Improving DNS Privacy with Oblivious DoH

Post by d3nj4l » Tue, Dec 08, 2020, 2:13 PM UTC

ignoramous wrote: post #52

darkwater wrote: post #43

Until we get rid of SNI[1] in HTTPS for good there will still be providers (like my ISP) that do deep packet inspection on SNI and kill the connection right away if you happen to visit a forbidden site (and this was western Europe, yesterday, on a site behind CloudFlare) [1] https://en.m.wikipedia.org/wiki/Server_Name_Indication

You can bypass SNI inspection [0] with tools like GreenTunnel [1] and Intra [2]. [0] https://twitter.com/vinifortuna/status/1304189371688660992 [1] https://news.ycombinator.com/item?id=22654737 [2] https://getintra.org/

Post by cblconfederate » Tue, Dec 08, 2020, 2:14 PM UTC

jgrahamc wrote: post #40

cblconfederate wrote: post #32

> Sullivan said a few partner organizations are already running proxies, allowing for early adopters to begin using the technology through Cloudflare’s existing 1.1.1.1 DNS resolver. In other words, in order to thwart efforts to make the internet anonymous , US companies are planning to takeover DNS for the vast majority of people.

Oh, please. ODoH is a proposed standard. Use whatever the hell proxy/resolver you feel like, wherever you like. DNS is a shit show of unencrypted data flying around being scooped up by God-knows-who and along comes someone proposing a standard to fix said shit show and this is the response people get.

Post by alecco » Tue, Dec 08, 2020, 2:15 PM UTC

jaimex2 wrote: post #55

Whats the point? Governments subpoena the information or just block the protocol outright. ( or in China, get it delivered to their door by Apple ) Commercial parties have a bag full of tricks from fingerprinting to embeds on the page itself to track you. Privacy seeking users are already tunneling their traffic. That leaves script kiddies at Internet cafes. TLS kind of fixed that already so... Good work?

Post by judge2020 » Tue, Dec 08, 2020, 2:16 PM UTC

darkwater wrote: post #43

Until we get rid of SNI[1] in HTTPS for good there will still be providers (like my ISP) that do deep packet inspection on SNI and kill the connection right away if you happen to visit a forbidden site (and this was western Europe, yesterday, on a site behind CloudFlare) [1] https://en.m.wikipedia.org/wiki/Server_Name_Indication

Post by baskire » Tue, Dec 08, 2020, 2:21 PM UTC

landerwust wrote: post #5

Opened this post expecting to be hating on another power grab dressed up as protocol engineering, but this one seems to actively /reduce/ the centralization of user data collection in DoH. Props to Cloudflare, I'm impressed.