4 ms·
>For devices that aren't fully under your control despite you owning them, couldn't they still do whatever they want by hardcoding the IPs of whatever services
by nobody9999 5y ago
>For devices that aren't fully under your control despite you owning them, couldn't they still do whatever they want by hardcoding the IPs of whatever services they want to talk to, instead of using DNS or anything like it at all? Blocking DoH doesn't fix that problem.
That's absolutely correct. And if any of my devices were doing that (and I've checked, for just that reason), egress filtering can handle blocking such connections just fine.
- josephcsible 5y agoPresumably there's a reason that you give these devices Internet access in the first place. Can't they just use the same host for their nefarious activity that they do for their legitimate activity?
- nobody9999 5y ago>Presumably there's a reason that you give these devices Internet access in the first place. Can't they just use the same host for their nefarious activity that they do for their legitimate activity? You make my point for me. Which is why hiding DNS traffic in https traffic is so insidious. Nuke DoH from orbit. It's the only way to be sure.
- josephcsible 5y agoHow so? My point is that if they do that, then they don't need DoH to do their bad stuff.