|
|
Subscribe / Log in / New account

Trust?

Trust?

Posted May 30, 2025 21:41 UTC (Fri) by Cyberax (✭ supporter ✭, #52523)
In reply to: Trust? by brunowolff
Parent article: System-wide encrypted DNS

> Please actually read the comments you are replying to more carefully. DOH does not keep your ISP from seeing where you connect to.

It does. It obscures the host name, so mere passive probing is insufficient for reliable detection. The ISP will have to actively probe the target host to find out what it serves, which also fails if it is a multiplexing load balancer.

Moreover, traffic monitoring is an order of magnitude more complex and expensive than just passively snooping on DNS requests. That's because traffic is usually handled completely in the dataplane of routers, and diverting it for inspection is expensive. But diverting a handful of DNS packets per minute for a typical host? That's easy.

So in practice, DoH/DoT will increase the privacy.


to post comments


Copyright © 2025, Eklektix, Inc.
Comments and public postings are copyrighted by their creators.
Linux is a registered trademark of Linus Torvalds