Now, Encrypted DNS (thanks to DNS over TLS/HTTPS) and HTTPS (thanks to Let's Encrypt and HSTS) are getting deployed somewhat widely.
The next step is encrypted SNI[0], and it'll get this much harder to do any meaningful DPI, for censorship or else.
[0]: https://en.wikipedia.org/wiki/Server_Name_Indication#Securit...
DoH also means breaking stuff like pihole and other ad filtering. It means you trust companies like google who base their revenue off ads, or cloudflare who have censored content numerous times in the past, to serve you DNS.
its also kind of pointless if the state knows youre using it outside of a tunnel...they can just watch your next packets to see where you decided to go.
In theory, you could have Pihole resolve using a DoH resolver and your devices resolve using Pihole and have the best of everything.
(Disclaimer: Google employee, not working on ads or Chromium or DNS.)
That way you could do DNS to pihole, do the filtering and let it use DoH to the outside world.
No, it doesn't.
e.g. I run DoH behind my home's dns cache server.
>its also kind of pointless if the state knows youre using it outside of a tunnel...they can just watch your next packets to see where you decided to go.
This is where HTTPS and eSNI further help.
I think GP is referring to the fact that apps can now bypass network / os wide dns stub / recursive resolvers undetected with DoH.
> This is where HTTPS and eSNI further help.
I believe TLS v1.3 specifically has anti-censorship and anti-surveillance properties baked in: https://blog.cloudflare.com/rfc-8446-aka-tls-1-3/
Using software that doesn't respect you is the problem.
Besides Stormfront[0], what else did they censor?
I still prefer VPNs and Tor, but hey.