Re:Encrypted Client Hello – the last puzzle piece to privacy
by YeBanKo on Saturday September 30, 2023 @12:36AM
(#37712795)
DNS don’t serve regular web traffic, so all the request to DNS server can be classified as DNS request. So what does it add on top of DoT?
Re:Encrypted Client Hello – the last puzzle piece to privacy
by d-z-m on Saturday September 30, 2023 @04:31AM
(#37713635)
It's harder to block.
Re:Encrypted Client Hello – the last puzzle piece to privacy
by YeBanKo on Saturday September 30, 2023 @03:27PM
(#37718867)
You can run DoT on any port, including 443. Then blocking it gonna be the same as blocking DoH. Why wrap it into HTTP request layer?
Re:Encrypted Client Hello – the last puzzle piece to privacy
by d-z-m on Thursday October 05, 2023 @05:58AM
(#37776681)
DoH makes the request look like a regular HTTPS request, therefore you'd need more sophisticated heuristics to block it.
If you contend that you can match the DoH SNI with a known DoH server and block that, fair enough. However, there's always another unknown DoH server you haven't blocked. Blocking DoT is trivial in comparison, because of its signature on the wire.
The ISP doesn't see the DNS request, therefore added privacy(you are presumably contacting a DoH server whom you trust). ISPs can pretty much get away with blocking port 853 without much flak(fairly niche, not much use), but if customers' DoH queries to Cloudflare aren't getting out, people are going to notice.