Android getting “DNS over TLS” support

Re:Android getting “DNS over TLS” support by NaliSauce on Monday October 23, 2017 @09:19AM (#15532943)

I really like this even though I think it only makes for a minimal increase in privacy due to either SNI[1] or quickly grabbing the cert of an IP revealing the hostname if no SNI is supported.

[1] https://en.wikipedia.org/wiki/Server_Name_Indication

[ Parent | on HN ]

Re:Android getting “DNS over TLS” support by jedisct1 on Monday October 23, 2017 @02:44PM (#15535793)

DNS-over-TLS and DNSCrypt are more about authentication than privacy. They are useful against the guy sitting behind you at Starbucks doing DNS injection.

They don't replace a VPN.

[ Parent | on HN ]

Re:Android getting “DNS over TLS” support by knorker on Monday October 23, 2017 @11:38AM (#15533943)

Doesn't TLS 1.3 fix this SNI hostname leak though?

[ Parent | on HN ]

Re:Android getting “DNS over TLS” support by aaomidi on Monday October 23, 2017 @11:53AM (#15534088)

Nope, they kept it because there weren't better alternatives.

[ Parent | on HN ]

Re:Android getting “DNS over TLS” support by richardjennings on Monday October 23, 2017 @10:09AM (#15533258)

SNI will show the hostname of the "DNS over TLS" server the TLS connection is made with but not the DNS queries made.

[ Parent | on HN ]

Re:Android getting “DNS over TLS” support by Ajedi32 on Monday October 23, 2017 @10:22AM (#15533339)

DNS isn't very useful unless you're actually planning to visit the IPs you just looked up. And as soon as you do that, you'll send the domain name in plaintext via SNI.

[ Parent | on HN ]

Re:Android getting “DNS over TLS” support by johannes1234321 on Monday October 23, 2017 @10:25AM (#15533362)

It will also show the hostname of the server I access after doing the DNS lookup.

[ Parent | on HN ]

Re:Android getting “DNS over TLS” support by LogicX on Monday October 23, 2017 @10:23AM (#15533345)

I don't think so.

The purpose of SNI is to pass the domain name to the final destination server, so it can serve up the correct SSL cert where there are multiple domains hosted on the same IP

[ Parent | on HN ]