News for hackers. Stuff that matters.

A comment on Chrome is deploying HTTP/3 and IETF QUIC. Parent comment

Re:Chrome is deploying HTTP/3 and IETF QUIC by nuker on Thursday October 08, 2020 @02:13AM (#24716383)
> With both a DNS-over-HTTP client and potentially a DNS-over-QUIC in the browser and serving advertisements over QUIC... there is a good chance that the world will see unblockable advertisements

And better tracking. In DoH RFC [0], 8. Privacy Considerations, 8.2. In the Server:

"HTTP's feature set can also be used for identification and tracking in a number of different ways. For example, Authentication request header fields explicitly identify profiles in use, and HTTP cookies are designed as an explicit state-tracking mechanism .."

"Determining whether or not a DoH implementation requires HTTP cookie support is particularly important because HTTP cookies are the primary state tracking mechanism in HTTP. HTTP cookies SHOULD NOT be accepted by DOH clients unless they are explicitly required by a use case."

I will stick to DoT.

[0] https://tools.ietf.org/html/rfc8484

[ Parent | on HN ]
Re:Chrome is deploying HTTP/3 and IETF QUIC by ignoramous on Thursday October 08, 2020 @03:11AM (#24716670)
There are valid uses for DoH, the most important being its counter against internet censorship. For DoT, a block on UDP/853 is all that's needed. Blocking DoH requires much more effort.

Also, it isn't like one couldn't be tracked by DNS resolvers without cookies: https://news.ycombinator.com/item?id=20219878 and https://news.ycombinator.com/item?id=19828702

[ Parent | on HN ]
Re:Chrome is deploying HTTP/3 and IETF QUIC by nuker on Thursday October 08, 2020 @08:18AM (#24718411)
> For DoT, a block on UDP/853 is all that's needed.

I cannot imagine it happening, it has to be blanket ban. Real life examples, excluding China?

> tracked by DNS resolvers without cookies

Thats Very clever :)) Safari fixed similar thing that was using HSTS, but I bet they'll kill this one too.

[ Parent | on HN ]
Re:Chrome is deploying HTTP/3 and IETF QUIC by ignoramous on Thursday October 08, 2020 @10:23AM (#24719311)
> I cannot imagine it happening...

I'm sorry but this is very much going to happen since nearly 1B Androids are now DoT capable. ESNI may also be blocked for same reasons once it is widely deployed.

> Safari fixed similar thing that was using HSTS, but I bet they'll kill this one too.

Safari cannot cover for apps sending DNS requests.

[ Parent | on HN ]
Re:Chrome is deploying HTTP/3 and IETF QUIC by nuker on Friday October 09, 2020 @11:35AM (#24730888)
> .. very much going to happen

That's prediction, not facts I asked for.

[ Parent | on HN ]
Re:Chrome is deploying HTTP/3 and IETF QUIC by ignoramous on Friday October 09, 2020 @01:15PM (#24732108)
Exhibit A: https://ooni.org/post/2020-iran-dot/
[ Parent | on HN ]