undefined | Better HN

0 pointsem-bee1y ago0 comments

A caveat of encrypted DNS is that it has to be bootstrapped via traditional, unencrypted DNS or via a well-known set of IPs. Currently, most clients using DoH/DoT use one of a small handful of providers. Cloudflare, Google, Quad9, etc. A motivated government could block those endpoints pretty easily.

not if DNS is hosted on the same servers as eg google search itself. then they would have to block google search in order to block DNS.

0 comments

brookst1y ago

…or use higher-level packet analysis to filter DoH.

ronsor1y ago

That kind of DPI is computationally expensive to the point China doesn't even do it much.

inkyoto1y ago

Not anymore and mainland Chinese manufacturers sell them on in large numbers to autocratic governments.

Such devices have a pretty simple architecture: the highly performant data plane where DPI is implemented in the hardware (using either ASIC's or FPGA's – don't have enough information), and the control plane. The control plane comes with a SDK of sorts that DPI appliance users can use to tailor the appliance to their environment and that is used to «refine» the data plane behaviour, i.e. sending down / updating DPI pattern matching / processing rules.

myrandomcomment1y ago

OMG, they very much do. It is not on 100% of the traffic but at any given time a more then smaller % is subject to DPI.

zamadatix1y ago

With HTTP/3 there isn't much higher level packet analysis to do between anything useful in the headers being encrypted and the session being reused. All you see is there is a 443 UDP session to a Google server and encrypted packets keep getting sent back and forth... which looks exactly like any other HTTP/3 session to a Google server.

I think the weak points are wholly untechnical e.g. Google would often give in to protect the $$$ they make in a region.

toast01y ago

Packet size (i forget if http/3 does padding) and packet rates are still available, dns looks a lot different than most http content.

1 more reply

BlueTemplar1y ago

Then they will block Google Search and blame it on Google ?

j / k navigate · click thread line to collapse