News for hackers. Stuff that matters.
Re:A safer and more private browsing experience with Secure DNS by tptacek on Tuesday May 19, 2020 @10:30PM (#23242706)
There is DNS-over-TLS. The difference between DoH and DoT is that DoT runs over a distinct port, and can be trivially filtered by network operators. DoH was created specifically to run encrypted DNS over a transport that would require more intensive filtering to block. As an anti-censorship mechanism, it's imperfect, but it comes at little real cost (other than preventing operators from blocking encrypted DNS, which is the point).

DoT is, effectively, DoH with a kill switch.

It'e essentially a moot point at this point; DoH won.

Re:A safer and more private browsing experience with Secure DNS by eatbitseveryday on Tuesday May 19, 2020 @10:50PM (#23242829)
Hm, why not add an encryption-upgrade path to the protocol using the same port? Why must we use another port?
Re:A safer and more private browsing experience with Secure DNS by pas on Wednesday May 20, 2020 @05:51AM (#23245022)
Again, trivially easy to block that. But DoH is real HTTP(S), you cannot really distinguish it from a HTTPS request for wikipedia.org or outlook.com.

The SNI hole is slowly being addressed by ESNI - https://www.cloudflare.com/ssl/encrypted-sni/