3 ms·
I deployed DNS-over-TLS on Cambridge University’s resolvers in late 2018, and at that time Android already had a superb implementation, that respected the DNS s
by fanf2 5y ago
I deployed DNS-over-TLS on Cambridge University’s resolvers in late 2018, and at that time Android already had a superb implementation, that respected the DNS server’s advertised connection idle times, and used TLS session caching to make reconnection faster.
IIRC an idle time of about 10 seconds seemed reasonable: long enough to be used for all the DNS requests even from a slow web page, but not so long that the server spends ages keeping state that will never be reused.
- rektide 5y agoIn general the Privacy Considerations section (7, slightly below what I cited, 5) is quite impressive & well considered. There are pretty strong & conservative recommendations: only use session resumption once, for one example. I have a lot of faith a) these specs have identified the potential issues fairly well, b) they have adequate & good recommendations, c) most implementations will follw these recommendations, and d) the alarm/alert will go up if implemenatations start undercutting significantly on privacy measures. Generally I think there's no present due cause for alarm, at all. Privacy is a real concern & risking it is an acknowledged existential risk that no standards bodies would pave over in todays or tomorrows world.