabilities provided by your operating system. I don't think any operating systems by default use DoH. [1] https://golang.org/pkg/net/http/cookiejar/#PublicSuffixList https://golang.org/pkg/net/http/cookiejar/#PublicSuffixList