News for hackers. Stuff that matters.

A comment on 1.1.1.1: Fast, privacy-first consumer DNS service. Parent comment

Re:1.1.1.1: Fast, privacy-first consumer DNS service by tyingq on Sunday April 01, 2018 @11:39AM (#16728813)
Dns over https would be harder for governments and other middleman to block or intercept, despite it being less efficient. It would look like any other https request. Especially if browsers agreed to universally support it.
[ Parent | on HN ]
Re:1.1.1.1: Fast, privacy-first consumer DNS service by IshKebab on Sunday April 01, 2018 @11:54AM (#16728893)
No it wouldn't. They're both encrypted with the same method so they can't tell whether http is used or not.
[ Parent | on HN ]
Re:1.1.1.1: Fast, privacy-first consumer DNS service by kpcyrd on Sunday April 01, 2018 @12:16PM (#16729014)
tls isn't magic, you can still observe the encrypted stream and make assumptions based on bytes sent/received on the wire, protocol patterns and timing. See the crime and breach attack.
[ Parent | on HN ]
Re:1.1.1.1: Fast, privacy-first consumer DNS service by tyingq on Sunday April 01, 2018 @12:08PM (#16728981)
Sorry, confused. Https requests are prolific, while encrypted DNS requests aren't. Why isn't the former less hard to detect?
[ Parent | on HN ]
Re:1.1.1.1: Fast, privacy-first consumer DNS service by ori_b on Sunday April 01, 2018 @03:36PM (#16730007)
How would you tell that an encrypted chunk of data is HTTPS instead of DNS? The best you'd be able to do is guess based on behavior that it's DNS.
[ Parent | on HN ]
Re:1.1.1.1: Fast, privacy-first consumer DNS service by tyingq on Monday April 02, 2018 @08:10PM (#16740681)
Destination port might be easy to differentiate dns over tls vs dns over https :)
[ Parent | on HN ]
Re:1.1.1.1: Fast, privacy-first consumer DNS service by forapurpose on Sunday April 01, 2018 @02:53PM (#16729817)
Perhaps if the attacker filters traffic first by protocol, it's harder but not at all impossible. I'd guess that DNS-over-HTTPS packets won't be hard to identify by other means.
[ Parent | on HN ]
Re:1.1.1.1: Fast, privacy-first consumer DNS service by patrickmcmanus on Sunday April 01, 2018 @03:12PM (#16729898)
of course dns over https to cloudflare can be mixed on the same h2 connection with other https to the same host. It starts to get interesting.

(this is one of the advantages of https vs straight tls)

[ Parent | on HN ]