4 ms·
As an infrasec person, DoH is great because we can config manage all the corp devices to use DoH servers run by the company whether not a device is on VPN. Goo
by mcpherrinm 2y ago
As an infrasec person, DoH is great because we can config manage all the corp devices to use DoH servers run by the company whether not a device is on VPN. Good visibility into what devices are looking up, easy internal domains, and ensuring malware domains are blocked on and off network.
At least the companies I’ve been working for have a lot more laptops at coffee shops and weworks, and probably not on a VPN half the time either. DoH has been a way bigger win than a hassle for me.
- sidewndr46 2y agohow would you ever get online at a coffee shop? Almost all of this use a captive portal that redirects DNS to some internal webpage making you click a button that says "I agree to your completely absurd terms and conditions"
- jeremyjh 2y agoI can use a mobile hotspot on my phone basically everywhere I go. Public Wifi is most often garbage throughput compared to 5g.
- SoftTalker 2y agoI have found that fewer places seem to be doing captive portals and are just going back to open wifi or maybe a well-posted password. Maybe they are realizing there's not a lot of value to it as almost all browser traffic is encrypted these days.
- grishka 2y agoA good implementation of DoH/DoT would use regular DNS in these situations.
- chupasaurus 2y agoIf you have any Windows devices they are leaking DNS requests no matter the setup as long as they are getting DNS servers from DHCP that aren't yours.