News for hackers. Stuff that matters.

A comment on DNS over HTTPS–What Is It and Why Do People Care? [pdf]. Parent comment

Re:DNS over HTTPS–What Is It and Why Do People Care? [pdf] by iampims on Monday October 21, 2019 @12:10AM (#21309295)
in my experience, it's not about the protocols, it's about all existing middleboxes blocking/intercepting all traffic on non 443 ports. UDP traffic is notoriously blocked by routers. The only viable option being: HTTPS.
[ Parent | on HN ]
Re:DNS over HTTPS–What Is It and Why Do People Care? [pdf] by defanor on Monday October 21, 2019 @12:42AM (#21309399)
> The only viable option being: HTTPS.

But why not DoT on port 443?

The story about office workers, sysadmins, and service providers trying to make life harder for each other and complicating things for everyone seems unfortunate, but makes sense, yet I don't quite see why HTTP has to be involved.

[ Parent | on HN ]
Re:DNS over HTTPS–What Is It and Why Do People Care? [pdf] by bluejekyll on Monday October 21, 2019 @01:46AM (#21309616)
HTTP2 isn't significantly more overhead than TLS in my experience.

Also, using DoT over 443 would mean that you have an issue with traffic not being distinguishable for routing purposes at the edge. By making DNS on 443 DoH, it means that all HTTP2 routers/loadbalancers/etc. can work the same regardless of it being a Web request or a DNS request, because then they are both Web, i.e. HTTP, requests.

[ Parent | on HN ]
Re:DNS over HTTPS–What Is It and Why Do People Care? [pdf] by sundbry on Monday October 21, 2019 @12:11AM (#21309303)
Probably because in your corporate/controlled environment you're supposed to use the company DNS for a good reason.
[ Parent | on HN ]
Re:DNS over HTTPS–What Is It and Why Do People Care? [pdf] by bluejekyll on Monday October 21, 2019 @01:49AM (#21309626)
If you're not using a VPN, DNS is actually pretty easily spoofed. DoH and DoT make that much harder.
[ Parent | on HN ]