News for hackers. Stuff that matters.

A comment on NSA Recommends How Enterprises Can Securely Adopt Encrypted DNS. Parent comment

Re:NSA Recommends How Enterprises Can Securely Adopt Encrypt... by 0xquad on Saturday January 16, 2021 @05:07PM (#25805972)
They are responding to the very recent emergence of applications (like Firefox) that (optionally) use their own encrypted DNS, thus bypassing the enterprise's ability to apply security policy based on DNS. (Visibility on DNS is also useful to help detect some malware.) I'll allow it.
[ Parent | on HN ]
Re:NSA Recommends How Enterprises Can Securely Adopt Encrypt... by vaduz on Saturday January 16, 2021 @06:50PM (#25806681)
It's clearly also spurred by the attempts to further obfuscate the use of DoH via Oblivious DoH [0] - though they don't go into much details on it.

[0] https://news.ycombinator.com/item?id=25344358

[ Parent | on HN ]
Re:NSA Recommends How Enterprises Can Securely Adopt Encrypt... by Daho0n on Sunday January 17, 2021 @06:43AM (#25809969)
>thus bypassing the enterprise's ability

I think you could change it to read " bypassing the NSA's ability" and find the real reason behind this.

[ Parent | on HN ]
Re:NSA Recommends How Enterprises Can Securely Adopt Encrypt... by 0xquad on Sunday January 17, 2021 @03:54PM (#25814850)
They aren't recommending you don't use DoH. Just that you don't allow individual apps to bypass your enterprise resolver. In fact I use the same strategy at home (with DoT) to enforce ad and tracker blocking. It's just common sense really.

From the document: >[...] NSA recommends that the enterprise DNS resolver supports encrypted DNS, such as DoH, and that only that resolver be used in order to have the best DNS protections and visibility.

[ Parent | on HN ]