News for hackers. Stuff that matters.

A comment on Improving DNS Privacy with Oblivious DoH. Parent comment

Re:Improving DNS Privacy with Oblivious DoH by judge2020 on Tuesday December 08, 2020 @03:07PM (#25350644)
> force all embedded devices on my network to go through the pihole

You can only do this for the devices that respect your DHCP-provided DNS config. Even if you redirect all port 53 traffic on your network to your pihole, a device can make its own (DoH or non-DoH) https connection and gets DNS responses via that, bypassing your pi-hole.

This was discussed extensively a few days ago on a thread about "72% of smart TVs and 46% of game consoles hardcode DNS settings":

https://news.ycombinator.com/item?id=25315172

[ Parent | on HN ]
Re:Improving DNS Privacy with Oblivious DoH by quicksilver03 on Wednesday December 09, 2020 @03:01AM (#25356387)
If you control DHCP and know the MAC address of those embedded devices, you can serve them a non-existing gateway so that they simply won't have a path outside of your home network.

Of course, that assumes IPv4, whereas with IPv6 and SLAAC I believe the only way is to firewall them out.

[ Parent | on HN ]
Re:Improving DNS Privacy with Oblivious DoH by GoblinSlayer on Wednesday December 09, 2020 @05:51AM (#25357324)
If they won't ask you to drink a verification can to proceed.
[ Parent | on HN ]