Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!

 



Forgot your password?
typodupeerror
×

Comment Clearly a PR piece (Score 1) 255

The way we can tell that this slashdot post is a PR agency product is the information is presented as de facto, as if stating something is not correct makes it not correct. The only predictable result from this is to make the supporters of these things believe even more strongly and the people who don't believe to think those people just stupid naves, with the ultimate and predictable result being derision.

Comment Re:What about DoT?? (Score 3, Informative) 67

DNS over TLS is already done by systemd-resolved on Linux, so if anyone wanted to go that route, they could already do so.

How is this accomplished without knowing if the server can respond to DoT? Even at the firewall level it seems like some defined intermediary (Cloudflare, Quad9, Google, etc.) DoT server is required.

Have you noticed that in these discussions nobody seems to mention that DoT and DoH can prevent modifying DNS queries?

I found interesting this paragraph from a PowerDNS blog entry:

DNS over HTTPS offers additional tracking capabilities

DNS over HTTPS opens up DNS to all the tracking possibilities present in HTTPS and TLS. As it stands, DNS over UDP almost always gets some free privacy by mixing all devices on a network together – an outside snooper sees a stream of queries coming from a household, a coffeeshop or even an entire office building, with no way to tie a query to any specific device or user. Such mixing of queries provides an imperfect but useful modicum of privacy.

DNS over HTTPS however neatly separates out each device (and even each individual application on that device) to a separate query stream. This alone is worrying, as we now have individual users’ queries, but the TLS that underlies HTTPS also typically uses TLS Resumption which offers even further tracking capabilities.

In short, setting up an encrypted connection eats up precious CPU cycles both on client and server. It is therefore possible to reuse a previously established encrypted state for subsequent connections, which saves a lot of time and processor energy.

It does however make it possible to track an application from IP address to IP address because this TLS Resumption session ID is effectively a cookie that uniquely tracks users across network and IP address changes.

Slashdot Top Deals

The Tao is like a glob pattern: used but never used up. It is like the extern void: filled with infinite possibilities.

Working...