News for hackers. Stuff that matters.

A comment on Improving DNS Privacy with Oblivious DoH. Parent comment

Re:Improving DNS Privacy with Oblivious DoH by specto on Tuesday December 08, 2020 @02:03PM (#25349872)
I have blocked 1.1.1.1 and 8.8.8.8 and noticed some devices behave very badly, often crashing or restarting. Debugging the issue, once I removed the firewall rule they behaved normally. Almost all of the affected devices were google related, Android TV for example.
[ Parent | on HN ]
Re:Improving DNS Privacy with Oblivious DoH by vetinari on Tuesday December 08, 2020 @03:22PM (#25350830)
You can also DNAT all port 53 traffic to your resolver. Devices will think they are talking to 8.8.8.8 or whatever, but in reality they will ask your resolver and your filtering will apply.

Your filtering can still break these devices.

[ Parent | on HN ]
Re:Improving DNS Privacy with Oblivious DoH by Spivak on Tuesday December 08, 2020 @08:42PM (#25354336)
This only works as long as DNS is both unauthenticated and unencrypted.
[ Parent | on HN ]
Re:Improving DNS Privacy with Oblivious DoH by vetinari on Wednesday December 09, 2020 @07:56AM (#25358004)
Which, at port 53, it is.

Obviously, it would work with DoT (853) only with cert verification disabled.

[ Parent | on HN ]