Re:UK Politicians Disapprove of DNS over HTTPS (DoH)
by johnnyapol on Sunday August 11, 2019 @06:13PM
(#20670879)
Just out of curiosity, though, how could I block network traffic that did not use a specific DNS server to progress? Even on public wifi, like Amtrak, where I am required to use a captive portal on first connect before anything can be done, I can, after accepting their TOS, re-load dnscrypt-proxy and be back on my merry way. In addition, some things don't even need DNS to function at all (what if I memorized the IP? What if the IP is hard-coded in?)
They could probably say "drop all requests to 1.1.1.1, etc." but nothing is stopping me from running my own DoH resolver that they would have to manually scan for.
Re:UK Politicians Disapprove of DNS over HTTPS (DoH)
by beatgammit on Sunday August 11, 2019 @09:29PM
(#20671729)
They could always just have a whitelist or force you to use their TLS cert so they can decrypt everything, and they'd just block anything that they can't filter. If they're using a whitelist and you need to access something, they check it out and add it to the whitelist if it seems reasonably secure.
That being said, I absolutely hate all the filtering crap, so I actively avoid working for any company that decides it needs to see everything I'm doing online.
Re:UK Politicians Disapprove of DNS over HTTPS (DoH)
by brokenmachine on Tuesday August 13, 2019 @02:22AM
(#20683266)
>I actively avoid working for any company that decides it needs to see everything I'm doing online
So in the interview, you actually ask, "do you have a filtering proxy to monitor workers internet traffic?"
They can and should secure their network, watch out for data exfiltration anyway, etc.
They should disable ever kind of network traffic that does not go through their auditing/filtering proxy (HTTP, DNS, SMTP or whatever).
If they want to support bring-your-own-device, great, configure said devices, set up proxy-auto-configuration, hand out "how to set up your device to work on corp-wifi" flyers, and in general, they have their IT team, let them work and they will figure this out.
The old way of just MITM-ing was always bad for at best it was/is lazy, but in reality it's quite unprofessional and counter-productive for security.