4 ms·

> I still think DoH is hot garbage and the way it has been implemented across browsers is an atrocity. Not sure if it's a hot garbage, but I don't see why it's

> I still think DoH is hot garbage and the way it has been implemented across browsers is an atrocity. Not sure if it's a hot garbage, but I don't see why it's better than DoT or DoQ, except maybe a use case for censored countries. DoT is faster and can be abstracted away from from HTTP. Presumably, DoH is more privacy preserving, because it runs on the same port and looks just like the rest HTTPS traffic. But I think a spying ISP can probably guess that it's a DNS traffic by where it's going. If it's an HTTPS connection over 443 going to a know DNS server, then it's probably a DNS request, thus I don't see added privacy here. But from traffic administration, it is harder. As a an example, now your Smart Spying Device can phone home and it is going to be harder to block it. Also, we are moving from your ISP knowing too much about you to Cloudflare knowing too much about you. It's one of the biggest DoH DNS services, often they see unencrypted HTTPs traffic, they also an exit node for iCloud Private Relays. ISP is left out, but Cloudflare seems to be able to consolidate this knowledge.

tialaramex 3y ago
Deployability is what matters. DoH had great deployability because everybody speaks HTTPS. In my home, lots of technologies would work. I have static v4 and v6, I have complete control over the firewalls, I can do whatever I want. But at my mum's house, who knows what ports work and which protocols work over them and whether you can change any of that. HTTPS definitely works though, because if it didn't her web browser wouldn't work and she'd yell at the ISP until they fixed it. So that's why DoH.
- YeBanKo 3y ago
  Everybody who speaks HTTPS speaks TLS and the existing DNS-over-TCP. DoT is just DNS-over-TCP tunneled inside TLS. And it can be on any port, not necessarily 853, could be even on 443. What is the point of wrapping it into http request?
  - tatersolid 3y ago
    Because ports other than 443 are often blocked on corporate, hotel, and even coffee shop networks.
josephcsible 3y ago
> I don't see why it's better than DoT or DoQ, except maybe a use case for censored countries. This feels like saying "I don't see why we need oxygen in the atmosphere, except for people needing to breathe." Being able to overcome censorship is a huge win and is more than sufficient for DoH to be better than DoT, etc. > Also, we are moving from your ISP knowing too much about you to Cloudflare knowing too much about you. It's one of the biggest DoH DNS services, often they see unencrypted HTTPs traffic, they also an exit node for iCloud Private Relays. ISP is left out, but Cloudflare seems to be able to consolidate this knowledge. The key making DoH still a net win in spite of that is that your ISP has the mapping from your source IP to your real-life identity, but DoH providers like CloudFlare don't.
- unaindz 3y ago
  And cloudflare already knew what site you were visiting. It's not like they only know it if you use ECH.
d-z-m 3y ago
> If it's an HTTPS connection over 443 going to a know DNS server, then it's probably a DNS request, thus I don't see added privacy here. The ISP doesn't see the DNS request, therefore added privacy(you are presumably contacting a DoH server whom you trust). ISPs can pretty much get away with blocking port 853 without much flak(fairly niche, not much use), but if customers' DoH queries to Cloudflare aren't getting out, people are going to notice.
- YeBanKo 3y ago
  DNS don’t serve regular web traffic, so all the request to DNS server can be classified as DNS request. So what does it add on top of DoT?
  - d-z-m 3y ago
    It's harder to block.
    - YeBanKo 3y ago
      You can run DoT on any port, including 443. Then blocking it gonna be the same as blocking DoH. Why wrap it into HTTP request layer?
      - d-z-m 3y ago
        DoH makes the request look like a regular HTTPS request, therefore you'd need more sophisticated heuristics to block it. If you contend that you can match the DoH SNI with a known DoH server and block that, fair enough. However, there's always another unknown DoH server you haven't blocked. Blocking DoT is trivial in comparison, because of its signature on the wire.

tialaramex 3y ago

Deployability is what matters. DoH had great deployability because everybody speaks HTTPS. In my home, lots of technologies would work. I have static v4 and v6, I have complete control over the firewalls, I can do whatever I want. But at my mum's house, who knows what ports work and which protocols work over them and whether you can change any of that. HTTPS definitely works though, because if it didn't her web browser wouldn't work and she'd yell at the ISP until they fixed it. So that's why DoH.

YeBanKo 3y ago
Everybody who speaks HTTPS speaks TLS and the existing DNS-over-TCP. DoT is just DNS-over-TCP tunneled inside TLS. And it can be on any port, not necessarily 853, could be even on 443. What is the point of wrapping it into http request?
- tatersolid 3y ago
  Because ports other than 443 are often blocked on corporate, hotel, and even coffee shop networks.

josephcsible 3y ago

> I don't see why it's better than DoT or DoQ, except maybe a use case for censored countries. This feels like saying "I don't see why we need oxygen in the atmosphere, except for people needing to breathe." Being able to overcome censorship is a huge win and is more than sufficient for DoH to be better than DoT, etc. > Also, we are moving from your ISP knowing too much about you to Cloudflare knowing too much about you. It's one of the biggest DoH DNS services, often they see unencrypted HTTPs traffic, they also an exit node for iCloud Private Relays. ISP is left out, but Cloudflare seems to be able to consolidate this knowledge. The key making DoH still a net win in spite of that is that your ISP has the mapping from your source IP to your real-life identity, but DoH providers like CloudFlare don't.

unaindz 3y ago
And cloudflare already knew what site you were visiting. It's not like they only know it if you use ECH.

d-z-m 3y ago

> If it's an HTTPS connection over 443 going to a know DNS server, then it's probably a DNS request, thus I don't see added privacy here. The ISP doesn't see the DNS request, therefore added privacy(you are presumably contacting a DoH server whom you trust). ISPs can pretty much get away with blocking port 853 without much flak(fairly niche, not much use), but if customers' DoH queries to Cloudflare aren't getting out, people are going to notice.

YeBanKo 3y ago
DNS don’t serve regular web traffic, so all the request to DNS server can be classified as DNS request. So what does it add on top of DoT?
- d-z-m 3y ago
  It's harder to block.
  - YeBanKo 3y ago
    You can run DoT on any port, including 443. Then blocking it gonna be the same as blocking DoH. Why wrap it into HTTP request layer?
    - d-z-m 3y ago
      DoH makes the request look like a regular HTTPS request, therefore you'd need more sophisticated heuristics to block it. If you contend that you can match the DoH SNI with a known DoH server and block that, fair enough. However, there's always another unknown DoH server you haven't blocked. Blocking DoT is trivial in comparison, because of its signature on the wire.