4 ms·
Doesn’t https and subsequently DNS over HTTPS effectively negate pi-hole? Honest inexperienced question.
by cheschire 5y ago
Doesn’t https and subsequently DNS over HTTPS effectively negate pi-hole? Honest inexperienced question.
- sofixa 5y agoHTTPS no, because you're still making regular old DNS queries for every domain, but DNS over HTTPS or stuff like Chromecasts using hardcoded DNS servers do effectively negate Pi-Hole.
- EvanAnderson 5y agoYes. Next you'll have to MiTM the DNS over HTTPS. Next in the arms race comes certificate-pinning. Controlling your name resolution will probably remain possible on Linux, but I expect most other platforms will make it exceedingly difficult for "normal" users. Embedded devices are already "game over". You don't own them (even if you paid for them). Controlling name resolution on your own network (and MiTM'ing HTTPS) makes you the same as a hostile nation-state actor. We can't have that.
- kelnos 5y ago> Embedded devices are already "game over". You don't own them (even if you paid for them). Ugh, seriously. I have a Chromecast, and couldn't figure out why it wouldn't play things on my local network (via DNS names set up in my router's resolver). Turns out Google hard-codes their own DNS servers and doesn't allow you to change them. The fix was to give the Chromecast a reserved IP address, and then set up some iptables rules on the router to redirect requests from it to 8.8.8.8 and 8.8.4.4 on port 53 to my router. I'm surprised that Chromecast is using old-school port-53 DNS and not DoH.
- throwawaycuriou 5y agois there any alternative software yet that can reproduce the Chromecast, including masquerading as one to my phone?
- pkulak 5y agoHTTPS doesn't, though DNS over HTTPS does. No one really uses DNS over HTTPS right now though.