On 2019-12-23 10:04 AM, Giles Orr via talk wrote:
Firefox now makes available DNS-over-HTTPS. I'm a big fan of security
and privacy, but I'm struggling to see the gains here: we stop some
hypothetical observer from finding out what domain name we're querying
... and then immediately turn around and ask that domain for a web
page. You hid the destination in your first query ... only to
immediately expose it with your next query.
I admit I'm thinking of our hypothetical advisor being at the ISP:
they'll see both types of queries anyway. I suppose the argument can
be made that an observer on the path to the DNS but not at the ISP has
been stymied, but this seems ... lower value. Still, is that
primarily what this will stop?
I also wonder about that. I can understand DNSSEC, to prevent DNS
highjacking, etc.. Also, this means that TCP will be required, complete
with the full sync/ack process, whereas DNS normally uses UDP.
---
Post to this mailing list [email protected]
Unsubscribe from this mailing list https://gtalug.org/mailman/listinfo/talk
