3 ms·
I wonder if you could block unknown DoH endpoints via traffic analysis. They probably have pretty unique signatures, with every request/response being approxima
by rlt 6y ago
I wonder if you could block unknown DoH endpoints via traffic analysis. They probably have pretty unique signatures, with every request/response being approximately the same size.
Not that I want to give anyone ideas.
- tga_d 6y agoI haven't looked closely at DoH, but based on my knowledge of plugable transports and website fingerprinting attacks, the answer is: probably, but with just a little effort on the client side, detection could be made pretty expensive -- probably expensive enough that ads on unresolved domains wouldn't justify it. Basically, if live classification of network traffic on (obfuscated) metadata were easy, China would have deployed it by now.