News for hackers. Stuff that matters.

A comment on Encrypted Client Hello – the last puzzle piece to privacy. Parent comment

Re:Encrypted Client Hello – the last puzzle piece to privacy by YeBanKo on Saturday September 30, 2023 @12:36AM (#37712795)
DNS don’t serve regular web traffic, so all the request to DNS server can be classified as DNS request. So what does it add on top of DoT?
[ Parent | on HN ]
Re:Encrypted Client Hello – the last puzzle piece to privacy by d-z-m on Saturday September 30, 2023 @04:31AM (#37713635)
It's harder to block.
[ Parent | on HN ]
Re:Encrypted Client Hello – the last puzzle piece to privacy by YeBanKo on Saturday September 30, 2023 @03:27PM (#37718867)
You can run DoT on any port, including 443. Then blocking it gonna be the same as blocking DoH. Why wrap it into HTTP request layer?
[ Parent | on HN ]
Re:Encrypted Client Hello – the last puzzle piece to privacy by d-z-m on Thursday October 05, 2023 @05:58AM (#37776681)
DoH makes the request look like a regular HTTPS request, therefore you'd need more sophisticated heuristics to block it.

If you contend that you can match the DoH SNI with a known DoH server and block that, fair enough. However, there's always another unknown DoH server you haven't blocked. Blocking DoT is trivial in comparison, because of its signature on the wire.

[ Parent | on HN ]