2 ms·
Yes. Next you'll have to MiTM the DNS over HTTPS. Next in the arms race comes certificate-pinning. Controlling your name resolution will probably remain possibl
by EvanAnderson 5y ago
Yes. Next you'll have to MiTM the DNS over HTTPS. Next in the arms race comes certificate-pinning. Controlling your name resolution will probably remain possible on Linux, but I expect most other platforms will make it exceedingly difficult for "normal" users.
Embedded devices are already "game over". You don't own them (even if you paid for them).
Controlling name resolution on your own network (and MiTM'ing HTTPS) makes you the same as a hostile nation-state actor. We can't have that.
- kelnos 5y ago> Embedded devices are already "game over". You don't own them (even if you paid for them). Ugh, seriously. I have a Chromecast, and couldn't figure out why it wouldn't play things on my local network (via DNS names set up in my router's resolver). Turns out Google hard-codes their own DNS servers and doesn't allow you to change them. The fix was to give the Chromecast a reserved IP address, and then set up some iptables rules on the router to redirect requests from it to 8.8.8.8 and 8.8.4.4 on port 53 to my router. I'm surprised that Chromecast is using old-school port-53 DNS and not DoH.
- throwawaycuriou 5y agois there any alternative software yet that can reproduce the Chromecast, including masquerading as one to my phone?