News for hackers. Stuff that matters.
Re:A cartoon intro to DNS over HTTPS (2018) by tialaramex on Sunday October 20, 2019 @10:39AM (#21304425)
The intent would be that the device has a setting where you pick which DoH service to use, and if that's a free text input you can put my-doh-server.my-vanity-domain.example

If 90% of users leave it as shipped set to (say) Google, 9% switch to their preferred service and only a handful like you actually type in a DNS name, that freedom to do is preserved. If it doesn't check the certificate from the DoH server when you override the configuration, you are immediately exposed to a MITM so it needs to check. However you'll have no trouble getting a cert for your own FQDN, and that's what the poster you replied to is thinking of.

Re:A cartoon intro to DNS over HTTPS (2018) by xg15 on Sunday October 20, 2019 @02:46PM (#21306164)
Not all devices have a screen or an easy method to input a TRR URL. So even if a vendor has the best intentions, the effort needed to make DoH configurable could be more than what can be justified for a "niche feature".

I believe there are ideas for a network-level autodiscovery of DoH servers, analogous to regular DNS. That would solve the problem, but I can't see how it would get buy-in from the DoH crowd, as it would tie DNS to the network again - and it would still have to be implemented by every single device.

Of course all of this is moot if the vendor actively wants to prevent you from intercepting DNS.