News for hackers. Stuff that matters.

A comment on NSA Recommends How Enterprises Can Securely Adopt Encrypted DNS. Parent comment

Re:NSA Recommends How Enterprises Can Securely Adopt Encrypt... by toast0 on Saturday January 16, 2021 @06:07PM (#25806386)
Well known public DoH resolvers are going to have well known IPs and will be easy to block.

eSNI and the encrypted TLS handshake proposal that was floated recently rely on fetching keys via DNS, so that's not applicable for DoH, and the handshake for a DoH client will probably be easy to distinguish from an HTTPS client.

It will be easy to block, if you want to.

[ Parent | on HN ]
Re:NSA Recommends How Enterprises Can Securely Adopt Encrypt... by StreamBright on Saturday January 16, 2021 @06:18PM (#25806475)
What if well known DoH resolves are going to be in the same range as the web traffic? If you could distinguish between DoH and HTTPS easily with iptables or pf, sure. I thought it is not that easy.
[ Parent | on HN ]
Re:NSA Recommends How Enterprises Can Securely Adopt Encrypt... by toast0 on Saturday January 16, 2021 @06:45PM (#25806645)
That really depends on how much Cloudflare and Google are willing to risk.

If enough people block the published DoH resolver IPs, they'll see reduced availability on any hostname that is hosted on the same IPs; but if Cloudflare and Google put important content on the same IPs, it makes it harder to block.

[ Parent | on HN ]