4 ms·

>What advantage do you see of DoT over DoH other than that it's easier to block at the network level? If you want to block other people's computers from using D

>What advantage do you see of DoT over DoH other than that it's easier to block at the network level? If you want to block other people's computers from using DoT or DoH, then you're the adversary that they're meant to protect us from. Not GP, but I don't want to block other people's computers. I'm only concerned with my computers. And when one of them gets uppity and tries to bypass the policies on my network, it needs to be smacked down. Hard. As for anyone else's devices? Have at it. Do whatever you want. But my devices on my network will abide by my policies. That may make you wonder if I'm going to try and steal your DNS requests. But don't worry, I won't invite you into my home.

josephcsible 5y ago
> That may make you wonder if I'm going to try and steal your DNS requests. But don't worry, I won't invite you into my home. The problem isn't guests using your house's network. The problem is that if there's a way for you to network-level block DoH at your own house, then nothing is stopping Comcast or China from implementing the same network-level block.
- nobody9999 5y ago
  >The problem isn't guests using your house's network. The problem is that if there's a way for you to network-level block DoH at your own house, then nothing is stopping Comcast or China from implementing the same network-level block. Fair enough. But I'd posit that you can't prevent a bad actor who controls your network access from doing whatever the hell they please with/on your traffic, whether you use DoH or not[0]. [0] cf. Transparent TLS proxies ( https://en.wikipedia.org/wiki/TLS_termination_proxy https://en.wikipedia.org/wiki/TLS_termination_proxy ) Edit: Changed prose to actually make sense.
  - josephcsible 5y ago
    Running a TLS termination proxy would break everything unless they convinced the users to accept their root certificate, so even the most evil ISPs generally don't do that.

josephcsible 5y ago

> That may make you wonder if I'm going to try and steal your DNS requests. But don't worry, I won't invite you into my home. The problem isn't guests using your house's network. The problem is that if there's a way for you to network-level block DoH at your own house, then nothing is stopping Comcast or China from implementing the same network-level block.

nobody9999 5y ago
>The problem isn't guests using your house's network. The problem is that if there's a way for you to network-level block DoH at your own house, then nothing is stopping Comcast or China from implementing the same network-level block. Fair enough. But I'd posit that you can't prevent a bad actor who controls your network access from doing whatever the hell they please with/on your traffic, whether you use DoH or not[0]. [0] cf. Transparent TLS proxies ( https://en.wikipedia.org/wiki/TLS_termination_proxy https://en.wikipedia.org/wiki/TLS_termination_proxy ) Edit: Changed prose to actually make sense.
- josephcsible 5y ago
  Running a TLS termination proxy would break everything unless they convinced the users to accept their root certificate, so even the most evil ISPs generally don't do that.