Timeline for Why is DNS-over-HTTPS such a big security nightmare compared to DNS-over-TLS?
Current License: CC BY-SA 4.0
7 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Oct 7, 2021 at 7:34 | history | edited | CommunityBot |
replaced https://tools.ietf.org/html/rfc with https://www.rfc-editor.org/rfc/rfc
|
|
| Aug 7, 2020 at 22:16 | comment | added | Patrick Mevzek | "DoT is any more secure than DoH", HTTP brings its own set of vulnerabilities, fingerprinting (see tools.ietf.org/html/rfc8484#section-8.2), etc. So it is a compromise. In a purely hypothetical pure Internet without broken software or hardware around, DoT makes more sense as fewer layers. Until of course you switch to DNS messages being JSON encoded instead of "as on the wire of DNS/53", which brings you other benefits (or problems) in HTTP land that you won't have in DoT. | |
| Aug 6, 2020 at 9:06 | comment | added | Esa Jokinen | @hilltothesouth: Yeah. Just couldn't cite the whole paper here. | |
| Aug 6, 2020 at 9:04 | comment | added | Esa Jokinen | @JohnZhau: Or NSA loves it when HTTPS prevents other intelligence agencies from seeing the same messages they already have access to on Facebook's servers. ;) | |
| Aug 6, 2020 at 8:42 | comment | added | hilltothesouth | @esa-jokinen Thank you for linking the SANS Institute whitepaper. I haven't read through all of it yet, but even these researchers seem to wonder if, other than the different port which can easily be blocked, DoT is any more secure than DoH. The very next paragraph after the ones you shared states: "As of this writing, there was less risk posed by DoT as a malicious vector than DoH. First, information security news outlets have not widely reported the use of DoT-based malware using TCP port 853... Malicious activity using DoT may be a future risk, but the current threat is not high." | |
| Aug 6, 2020 at 8:28 | comment | added | ChocolateOverflow | Encrypting your data gives you privacy but the NSA hates it when they can't see your Facebook messages because that encryption is making them unable to snoop on the bad guys' (and your) data to "make everyone safer". | |
| Aug 6, 2020 at 7:56 | history | answered | Esa Jokinen | CC BY-SA 4.0 |