Hacker News Reader

Comment by pitaj | Hacker News Reader

All you need is to point DoH at your own DNS server

You can't do that with a Chromecast. The goal here is to sell devices which can ensure they always talk to their own DoH endpoint with no ability to secure it.

Chromecast was already bypassing local DNS for years before DoH was even conceived.

Blocking people from using DoH isn't going to solve the problem you are describing, it will just weaken users' privacy. Big vendors like Google will just create their own workarounds.

> Chromecast was already bypassing local DNS for years before DoH was even conceived.

Before DoH though, my understanding is a good gateway appliance could just overwrite those DNS requests as it sees them. Now they'll be encrypted, and you'll have no way to tell the Chromecast where to connect (or even to where it is connecting).

If the possibility of having the DNS packets rewritten was a concern for them, any junior developer could have easily implemented a proprietary REST web service to get the IPs over HTTPS just like DoH. Standardization of DoH in browsers isn't really furthering that issue.

How would they get the first IP for the REST client to contact?

That problem isn't solved by DoH, you still need to hardcode the DoH server IP there too if you intend to bypass the network level settings. So a proprietary system would be no different.

All the major appliance vendors (Google, Amazon) already have huge fixed IP ranges to devote to this purpose, which are effectively unblockable because they might be shared with important cloud services.

Reply on news.ycombinator.com