4 ms·
I never understood DOH over DOT. It makes sense if you want to hide DNS lookups so that people cannot block the DNS queries to ad and other scam networks.
by dev_l1x_be 10mo ago
I never understood DOH over DOT. It makes sense if you want to hide DNS lookups so that people cannot block the DNS queries to ad and other scam networks.
- junon 10mo agoIt's both. In oppressive countries (Iran, China, Russia) where all traffic is filtered, DOH is supposed to help keep things concealed, too.
- itopaloglu83 10mo agoDOH prevents malicious network providers from blocking DOT traffic to enforce their own DNS services for “efficiency” reasons. Most ISPs just want to sell your data and with encrypted client hello and DOH they’re losing visibility into what you’re doing.
- toast0 10mo agoDon't you just intercept traffic to well know recursive resolvers? And then drop packets to ports other than 53?
- zamadatix 10mo agoThat's the beauty of DoH - you don't have to pick a resolver which uses a dedicated IP. You can even stand your own up behind a CDN and blocking it would mean blocking HTTPS traffic to the CDN.
- toast0 10mo agoIf I'm an evil monetizing ISP or a great firewall, I don't really need to catch 100% of the traffic I'm trying to prevent. If there's a handful of people who can circumvent my restrictions, that's fine. As long as I get all the people trying to use popular DNS, that's good enough. If I really do need to get that last bit, there's always other analysis to be done (request/response size/cadence, always talks to host X before making connections to other hosts, etc)
- zamadatix 10mo agoNot 100% of people need/care about such workarounds either though, so it works out. For true government level interest in what you are doing, it's a much harder conversation than e.g. avoiding ISPs making a buck intercepting with wildcard fallbacks and is probably going to need to extend to something well beyond just DoH if one is convinced that's their primary concern.
- itopaloglu83 10mo agoWell, that’s T-Mobile for you. They force you to stay behind their NAT and recently started blocking VPN connections to home labs even.
- 1vuio0pswjnm7 10mo agoExcept encrypted client hello (ECH) is just a draft and isn't being used server side on the public www If I'm wrong then please provide some examples of servers that support ECH
- itopaloglu83 10mo agoISPs and other networks operators are continuously losing insights into the traffic they carry with each privacy oriented technology improvements and they just don’t want to become commodity providers because they can make billions of dollars selling everything from information to prioritized traffic etc.
- 1vuio0pswjnm7 10mo agoWhy does SNI even exist Whoever designed TLS did not expect third parties, so-called "content delivery networks", "cloud providers", etc., wanting to offer hosting to an unlimited number of customers ($$) on a limited pool of IP addresses Problem of cleartext SNI was solved in 2011, well before "QUIC" existed http://curvecp.org/addressing.html http://curvecp.org/addressing.html Without TLS and without SNI anyone can host multiple HTTPS sites on a single IP address
- zamadatix 10mo agoDOT picked an odd port, DOH uses 443. Otherwise they both have the benefits of TLS.
- wongogue 10mo agoMy ISP (my area is serviced by 1 more but they offer lower speeds) blocks the DoT port. They cannot block 443. If they start blocking popular DoH domains, I can use any of the mirrors or run my own over https://wongogue.in/catpics/ https://wongogue.in/catpics/
- zokier 10mo agoDoQ is better than either dot/doh
- 1vuio0pswjnm7 10mo agoDNSCurve is better than DoQ
- jeroenhd 10mo agoThanks to the ossification of the internet, every new protocol or protocol extension needs to be over HTTPS. DoT works fine, it's supported on all kinds of operating systems even if they don't advertise it, but DoH arrived in browsers. Some shitty ISPs and terrible middleboxes also block DoT (though IMO that should be a reason to switch ISPs, not a reason to stop using DoT). On the hosting side, there are more options for HTTP proxies/firewalls/multiplexers/terminators than there are for DNS, so it's easier to build infra around DoH. If you're just a small server, you won't need more than an nginx stream proxy, but if you're doing botnet detection and redundant failovers, you may need something more complex.
- arbll 10mo ago> though IMO that should be a reason to switch ISPs, not a reason to stop using DoT If you have that choice, there's many countries that really want to control what their citizens see and can access at this point. If we had DoH + ECH widely adopted it would heavily limit their power.
- ori_b 10mo ago> Thanks to the ossification of the internet, every new protocol or protocol extension needs to be over HTTPS. If someone can tell you're using HTTPS instead of some other TLS-encrypted protocol, that means they've broken TLS.
- toast0 10mo ago> If someone can tell you're using HTTPS instead of some other TLS-encrypted protocol, that means they've broken TLS. Lots of clients just tell the world. ALPN is part of the unecrypted client hello.
- kassner 10mo agoI’d say nowadays 443/tcp is the only port that you’ll find open in any usable network, anything else is part of a corporate network whack-a-mole game. So while DoH and DoT traffic shouldn’t be distinguishable, 853/tcp is surely a weird port in the grand scheme of things.
- josephcsible 10mo agoBecause if you're on the kind of malicious network that's the reason to use encrypted DNS at all, then your connection attempts on port 853 will probably just get blocked wholesale. DoH is better since it looks the same as all other HTTPS traffic. And you can still block ad and scam domains with DoH. Either do so with a browser extension, in your hosts file, or with a local resolver that does the filtering and then uses DoH to the upstream for any that it doesn't block.
- dev_l1x_be 10mo ago> And you can still block ad and scam domains with DoH. How? There are certain browsers that ignore your DNS settings and talk directly to DoH servers. How could I check what is that the browser requesting through a SSL session? Do you want me to spoof a cert and put it on a MITM node? These are my nameservers: nameserver 10.10.10.65 nameserver 10.10.10.66 If the browser plays along than talking to these is the safest bet for me because it runs AdGuardHome and removes any ad or malicious (these are interchangable terms) content by returning 0.0.0.0 for those queries. I use DoT as uplink so the ISP cannot look into my traffic and I use http->https upgrades for everything. For me DoH makes it harder to filter the internet.
- josephcsible 10mo agoAdGuard has a DoH server. Just configure your browser to use https://dns.adguard-dns.com/dns-query https://dns.adguard-dns.com/dns-query for it.
- zamadatix 10mo agoThere are a plethora of ways to control whether the browser uses its own DoH or the system DNS. Some inside the browser itself, some in the machine's OS, and some from the local network. You can also configure the browser to use your chosen DoH server directly, but this is often as much work as just telling the browser to use the system DNS server and setting that up as DoH anyways.
- TZubiri 10mo ago[dead]
- 1vuio0pswjnm7 10mo agoAnyone who has their DNS filtered, e.g., by ISPs that redirect DNS port numbers, like hotels, can use DoH to work around the problem