3 ms·
I haven't looked into DNS-over-HTTP/3 (DoH), but there's a secure-ish DNS mechanism already: DNS over Distributed TLS (DoT) [1]. The main criticisms of DoT are
by Communitivity 4y ago
I haven't looked into DNS-over-HTTP/3 (DoH), but there's a secure-ish DNS mechanism already: DNS over Distributed TLS (DoT) [1].
The main criticisms of DoT are that it's hard to analyze for cybersecurity purposes. Except DoT is not encrypted end-to-end but only encrypted hop-to-hop. This means you can put a proxy checking for cybersecurity threats in front of your DoT traffic into or out of your network, if you need to. DoT can also be peer to peer, which can leverage a lot of benefits. DoH is client-server.
DoH has all the problems that come with HTTP/s and seems a good way to break one of the most relatively reliable systems of the Internet, in the name of convenience.
[1] https://datatracker.ietf.org/doc/html/rfc8094 https://datatracker.ietf.org/doc/html/rfc8094
- tptacek 4y agoNo, the main criticism of DoT is that it's trivial for network operators to block, because it runs on its own port. The entire reason DoH exists is to get past middleboxes.
- codewiz 4y agoDoT is simply DNS-over-TLS (never heard of Distributed TLS). The article linked by this post explains that Android supported DoT since Android 9, but it was problematic because it required frequent TCP handshakes and TLS handshakes. Plus, it could be easily blocked by middle boxes.
- Melatonic 4y agoI think Tmobile is blocking DoT specifically
- codewiz 4y agoDammit, I use T-Mobile. But they can't easily block DoH, since it looks like regular HTTP/3 traffic on UDP port 443.
- Communitivity 4y agoAh, thank you. Then DoT is not really what I meant. Distributed TLS, aka Datagram TLS, aka DLTS, is TLS security mechanisms adapted for use with UDP [1]. [1] https://developer.mozilla.org/en-US/docs/Glossary/DTLS https://developer.mozilla.org/en-US/docs/Glossary/DTLS